From 74a252561d4d3ad10cbd427b0a27fa2f1ac4d3b9 Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Tue, 30 Jun 2026 11:36:37 +0200 Subject: [PATCH 1/7] chore(deps): track external tool binaries from GitHub releases (tier 1) Add Renovate tracking annotations for external tools downloaded as prebuilt binaries from GitHub releases: - FLS (jumpstarter-dev/fls) in python/Containerfile - Renode (renode/renode) in python-tests workflow, extracted to env var - CFSSL (cloudflare/cfssl) in e2e/setup-e2e.sh - YQ (mikefarah/yq) in e2e/setup-e2e.sh - Operator SDK in controller/deploy/operator/Makefile - OPM (operator-framework/operator-registry) extracted from inline URL to OPM_VERSION variable in controller/deploy/operator/Makefile Add custom regex managers to renovate.jsonc for Makefiles, shell scripts, and GitHub Actions YAML env blocks. Group operator tooling and e2e test tools in packageRules. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/python-tests.yaml | 6 +++- controller/deploy/operator/Makefile | 5 ++- e2e/setup-e2e.sh | 2 ++ python/Containerfile | 1 + renovate.jsonc | 47 +++++++++++++++++++++++++++++ 5 files changed, 59 insertions(+), 2 deletions(-) diff --git a/.github/workflows/python-tests.yaml b/.github/workflows/python-tests.yaml index 3fd327296..c34ea5599 100644 --- a/.github/workflows/python-tests.yaml +++ b/.github/workflows/python-tests.yaml @@ -119,8 +119,12 @@ jobs: - name: Install Renode (Linux) if: runner.os == 'Linux' + env: + # renovate: datasource=github-releases depName=renode/renode + RENODE_VERSION: v1.16.1 run: | - wget https://github.com/renode/renode/releases/download/v1.16.1/renode_1.16.1_amd64.deb -O /tmp/renode.deb + RENODE_TAG="${RENODE_VERSION#v}" + wget "https://github.com/renode/renode/releases/download/${RENODE_VERSION}/renode_${RENODE_TAG}_amd64.deb" -O /tmp/renode.deb sudo apt-get install -y /tmp/renode.deb - name: Install Qemu (macOS) diff --git a/controller/deploy/operator/Makefile b/controller/deploy/operator/Makefile index 9448672e1..946aeab34 100644 --- a/controller/deploy/operator/Makefile +++ b/controller/deploy/operator/Makefile @@ -60,7 +60,10 @@ endif # Set the Operator SDK version to use. By default, what is installed on the system is used. # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit. +# renovate: datasource=github-releases depName=operator-framework/operator-sdk OPERATOR_SDK_VERSION ?= v1.41.1 +# renovate: datasource=github-releases depName=operator-framework/operator-registry +OPM_VERSION ?= v1.55.0 # Image URL to use all building/pushing image targets IMG ?= $(IMAGE_TAG_BASE):$(VERSION) @@ -362,7 +365,7 @@ ifeq (,$(shell which opm 2>/dev/null)) set -e ;\ mkdir -p $(dir $(OPM)) ;\ OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \ - curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.55.0/$${OS}-$${ARCH}-opm ;\ + curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/$(OPM_VERSION)/$${OS}-$${ARCH}-opm ;\ chmod +x $(OPM) ;\ } else diff --git a/e2e/setup-e2e.sh b/e2e/setup-e2e.sh index 1eebb24ec..fb58e84d0 100755 --- a/e2e/setup-e2e.sh +++ b/e2e/setup-e2e.sh @@ -58,7 +58,9 @@ install_dependencies() { # Step 2: Install e2e tools (cfssl, cfssljson, yq) as prebuilt binaries E2E_TOOLS_BIN="$REPO_ROOT/.e2e/bin" +# renovate: datasource=github-releases depName=cloudflare/cfssl extractVersion=^v(?.