renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>tuna-os/.github",
    "config:best-practices"
  ],
  "automergeType": "pr",
  "automergeStrategy": "squash",
  "rebaseWhen": "conflicted",
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "vulnerabilityAlerts": {
    "schedule": [
      "at any time"
    ]
  },
  "git-submodules": {
    "enabled": true
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "Update the Renovate validator used by its own config gate",
      "managerFilePatterns": [
        "/^\\.github/workflows/validate-renovate\\.yaml$/"
      ],
      "matchStrings": [
        "# renovate: datasource=npm depName=(?<depName>[^\\s]+)\\n\\s+RENOVATE_VERSION: \\\"(?<currentValue>[^\\\"]+)\\\""
      ],
      "datasourceTemplate": "npm"
    },
    {
      "customType": "regex",
      "description": "Update image digests in image-versions.yaml",
      "managerFilePatterns": [
        "/^image-versions\\.yaml$/"
      ],
      "matchStrings": [
        "- name: (?<depName>[\\w-]+)\\n\\s+image: (?<packageName>[^\\n]+)\\n\\s+tag: (?<currentValue>[^\\n]+)\\n\\s+digest: (?<currentDigest>sha256:[a-f0-9]+)"
      ],
      "datasourceTemplate": "docker",
      "depNameTemplate": "{{{packageName}}}"
    },
    {
      "customType": "regex",
      "description": "Update pinned downloads in image-versions.yaml (GitHub releases)",
      "managerFilePatterns": [
        "/^image-versions\\.yaml$/"
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\n\\s+[\\w-]+:\\s*\"(?<currentValue>[^\"]+)\""
      ]
    },
    {
      "customType": "regex",
      "description": "Update GitHub Actions pinned SHAs",
      "managerFilePatterns": [
        "/\\.github/workflows/.+\\.ya?ml$/"
      ],
      "matchStrings": [
        "uses:\\s+(?<depName>[\\w-]+/[\\w-]+)@(?<currentDigest>[a-f0-9]{40})\\s*#\\s*(?<currentValue>v?\\d[^\\s]*)"
      ],
      "datasourceTemplate": "github-tags"
    },
    {
      "customType": "regex",
      "description": "Update font/binary version pins in build scripts and toolchain",
      "managerFilePatterns": [
        "/^build_scripts/.+\\.sh$/",
        "/^scripts/.+\\.sh$/",
        "/^toolchain/Containerfile\\.debian$/"
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\n.*?(?<currentValue>v?\\d+\\.\\d+[^\\s/\"]*)"
      ]
    },
    {
      "customType": "regex",
      "description": "Update pinned GitHub source commits in build scripts",
      "managerFilePatterns": [
        "/^build_scripts\\/desktop\\/kcm-ublue\\.sh$/"
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+ref=(?<currentValue>[^\\s]+)\\n\\s*KRUNNER_BAZAAR_REF=\"(?<currentDigest>[0-9a-f]{40})\""
      ],
      "packageNameTemplate": "https://github.com/{{{depName}}}"
    },
    {
      "customType": "regex",
      "description": "Update pinned GitHub source commits in image-versions.yaml",
      "managerFilePatterns": [
        "/^image-versions\\.yaml$/"
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+ref=(?<currentValue>[^\\s]+)\\n\\s*[\\w-]+:\\s*\"(?<currentDigest>[0-9a-f]{40})\""
      ],
      "packageNameTemplate": "https://github.com/{{{depName}}}"
    },
    {
      "customType": "regex",
      "description": "Update quay.io image digests in registry-map.yaml. tunaOS#1568: this file carried a digest pin for supply-chain safety that nothing bumped, and the pin was garbage-collected upstream (quay 404) before anyone noticed. Scoped to `registry: quay` entries so registryUrlTemplate is correct by construction; a ghcr entry that gains a digest needs its own block rather than silently resolving against the wrong registry.",
      "managerFilePatterns": [
        "/^registry-map\\.yaml$/"
      ],
      "matchStrings": [
        "registry: quay\\n\\s+path: (?<packageName>[^\\n]+)\\n(?:\\s+#[^\\n]*\\n)*\\s+digest: (?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: (?<currentValue>[^\\n]+)"
      ],
      "datasourceTemplate": "docker",
      "registryUrlTemplate": "https://quay.io",
