renovate-custom.json5

// Repo-specific Renovate rules for devctl, layered on top of the generated
// renovate.json5 (which extends this file last). devctl never touches this
// file. Rules for a whole class of repos belong in giantswarm/renovate-presets.
//
// devctl is special: it is the generator. Several upstream tool versions are
// pinned inside the generator's own source (Go constants, golden fixtures, and
// workflow templates) rather than in a manifest a built-in manager understands,
// so the custom managers below keep them current. These were dropped from
// renovate.json5 by the 2026-06-24 align-files run (#2030) and restored here.
{
  // Let the github-actions manager also scan the workflow templates devctl
  // emits, so action versions baked into the templates get bumped too.
  // Also the mctl goldens, so template and golden bump in one PR.
  'github-actions': {
    managerFilePatterns: [
      '/.*.yaml.template$/',
      '/pkg/gen/input/workflows/testdata/mctl_.*\\.yaml\\.golden$/',
    ],
  },
  customManagers: [
    // The orb versions baked into the `gen circleci` generator, pinned as Go
    // constants next to the config template so a major orb bump forces a devctl
    // release rather than silently skewing against a stale template. Renovate
    // bumps them here, not in giantswarm/github.
    //
    // The giantswarm/architect entry is tracked via github-tags on the
    // architect-orb source repo (not the `orb` datasource): the generated
    // renovate.json5 disables `orb` updates for giantswarm/architect (so they
    // stop fighting align-files in .circleci/config.yml), and that root rule
    // would otherwise also block the constant. github-tags on architect-orb
    // carries the same versions and is not matched by the disable rule.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/circleci/circleci\\.go$/'],
      matchStrings: [
        '// renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\n\\s*const \\w*OrbVersion = "(?<currentValue>[^"]+)"',
      ],
    },
    // The cimg/node tag the generated Node job runs on, pinned as a Go constant
    // beside the orb pins and for the same reason. It carries the same
    // `// renovate:` annotation, but the rule above is anchored on
    // `\w*OrbVersion` and so never matched it: the constant sat at its
    // introduction value from #2052 with no PR ever opened against it, while
    // cimg/node moved on. It is the floor for every repo that pins no .nvmrc,
    // so a frozen default is a frozen Node for all of them.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/circleci/circleci\\.go$/'],
      matchStrings: [
        '// renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\n\\s*const \\w*ImageVersion = "(?<currentValue>[^"]+)"',
      ],
    },
    // The golden fixtures render the same cimg/node tag the constant above
    // sets, so they must move in the same PR or the byte-for-byte golden tests
    // go red on every Node bump -- the same coupling the architect-orb fixture
    // manager below solves. Both the executor image and the cache-key salt are
    // matched, since the generator derives them from one value.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/circleci/testdata/.*\\.workflows\\.yml$/'],
      matchStrings: [
        'image: cimg/node:(?<currentValue>\\S+)',
        'node-build-[\\w-]+-v\\d+-(?<currentValue>\\d+\\.\\d+\\.\\d+)-',
      ],
      depNameTemplate: 'cimg/node',
      datasourceTemplate: 'docker',
    },
    // The golden fixtures render the kind node tag ATSKindNodeImageVersion sets
    // (matched by the `\w*ImageVersion` constant rule above), so they move in
    // the same PR.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/circleci/testdata/.*\\.workflows\\.yml$/'],
      matchStrings: ['gsoci\\.azurecr\\.io/giantswarm/kind-node:(?<currentValue>v[\\w.-]+)'],
      depNameTemplate: 'gsoci.azurecr.io/giantswarm/kind-node',
      datasourceTemplate: 'docker',
    },
    // The golden fixtures pin the same orb versions the generator emits. Same
    // depName/datasource as the constants above, so Renovate bumps constant and
    // goldens in one PR and the byte-for-byte golden tests stay green -- without
    // this, every orb bump needs a manual fixture regen.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/circleci/testdata/.*\\.workflows\\.yml$/'],
      matchStrings: ['architect: giantswarm/architect@(?<currentValue>\\S+)'],
      depNameTemplate: 'giantswarm/architect-orb',
      datasourceTemplate: 'github-tags',
    },
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/circleci/testdata/setup\\.config\\.yml$/'],
      matchStrings: ['continuation: circleci/continuation@(?<currentValue>\\S+)'],
      depNameTemplate: 'circleci/continuation',
      datasourceTemplate: 'orb',
    },
    // mctl image tag (MctlVersion) and the goldens that render it.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/workflows/internal/file/mctl\\.go$/'],
      matchStrings: [
        '// renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\n\\s*const MctlVersion = "(?<currentValue>[^"]+)"',
      ],
    },
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/workflows/testdata/mctl_.*\\.yaml\\.golden$/'],
      matchStrings: ['gsoci\\.azurecr\\.io/giantswarm/mctl:(?<currentValue>\\d+\\.\\d+\\.\\d+)'],
      depNameTemplate: 'gsoci.azurecr.io/giantswarm/mctl',
      datasourceTemplate: 'docker',
    },
    // Pre-commit hook revisions in the pre-commit config template.