+)$ CFSSL_VERSION="1.6.5" +# renovate: datasource=github-releases depName=mikefarah/yq YQ_VERSION="v4.52.5" # SHA256 checksums for prebuilt binaries (from upstream release assets) diff --git a/python/Containerfile b/python/Containerfile index ea9bb606b..39c331d55 100644 --- a/python/Containerfile +++ b/python/Containerfile @@ -12,6 +12,7 @@ RUN dnf install -y python3 ustreamer libusb1 android-tools python3-libgpiod curl dnf clean all && \ rm -rf /var/cache/dnf +# renovate: datasource=github-releases depName=jumpstarter-dev/fls ARG FLS_VERSION=0.3.0 RUN ARCH=$(uname -m) && \ SUFFIX="linux" && \ diff --git a/renovate.jsonc b/renovate.jsonc index ac7b294a4..e09bf8411 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -68,6 +68,36 @@ "depNameTemplate": "astral-sh/uv", "datasourceTemplate": "github-releases", "versioningTemplate": "semver" + }, + { + "description": "Track GitHub release binaries in Makefiles via inline annotations", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)Makefile$/" + ], + "matchStrings": [ + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n[A-Z_]+\\s*\\??=\\s*(?[^\\s]+)" + ] + }, + { + "description": "Track GitHub release binaries in shell scripts via inline annotations", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)[^/]+\\.sh$/" + ], + "matchStrings": [ + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n[A-Z_]+=(?:\"|')(?[^\"']+)(?:\"|')" + ] + }, + { + "description": "Track GitHub release binaries in GitHub Actions YAML env blocks", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)\\.github/workflows/[^/]+\\.ya?ml$/" + ], + "matchStrings": [ + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n\\s+[A-Z_]+:\\s*(?[^\\s]+)" + ] } ], "packageRules": [ @@ -246,6 +276,23 @@ ], "allowedVersions": "/^\\d+\\.\\d+\\.\\d+$/", "automerge": false + }, + { + "description": "Group operator tooling (operator-sdk, OPM, scorecard-test)", + "groupName": "operator-tooling", + "matchDepNames": [ + "operator-framework/operator-sdk", + "operator-framework/operator-registry", + "quay.io/operator-framework/scorecard-test" + ] + }, + { + "description": "Group e2e test tools (cfssl, yq)", + "groupName": "e2e-test-tools", + "matchDepNames": [ + "cloudflare/cfssl", + "mikefarah/yq" + ] } ] } From 2376c6966d59865ac02639d7195bb43fd2f432b4 Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Tue, 30 Jun 2026 11:37:50 +0200 Subject: [PATCH 2/7] chore(deps): track Go build tools via Renovate annotations (tier 2) Add Renovate tracking annotations for Go tools installed via go install: - kustomize (kubernetes-sigs/kustomize) - controller-gen (kubernetes-sigs/controller-tools) - golangci-lint (golangci/golangci-lint) - kind (kubernetes-sigs/kind) - grpcurl (fullstorydev/grpcurl) - envtest K8s version (kubernetes/kubernetes) Fix version drift between controller/Makefile and controller/deploy/operator/Makefile by aligning to newer versions: - kustomize: v5.4.1 -> v5.6.0 - controller-gen: v0.16.3 -> v0.18.0 Group Go build tools in a packageRule so Renovate updates them together across both Makefiles. Co-Authored-By: Claude Opus 4.6 (1M context) --- controller/Makefile | 10 ++++++++-- controller/deploy/operator/Makefile | 3 +++ renovate.jsonc | 14 ++++++++++++++ 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/controller/Makefile b/controller/Makefile index f057b134f..ccaf961b4 100644 --- a/controller/Makefile +++ b/controller/Makefile @@ -5,6 +5,7 @@ IMG ?= quay.io/jumpstarter-dev/jumpstarter-controller:latest DOCKER_REPO = $(shell echo $(IMG) | cut -d: -f1) DOCKER_TAG = $(shell echo $(IMG) | cut -d: -f2) # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary. +# renovate: datasource=github-releases depName=kubernetes/kubernetes extractVersion=^v(?.