      "depNameTemplate": "{{{packageName}}}"
    },
    {
      "customType": "regex",
      "description": "Update base image digests in tunaos.toml. Automates freshness for digest-pinned base images so Renovate opens freshness bumps before upstream garbage collection causes manifest-unknown build failures (tunaOS#2113).",
      "managerFilePatterns": [
        "/^tunaos\\.toml$/"
      ],
      "matchStrings": [
        "(?:^|\\n)[ \\t]*base_image\\s*=\\s*\"(?<depName>(?<packageName>[^:]+)):(?<currentValue>[^@\\n\"]+)@(?<currentDigest>sha256:[a-f0-9]+)\""
      ],
      "datasourceTemplate": "docker",
      "depNameTemplate": "{{{packageName}}}"
    }
  ],
  "packageRules": [
    {
      "description": "Mirrors the low-risk set in the shared preset (local>tuna-os/.github). Redundant at runtime -- the preset already carries it, and preset rules are applied before this file's -- but kept HERE on purpose: tests/test_checksum_pinned_downloads_are_not_automerged.py reads this file alone and cannot resolve the preset, so without a local blanket rule the checksum-pinned hold below has nothing to be ordered against and the invariant from #2293/#2308 stops being verifiable in-repo. Keep it immediately above that hold.",
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "pinDigest",
        "digest"
      ],
      "automerge": true
    },
    {
      "description": "Never automerge a download whose version is paired with a hand-pinned sha256. Renovate bumps the version and cannot bump the checksum, so the bump alone fails every base build closed at `sha256sum --check` (install-remora.sh). The `checksums` check catches it on the PR, but the main ruleset has no required status checks, so platformAutomerge merged #2308 with that check red and took every variant's nightly base build down on 2026-09-03 (flounder run 33694724467). Hold these for a human to run `scripts/check-download-checksums.py --fix` on the branch first. tests/test_checksum_pinned_downloads_are_not_automerged.py derives this list from the repo. tuna-os/fisherman is held for a different reason: luks-e2e.yml builds that commit and runs it as root, so a person must review every bump of the pin (#3413).",
      "matchDepNames": [
        "tuna-os/remora",
        "twpayne/chezmoi",
        "AvengeMedia/DankMaterialShell",
        "tuna-os/bootc-installer",
        "ublue-os/uupd",
        "tuna-os/fisherman",
        "rust-lang/rustup"
      ],
      "automerge": false
    },
    {
      "description": "Group all GitHub Actions updates into a single PR",
      "matchManagers": [
        "github-actions"
      ],
      "groupName": "github-actions"
    },
    {
      "description": "A GitHub-hosted runner image major (ubuntu-24.04 -> ubuntu-26.04) is an OS migration, not a dependency bump: it changes the preinstalled podman, shellcheck, just and apt set under every workflow, and is validated on its own branch. Renovate folded it into the github-actions major group (tunaOS#4184: 18 jobs moved to ubuntu-26.04, Lint red) next to an unrelated actions/cache bump. Do not propose runner majors; move runners deliberately.",
      "matchDatasources": [
        "github-runners"
      ],
      "matchUpdateTypes": [
        "major"
      ],
      "enabled": false
    },
    {
      "description": "Group git-submodule updates into a single PR",
      "matchManagers": [
        "git-submodules"
      ],
      "groupName": "submodules"
    },
    {
      "description": "ghcr.io/projectbluefin/common:latest moves upstream multiple times a day, and digest-tracking PRs get superseded rather than updated in place \u2014 three separate PRs (each a full CI run) landed in ~33 hours (tunaOS#753). Debounce: wait for a digest to sit still for a few days before opening a PR, so rapid upstream churn coalesces into one PR instead of several.",
      "matchPackageNames": [
        "ghcr.io/projectbluefin/common"
      ],
      "minimumReleaseAge": "3 days"
    },
    {