    // The built-in pre-commit manager cannot parse this file because it contains
    // Go template directives ({{- if ... }}) that make the YAML invalid.
    {
      customType: 'regex',
      managerFilePatterns: ['/pre-commit-config\\.yaml\\.template$/'],
      matchStrings: [
        '- repo: https://github\\.com/(?<depName>[^\\n]+)\\n\\s+rev: [\'"]?(?<currentValue>[^\'"\\n]+)',
      ],
      datasourceTemplate: 'github-tags',
    },
    // `schemalint` (normalizer) and `helm-values-schema-json` (generator) used to be
    // pinned as literals in the pre-commit config template and needed a custom manager
    // here. devctl#2195 made it import both as Go libraries and stamp the template's
    // `additional_dependencies` and the `schemalint-verify` `rev:` from its own go.mod, so
    // the built-in gomod manager is now the single place either version moves. Nothing in
    // the template carries a literal version for them any more, and a regex manager that
    // matched one would fight go.mod.
    // helm-docs version pinned as an env var in the pre-commit GitHub Actions workflow
    // template, and passed to the reusable sync-from-upstream workflow, which installs the
    // same tools to run the same hooks. Both pins have to move in one PR: sync-from-upstream
    // commits whatever the hooks rewrite, so a skew against the consumer's own pre-commit
    // job makes every sync PR fail its schema check.
    // Renovate will consolidate updates with the pre-commit hook rev for the same package.
    {
      customType: 'regex',
      managerFilePatterns: [
        '/pre-commit-action\\.yaml\\.template$/',
        '/sync_from_upstream\\.yaml\\.template$/',
      ],
      matchStrings: [
        'HELM_DOCS_VERSION: "(?<currentValue>[^"]+)"',
        'helm_docs_version: \'(?<currentValue>[^\']+)\'',
      ],
      depNameTemplate: 'norwoodj/helm-docs',
      datasourceTemplate: 'github-releases',
    },
    // golangci-lint version used in install-binary-action. The two-line match avoids
    // false-positives with other `version:` fields in the same file.
    {
      customType: 'regex',
      managerFilePatterns: ['/pre-commit-action\\.yaml\\.template$/'],
      matchStrings: ['binary: golangci-lint\\n\\s+version: "(?<currentValue>[^"]+)"'],
      depNameTemplate: 'golangci/golangci-lint',
      datasourceTemplate: 'github-releases',
    },
    // goimports module version pinned in a `go install` run step.
    {
      customType: 'regex',
      managerFilePatterns: ['/pre-commit-action\\.yaml\\.template$/'],
      matchStrings: ['go install golang\\.org/x/tools/cmd/goimports@(?<currentValue>[^\\s]+)'],
      depNameTemplate: 'golang.org/x/tools',
      datasourceTemplate: 'go',
    },
    // Pins in the generator's templates that carry the standard `# renovate:` annotation.
    // Nothing else matches these pins: renovate-presets anchors its Makefile manager on
    // `/^Makefile\..+\.mk$/`, which no nested `*.mk.template` matches, and its other
    // managers read `# repo:` / `# registry:` comment lines instead. The built-in
    // github-actions manager does scan the `*.yaml.template` files (see above), but it reads
    // `uses:` lines, not an annotation above an `env:` entry. One entry for the whole
    // annotation form, so a new pin needs only the comment above it -- written as
    // `# renovate: datasource=X depName=Y [versioning=Z]` on the line directly above a single
    // `NAME ?= value` (Makefile fragment) or `NAME: value` (workflow env block). Any other
    // shape silently stops being matched, with no error. The optional versioning capture is
    // what keeps a `versioning=` annotation matching at all.