+)$ ENVTEST_K8S_VERSION = 1.30.0 # Version information @@ -224,11 +225,16 @@ KIND = $(LOCALBIN)/kind GRPCURL = $(LOCALBIN)/grpcurl ## Tool Versions -KUSTOMIZE_VERSION ?= v5.4.1 -CONTROLLER_TOOLS_VERSION ?= v0.16.3 +# renovate: datasource=github-releases depName=kubernetes-sigs/kustomize extractVersion=^kustomize/(?v\d+\.\d+\.\d+)$ +KUSTOMIZE_VERSION ?= v5.6.0 +# renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools +CONTROLLER_TOOLS_VERSION ?= v0.18.0 ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}') +# renovate: datasource=github-releases depName=golangci/golangci-lint GOLANGCI_LINT_VERSION ?= v2.5.0 +# renovate: datasource=github-releases depName=kubernetes-sigs/kind KIND_VERSION ?= v0.27.0 +# renovate: datasource=github-releases depName=fullstorydev/grpcurl GRPCURL_VERSION ?= v1.9.2 .PHONY: kustomize diff --git a/controller/deploy/operator/Makefile b/controller/deploy/operator/Makefile index 946aeab34..5e572a906 100644 --- a/controller/deploy/operator/Makefile +++ b/controller/deploy/operator/Makefile @@ -250,12 +250,15 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest GOLANGCI_LINT = $(LOCALBIN)/golangci-lint ## Tool Versions +# renovate: datasource=github-releases depName=kubernetes-sigs/kustomize extractVersion=^kustomize/(?v\d+\.\d+\.\d+)$ KUSTOMIZE_VERSION ?= v5.6.0 +# renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools CONTROLLER_TOOLS_VERSION ?= v0.18.0 #ENVTEST_VERSION is the version of controller-runtime release branch to fetch the envtest setup script (i.e. release-0.20) ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}') #ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31) ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}') +# renovate: datasource=github-releases depName=golangci/golangci-lint GOLANGCI_LINT_VERSION ?= v2.5.0 .PHONY: kustomize diff --git a/renovate.jsonc b/renovate.jsonc index e09bf8411..2463a82a9 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -293,6 +293,20 @@ "cloudflare/cfssl", "mikefarah/yq" ] + }, + { + "description": "Group Go build tools across both controller Makefiles", + "groupName": "go-build-tools", + "matchManagers": [ + "custom.regex" + ], + "matchDepNames": [ + "kubernetes-sigs/kustomize", + "kubernetes-sigs/controller-tools", + "golangci/golangci-lint", + "kubernetes-sigs/kind", + "fullstorydev/grpcurl" + ] } ] } From 7caba8b00719eb4ff7c1ce44233803f0bd66a132 Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Tue, 30 Jun 2026 11:39:18 +0200 Subject: [PATCH 3/7] chore(deps): track infrastructure manifest versions via Renovate (tier 3) Add Renovate tracking for infrastructure manifests downloaded at runtime: - cert-manager (cert-manager/cert-manager) in Go test utils and Python operator.py - prometheus-operator (prometheus-operator/prometheus-operator) in Go test utils Fix version drift between controller/test/utils/utils.go and controller/deploy/operator/test/utils/utils.go: - cert-manager: v1.14.4 -> v1.19.2 - prometheus-operator: v0.72.0 -> v0.77.1 Also fix stale cert-manager download URL from jetstack/cert-manager to cert-manager/cert-manager (project moved orgs). Add custom regex managers for Go (.go) and Python (.py) source files to pick up inline Renovate annotations. Group cert-manager and prometheus-operator in an infrastructure-manifests packageRule. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../deploy/operator/test/utils/utils.go | 2 ++ controller/test/utils/utils.go | 8 ++++-- .../cluster/operator.py | 1 + renovate.jsonc | 28 +++++++++++++++++++ 4 files changed, 36 insertions(+), 3 deletions(-) diff --git a/controller/deploy/operator/test/utils/utils.go b/controller/deploy/operator/test/utils/utils.go index a39fca970..555344f67 100644 --- a/controller/deploy/operator/test/utils/utils.go +++ b/controller/deploy/operator/test/utils/utils.go @@ -28,10 +28,12 @@ import ( ) const ( + // renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator prometheusOperatorVersion = "v0.77.1" prometheusOperatorURL = "https://github.com/prometheus-operator/prometheus-operator/" + "releases/download/%s/bundle.yaml" + // renovate: datasource=github-releases depName=cert-manager/cert-manager certmanagerVersion = "v1.19.2" certmanagerURLTmpl = "https://github.com/cert-manager/cert-manager/releases/download/%s/cert-manager.yaml" ) diff --git a/controller/test/utils/utils.go b/controller/test/utils/utils.go index 0deb50a31..fe909c7c2 100644 --- a/controller/test/utils/utils.go +++ b/controller/test/utils/utils.go @@ -26,12 +26,14 @@ import ( ) const ( - prometheusOperatorVersion = "v0.72.0" + // renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator + prometheusOperatorVersion = "v0.77.1" prometheusOperatorURL = "https://github.com/prometheus-operator/prometheus-operator/" + "releases/download/%s/bundle.yaml" - certmanagerVersion = "v1.14.4" - certmanagerURLTmpl = "https://github.com/jetstack/cert-manager/releases/download/%s/cert-manager.yaml" + // renovate: datasource=github-releases depName=cert-manager/cert-manager + certmanagerVersion = "v1.19.2" + certmanagerURLTmpl = "https://github.com/cert-manager/cert-manager/releases/download/%s/cert-manager.yaml" ) func warnError(err error) { diff --git a/python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/cluster/operator.py b/python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/cluster/operator.py index 7987682a8..a81003e68 100644 --- a/python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/cluster/operator.py +++ b/python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/cluster/operator.py @@ -7,6 +7,7 @@ from ..exceptions import ClusterOperationError from .common import GRPC_NODEPORT, LOGIN_NODEPORT, ROUTER_NODEPORT, run_command, run_command_with_output +# renovate: datasource=github-releases depName=cert-manager/cert-manager CERTMANAGER_VERSION = "v1.19.2" OPERATOR_INSTALLER_URL_TEMPLATE = ( "https://github.com/jumpstarter-dev/jumpstarter/releases/download/{version}/operator-installer.yaml" diff --git a/renovate.jsonc b/renovate.jsonc index 2463a82a9..1ba0d01b4 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -98,6 +98,26 @@ "matchStrings": [ "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n\\s+[A-Z_]+:\\s*(?[^\\s]+)" ] + }, + { + "description": "Track versioned dependencies in Go source files via inline annotations", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)[^/]+\\.go$/" + ], + "matchStrings": [ + "//\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n\\s+\\w+\\s*=\\s*\"(?[^\"]+)\"" + ] + }, + { + "description": "Track versioned dependencies in Python source files via inline annotations", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)[^/]+\\.py$/" + ], + "matchStrings": [ + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n[A-Z_]+\\s*=\\s*\"(?