      "description": "CEILING on bootc. v1.16.11 made `selinux` a hard, non-optional dependency of bootc-lib (crates/lib/Cargo.toml: `selinux = { workspace = true }`, no feature flag), and selinux-sys needs selinux/selinux.h, which Arch does not ship -- `libselinux` is not in its official repos at all. So every Arch-family image (marlin) fails to build its bootc-builder stage: \"selinux-sys: Failed to find 'selinux/selinux.h'\". v1.16.10 builds cleanly, verified by building the builder stage at both versions. Lift this the moment bootc makes selinux optional again or Arch ships libselinux -- it is a ceiling on a dependency we want to track, not a decision to stop tracking it.",
      "matchPackageNames": [
        "bootc-dev/bootc"
      ],
      "allowedVersions": "<=1.16.10"
    },
    {
      "description": "Keep the primary-config compatibility job on Python 3.10; other runtime jobs may advance.",
      "matchManagers": [
        "github-actions"
      ],
      "matchPackageNames": [
        "python"
      ],
      "matchFileNames": [
        ".github/workflows/test.yml"
      ],
      "matchCurrentValue": "/^3\\.10(?:\\.|$)/",
      "allowedVersions": "<3.11"
    },
    {
      "description": "Same floor, matched by depName. Renovate reported this dependency as `python` (type uses-with) whose package is actions/python-versions, and the rule above, keyed on matchPackageNames, did not stop it: PR #3552 moved the floor job 3.10 -> 3.15 and merged on 2026-10-21, turning Unit Tests red on main. matchDepNames matches the name Renovate displays, so this rule applies whichever field the rule above was being compared against. Both are kept: tests/test_primary_python_floor.py pins each.",
      "matchManagers": [
        "github-actions"
      ],
      "matchDepNames": [
        "python"
      ],
      "matchFileNames": [
        ".github/workflows/test.yml"
      ],
      "matchCurrentValue": "/^3\\.10(?:\\.|$)/",
      "allowedVersions": "<3.11"
    },
    {
      "description": "CI cost (2026-11): GitHub Actions and npm tooling bumps open one PR each, and every PR is a full CI run plus a merge-queue run plus a push run on an org runner pool that was saturated all week. Open them once a week, Monday before 06:00 UTC (Renovate's default timezone), so they coalesce into the `github-actions` group PR and one `npm tooling` PR. `custom.regex` is listed because the pinned-SHA manager above reads the same workflow files. This rule comes BEFORE the docker digest rule below on purpose: a docker image referenced from a workflow file matches both, and the later rule wins. Security updates are not delayed: see vulnerabilityAlerts.",
      "matchManagers": [
        "github-actions",
        "custom.regex"
      ],
      "matchFileNames": [
        ".github/workflows/**"
      ],
      "schedule": [
        "before 6am on monday"
      ]
    },
    {
      "description": "npm-distributed tooling (the Renovate validator pin in validate-renovate.yaml, wrangler) was a separate merge every few days (`renovate-44.x`). One weekly PR instead.",
      "matchDatasources": [
        "npm"
      ],
      "groupName": "npm tooling",
      "schedule": [
        "before 6am on monday"
      ]
    },
    {
      "description": "CI cost (2026-11): docker digest bumps (image-versions.yaml, tunaos.toml base images, registry-map.yaml) are most of the week's Renovate merges (ghcr.io/projectbluefin/utah-packages:latest alone merged 25 times, eln-bootc:latest 15 times) and each one runs the whole PR pipeline, the merge queue and a push run. Renovate only creates or updates these branches before 06:00 UTC, so a base moving six times a day becomes at most one PR a day. Freshness cost: a base image digest is at most one day old; the nightly builds read the current main, not a PR.",
      "matchDatasources": [
        "docker"
      ],
      "matchUpdateTypes": [
        "digest"
      ],
      "schedule": [
        "before 6am"
      ]
    }
  ]
}