    // The generated copies in app repos stay uncovered on purpose: align-files regenerates
    // them from here, so a per-repo bump would only fight the regeneration.
    //
    // Kyverno is tracked against giantswarm/kyverno-crds, so the chainsaw tests run the
    // version we ship rather than whatever upstream released last. It is pinned twice, in the
    // Makefile fragment and in the workflow env block, and both carry the annotation, so they
    // move in one PR: the workflow env wins in CI, the Makefile default is what a local
    // `make install-kyverno` uses.
    {
      customType: 'regex',
      managerFilePatterns: ['/pkg/gen/input/.*\\.template$/'],
      matchStrings: [
        '# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: versioning=(?<versioning>\\S+))?\\n\\s*\\w+ \\?= (?<currentValue>\\S+)',
        '# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: versioning=(?<versioning>\\S+))?\\n\\s*\\w+: (?<currentValue>\\S+)',
      ],
      versioningTemplate: '{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}',
    },
  ],
  packageRules: [
    {
      // kind and the kindest/node image it boots are released and tested as a pair, so a
      // chainsaw run on a mismatched pair is untested ground. One PR for both, so the review
      // sees the combination rather than two halves of it.
      matchPackageNames: ['kubernetes-sigs/kind', 'kindest/node'],
      groupName: 'kind',
    },
    {
      // architect-orb git tags are vX.Y.Z; the pinned constant and the golden
      // fixtures hold the bare version, so strip the leading `v` before
      // comparison. Scoped to the architect-orb source repo, so it never
      // touches the `orb`-datasource giantswarm/architect the root config
      // disables.
      matchDatasources: ['github-tags'],
      matchPackageNames: ['giantswarm/architect-orb'],
      extractVersion: '^v(?<version>.+)$',
    },
    {
      // The canonical ATS (app-test-suite) Pipfile is embedded here and
      // generated verbatim into every chart/app repo's tests/ats/Pipfile by
      // `devctl gen circleci`. It is the single source the built-in pipenv
      // manager bumps -- group the whole stack into one PR so the pins move
      // together (and stay mutually resolvable, e.g. pytest inside the range
      // pytest-helm-charts declares), then propagate to all repos via one align-files
      // regeneration. The per-repo copies are disabled for Renovate via
      // renovate-presets:tests-ats.json5, so this is the only place the stack
      // is updated.
      // The uv layout of the same stack (pyproject.toml + uv.lock, emitted for
      // app-test-suite 1.x repos) lives next to it and is bumped by the pep621
      // manager; the group keeps both layouts on identical pins in one PR.
      matchManagers: ['pipenv', 'pep621'],
      matchFileNames: ['pkg/gen/input/ats/internal/file/Pipfile', 'pkg/gen/input/ats/internal/file/pyproject.toml'],
      groupName: 'ATS test dependencies',
    },
    {
      // The `schemalint-verify` `rev:` in the pre-commit config template is now
      // `{{ $.SchemalintVersion }}`, stamped from devctl's own go.mod (devctl#2195), so the
      // generic `- repo:`/`rev:` manager above captures a template expression instead of a
      // version. Disable that entry: go.mod is the single pin, and the gomod manager moves
      // it under the `github.com/giantswarm/schemalint/v2` name below.
      matchDepNames: ['giantswarm/schemalint'],
      enabled: false,
    },
    {
      // A schemalint major moves the Go module path (`/v2` -> `/v3`), which the gomod
      // manager cannot rewrite -- go.mod and the import in
      // pkg/gen/input/precommit/internal/file/values_schema.go need a hand edit together.
      // Park majors on the dependency dashboard instead of opening a PR that cannot build.
      matchDepNames: ['github.com/giantswarm/schemalint/v2'],
      matchUpdateTypes: ['major'],
      dependencyDashboardApproval: true,
    },
  ],
}