[^\"]+)\"" + ] } ], "packageRules": [ @@ -294,6 +314,14 @@ "mikefarah/yq" ] }, + { + "description": "Group infrastructure manifests (cert-manager, prometheus-operator)", + "groupName": "infrastructure-manifests", + "matchDepNames": [ + "cert-manager/cert-manager", + "prometheus-operator/prometheus-operator" + ] + }, { "description": "Group Go build tools across both controller Makefiles", "groupName": "go-build-tools", From 9672597ea1b32c2682f690b114ec1dfb3a8540fb Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Tue, 30 Jun 2026 11:41:11 +0200 Subject: [PATCH 4/7] chore(deps): track container images and artifacts outside Containerfiles (tier 4) Add Renovate tracking for container images and artifacts that are invisible to the dockerfile manager: - scorecard-test (quay.io/operator-framework/scorecard-test) in scorecard patch YAMLs via '# renovate: image' annotations - jumpstarter demoenv StatefulSets updated from stale 0.5.0 to latest with image tracking annotations - Fedora Cloud qcow2 version extracted to FEDORA_CLOUD_VERSION env var in python-tests workflow - bufbuild/buf pinned from unpinned 'latest' to v1.71.0 in both protocol/Makefile and controller/Makefile with Renovate annotations Add custom regex manager for YAML image annotations. Group bufbuild/buf in a buf-tooling packageRule. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/python-tests.yaml | 11 ++++++++--- controller/Makefile | 5 ++++- .../config/scorecard/patches/basic.config.yaml | 1 + .../config/scorecard/patches/olm.config.yaml | 5 +++++ .../hack/demoenv/exporters-statefulset.yaml | 3 ++- .../demoenv/vcan-exporters-statefulset.yaml | 3 ++- protocol/Makefile | 6 ++++-- renovate.jsonc | 18 ++++++++++++++++++ 8 files changed, 44 insertions(+), 8 deletions(-) diff --git a/.github/workflows/python-tests.yaml b/.github/workflows/python-tests.yaml index c34ea5599..0b6a53741 100644 --- a/.github/workflows/python-tests.yaml +++ b/.github/workflows/python-tests.yaml @@ -148,14 +148,19 @@ jobs: uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 with: path: python/packages/jumpstarter-driver-qemu/images - key: fedora-cloud-43-1.6 + key: fedora-cloud-${{ env.FEDORA_CLOUD_VERSION }} + env: + FEDORA_CLOUD_VERSION: "43-1.6" - name: Download Fedora Cloud images if: steps.cache-fedora-cloud-images.outputs.cache-hit != 'true' + env: + FEDORA_CLOUD_VERSION: "43-1.6" run: | + FEDORA_RELEASE="${FEDORA_CLOUD_VERSION%%-*}" for arch in aarch64 x86_64; do - curl -L --fail --output "python/packages/jumpstarter-driver-qemu/images/Fedora-Cloud-Base-Generic-43-1.6.${arch}.qcow2" \ - "https://iad.mirror.rackspace.com/fedora/releases/43/Cloud/${arch}/images/Fedora-Cloud-Base-Generic-43-1.6.${arch}.qcow2" + curl -L --fail --output "python/packages/jumpstarter-driver-qemu/images/Fedora-Cloud-Base-Generic-${FEDORA_CLOUD_VERSION}.${arch}.qcow2" \ + "https://iad.mirror.rackspace.com/fedora/releases/${FEDORA_RELEASE}/Cloud/${arch}/images/Fedora-Cloud-Base-Generic-${FEDORA_CLOUD_VERSION}.${arch}.qcow2" done - name: Run pytest diff --git a/controller/Makefile b/controller/Makefile index ccaf961b4..0a2ee3930 100644 --- a/controller/Makefile +++ b/controller/Makefile @@ -247,9 +247,12 @@ controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessar $(CONTROLLER_GEN): $(LOCALBIN) $(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION)) +# renovate: datasource=docker depName=docker.io/bufbuild/buf +BUF_VERSION ?= v1.71.0 + .PHONY: protobuf-gen protobuf-gen: - podman run --volume "$(shell pwd):/workspace" --workdir /workspace docker.io/bufbuild/buf:latest generate + podman run --volume "$(shell pwd):/workspace" --workdir /workspace docker.io/bufbuild/buf:$(BUF_VERSION) generate .PHONY: envtest envtest: $(ENVTEST) ## Download setup-envtest locally if necessary. diff --git a/controller/deploy/operator/config/scorecard/patches/basic.config.yaml b/controller/deploy/operator/config/scorecard/patches/basic.config.yaml index 8237b70d8..8d8eb18c1 100644 --- a/controller/deploy/operator/config/scorecard/patches/basic.config.yaml +++ b/controller/deploy/operator/config/scorecard/patches/basic.config.yaml @@ -4,6 +4,7 @@ entrypoint: - scorecard-test - basic-check-spec + # renovate: image image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: basic diff --git a/controller/deploy/operator/config/scorecard/patches/olm.config.yaml b/controller/deploy/operator/config/scorecard/patches/olm.config.yaml index 416660a77..469eefc2c 100644 --- a/controller/deploy/operator/config/scorecard/patches/olm.config.yaml +++ b/controller/deploy/operator/config/scorecard/patches/olm.config.yaml @@ -4,6 +4,7 @@ entrypoint: - scorecard-test - olm-bundle-validation + # renovate: image image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm @@ -14,6 +15,7 @@ entrypoint: - scorecard-test - olm-crds-have-validation + # renovate: image image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm @@ -24,6 +26,7 @@ entrypoint: - scorecard-test - olm-crds-have-resources + # renovate: image image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm @@ -34,6 +37,7 @@ entrypoint: - scorecard-test - olm-spec-descriptors + # renovate: image image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm @@ -44,6 +48,7 @@ entrypoint: - scorecard-test - olm-status-descriptors + # renovate: image image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm diff --git a/controller/hack/demoenv/exporters-statefulset.yaml b/controller/hack/demoenv/exporters-statefulset.yaml index 766cebcc5..0da356c91 100644 --- a/controller/hack/demoenv/exporters-statefulset.yaml +++ b/controller/hack/demoenv/exporters-statefulset.yaml @@ -16,7 +16,8 @@ spec: restartPolicy: Always containers: - name: jumpstarter-exporter - image: quay.io/jumpstarter-dev/jumpstarter:0.5.0 + # renovate: image + image: quay.io/jumpstarter-dev/jumpstarter:latest imagePullPolicy: IfNotPresent env: - name: JUMPSTARTER_GRPC_INSECURE diff --git a/controller/hack/demoenv/vcan-exporters-statefulset.yaml b/controller/hack/demoenv/vcan-exporters-statefulset.yaml index 651c6fe2c..aef0df6f2 100644 --- a/controller/hack/demoenv/vcan-exporters-statefulset.yaml +++ b/controller/hack/demoenv/vcan-exporters-statefulset.yaml @@ -16,7 +16,8 @@ spec: restartPolicy: Always containers: - name: jumpstarter-exporter - image: quay.io/jumpstarter-dev/jumpstarter:0.5.0 + # renovate: image + image: quay.io/jumpstarter-dev/jumpstarter:latest imagePullPolicy: IfNotPresent env: - name: JUMPSTARTER_GRPC_INSECURE diff --git a/protocol/Makefile b/protocol/Makefile index 4df02346a..68e044724 100644 --- a/protocol/Makefile +++ b/protocol/Makefile @@ -1,5 +1,7 @@ -BUF_IMAGE=docker.io/bufbuild/buf:latest -BUF=podman run --volume "$(shell pwd):/workspace" --workdir /workspace docker.io/bufbuild/buf:latest +# renovate: datasource=docker depName=docker.io/bufbuild/buf +BUF_VERSION=v1.71.0 +BUF_IMAGE=docker.io/bufbuild/buf:$(BUF_VERSION) +BUF=podman run --volume "$(shell pwd):/workspace" --workdir /workspace $(BUF_IMAGE) all: lint diff --git a/renovate.jsonc b/renovate.jsonc index 1ba0d01b4..09e5ab243 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -118,6 +118,17 @@ "matchStrings": [ "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n[A-Z_]+\\s*=\\s*\"(?[^\"]+)\"" ] + }, + { + "description": "Track container image references in YAML via '# renovate: image' annotations", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)[^/]+\\.ya?ml$/" + ], + "matchStrings": [ + "#\\s*renovate:\\s*image\\n\\s+image:\\s*(?[^:\\s]+):(?[^\\s]+)" + ], + "datasourceTemplate": "docker" } ], "packageRules": [ @@ -335,6 +346,13 @@ "kubernetes-sigs/kind", "fullstorydev/grpcurl" ] + }, + { + "description": "Group bufbuild/buf container image across Makefiles", + "groupName": "buf-tooling", + "matchDepNames": [ + "docker.io/bufbuild/buf" + ] } ] } From 20482c2cd39e09ecf24886f1b00f7cafa8863ed1 Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Tue, 30 Jun 2026 11:43:21 +0200 Subject: [PATCH 5/7] chore(deps): track buf protobuf plugin versions via Renovate (tier 5) Add custom regex managers for buf.gen.yaml plugin versions: - protocolbuffers/python tracked via github-releases for protocolbuffers/protobuf (versions align directly) - nipunn1313-mypy and nipunn1313-mypy-grpc tracked via pypi datasource for mypy-protobuf (versions strip the v prefix for PyPI matching) Group buf protobuf plugins in a buf-protobuf-plugins packageRule so updates to protobuf and mypy-protobuf are reviewed together. Co-Authored-By: Claude Opus 4.6 (1M context) --- renovate.jsonc | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/renovate.jsonc b/renovate.jsonc index 09e5ab243..d559cb5a6 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -129,6 +129,30 @@ "#\\s*renovate:\\s*image\\n\\s+image:\\s*(?[^:\\s]+):(?[^\\s]+)" ], "datasourceTemplate": "docker" + }, + { + "description": "Track buf protobuf plugin versions (protocolbuffers/python -> protobuf releases)", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)buf\\.gen\\.ya?ml$/" + ], + "matchStrings": [ + "remote:\\s*buf\\.build/protocolbuffers/(?python):(?v[^\\s]+)" + ], + "depNameTemplate": "protocolbuffers/protobuf", + "datasourceTemplate": "github-releases" + }, + { + "description": "Track buf community plugin versions (nipunn1313-mypy, nipunn1313-mypy-grpc); uses pypi datasource for mypy-protobuf", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)buf\\.gen\\.ya?ml$/" + ], + "matchStrings": [ + "remote:\\s*buf\\.build/community/nipunn1313-mypy(?:-grpc)?:v(?[^\\s]+)" + ], + "depNameTemplate": "mypy-protobuf", + "datasourceTemplate": "pypi" } ], "packageRules": [ @@ -353,6 +377,14 @@ "matchDepNames": [ "docker.io/bufbuild/buf" ] + }, + { + "description": "Group buf protobuf plugins", + "groupName": "buf-protobuf-plugins", + "matchDepNames": [ + "protocolbuffers/protobuf", + "mypy-protobuf" + ] } ] } From ebb8f8af50c185752c59cbe2b9dbe9a4f84f622e Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Tue, 30 Jun 2026 11:56:03 +0200 Subject: [PATCH 6/7] fix(deps): address review findings in Renovate configuration - Add Containerfile/Dockerfile custom regex manager so FLS ARG annotation is actually tracked (C1: was silently ignored by all existing managers) - Change [A-Z_]+ to [A-Z0-9_]+ in all custom regex patterns so variable names containing digits (e.g. ENVTEST_K8S_VERSION) are matched (H1) - Add extractVersion support to GitHub Actions YAML manager for parity - Remove dead # renovate: image annotations from demoenv StatefulSets since Renovate cannot track the 'latest' tag (M1) Co-Authored-By: Claude Opus 4.6 (1M context) --- .../hack/demoenv/exporters-statefulset.yaml | 1 - .../demoenv/vcan-exporters-statefulset.yaml | 1 - renovate.jsonc | 19 +++++++++++++++---- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/controller/hack/demoenv/exporters-statefulset.yaml b/controller/hack/demoenv/exporters-statefulset.yaml index 0da356c91..46e31b8b0 100644 --- a/controller/hack/demoenv/exporters-statefulset.yaml +++ b/controller/hack/demoenv/exporters-statefulset.yaml @@ -16,7 +16,6 @@ spec: restartPolicy: Always containers: - name: jumpstarter-exporter - # renovate: image image: quay.io/jumpstarter-dev/jumpstarter:latest imagePullPolicy: IfNotPresent env: diff --git a/controller/hack/demoenv/vcan-exporters-statefulset.yaml b/controller/hack/demoenv/vcan-exporters-statefulset.yaml index aef0df6f2..94cb44540 100644 --- a/controller/hack/demoenv/vcan-exporters-statefulset.yaml +++ b/controller/hack/demoenv/vcan-exporters-statefulset.yaml @@ -16,7 +16,6 @@ spec: restartPolicy: Always containers: - name: jumpstarter-exporter - # renovate: image image: quay.io/jumpstarter-dev/jumpstarter:latest imagePullPolicy: IfNotPresent env: diff --git a/renovate.jsonc b/renovate.jsonc index d559cb5a6..184450b61 100644 --- a/renovate.jsonc +++ b/renovate.jsonc @@ -76,7 +76,18 @@ "/(^|/)Makefile$/" ], "matchStrings": [ - "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n[A-Z_]+\\s*\\??=\\s*(?[^\\s]+)" + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n[A-Z0-9_]+\\s*\\??=\\s*(?[^\\s]+)" + ] + }, + { + "description": "Track versioned ARG dependencies in Containerfiles/Dockerfiles via inline annotations", + "customType": "regex", + "managerFilePatterns": [ + "/(^|/)[Cc]ontainerfile[^/]*$/", + "/(^|/)[Dd]ockerfile[^/]*$/" + ], + "matchStrings": [ + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\nARG\\s+[A-Z0-9_]+=(?[^\\s]+)" ] }, { @@ -86,7 +97,7 @@ "/(^|/)[^/]+\\.sh$/" ], "matchStrings": [ - "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n[A-Z_]+=(?:\"|')(?[^\"']+)(?:\"|')" + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n[A-Z0-9_]+=(?:\"|')(?[^\"']+)(?:\"|')" ] }, { @@ -96,7 +107,7 @@ "/(^|/)\\.github/workflows/[^/]+\\.ya?ml$/" ], "matchStrings": [ - "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n\\s+[A-Z_]+:\\s*(?[^\\s]+)" + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)(?:\\s+extractVersion=(?[^\\s]+))?\\n\\s+[A-Z0-9_]+:\\s*(?[^\\s]+)" ] }, { @@ -116,7 +127,7 @@ "/(^|/)[^/]+\\.py$/" ], "matchStrings": [ - "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n[A-Z_]+\\s*=\\s*\"(?[^\"]+)\"" + "#\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\n[A-Z0-9_]+\\s*=\\s*\"(?[^\"]+)\"" ] }, { From 1290028fabd502178c9cd8eaeb94c13ab37d8b4c Mon Sep 17 00:00:00 2001 From: Paul Wallrabe Date: Wed, 1 Jul 2026 10:36:28 +0200 Subject: [PATCH 7/7] fix(deps): use correct buf Docker tag format without v prefix bufbuild/buf Docker Hub tags use plain semver (1.71.0) while GitHub releases use the v prefix (v1.71.0). The Docker datasource will match against Docker Hub tags directly, so no extractVersion is needed. Co-Authored-By: Claude Opus 4.6 (1M context) --- controller/Makefile | 2 +- protocol/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/controller/Makefile b/controller/Makefile index 0a2ee3930..a986914fb 100644 --- a/controller/Makefile +++ b/controller/Makefile @@ -248,7 +248,7 @@ $(CONTROLLER_GEN): $(LOCALBIN) $(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION)) # renovate: datasource=docker depName=docker.io/bufbuild/buf -BUF_VERSION ?= v1.71.0 +BUF_VERSION ?= 1.71.0 .PHONY: protobuf-gen protobuf-gen: diff --git a/protocol/Makefile b/protocol/Makefile index 68e044724..7ac8e5efd 100644 --- a/protocol/Makefile +++ b/protocol/Makefile @@ -1,5 +1,5 @@ # renovate: datasource=docker depName=docker.io/bufbuild/buf -BUF_VERSION=v1.71.0 +BUF_VERSION=1.71.0 BUF_IMAGE=docker.io/bufbuild/buf:$(BUF_VERSION) BUF=podman run --volume "$(shell pwd):/workspace" --workdir /workspace $(BUF_IMAGE)