fix: automate tested dependency updates

.github/workflows/on-pr.yaml

@@ -10,7 +10,8 @@ on:
       - reopened
       - synchronize
     paths:
-      - ".github/workflows/on-pr.yaml"
+      - 'renovate.json'
+      - ".github/workflows/**"
       - ".gitops/**"
       - "apis/**"
       - "examples/**"

README.md

@@ -18,10 +18,10 @@ Deletion protection (Usages) ensures correct teardown order: gateways before ist
 
 - Crossplane installed in the cluster
 - Crossplane providers:
-  - `provider-helm` (>=v1.0.6)
-  - `provider-kubernetes` (>=v0.15.0) — only needed when using `egress.allowedHosts`
+  - `provider-helm` (^v1)
+  - `provider-kubernetes` (^v1) — only needed when using `egress.allowedHosts`
 - Crossplane function:
-  - `function-auto-ready` (>=v0.6.0)
+  - `function-auto-ready` (^v0)
 
 ## Quick Start
 

examples/istiostacks/standard.yaml

@@ -8,6 +8,7 @@ spec:
   labels:
     team: platform
   namespace: istio-system
+  # renovate: datasource=helm depName=base registryUrl=https://istio-release.storage.googleapis.com/charts
   chartVersion: "1.29.2"
 
   ingressGateway:

functions/render/000-state-init.yaml.gotmpl

@@ -13,6 +13,7 @@
 {{- $name := $metadata.name | default "istio" }}
 {{- $clusterName := $spec.clusterName | default $name }}
 {{- $namespace := $spec.namespace | default "istio-system" }}
+# renovate: datasource=helm depName=base registryUrl=https://istio-release.storage.googleapis.com/charts
 {{- $chartVersion := $spec.chartVersion | default "1.29.2" }}
 {{- $managementPolicies := $spec.managementPolicies | default (list "*") }}
 

renovate.json

@@ -12,10 +12,20 @@
   },
   "packageRules": [
     {
-      "description": "Automerge minor and patch updates that pass all checks",
-      "matchUpdateTypes": ["minor", "patch"],
+      "description": "Automerge minor and patch updates after all checks pass",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
       "automerge": true
     },
+    {
+      "description": "Require manual review for major updates",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false
+    },
     {
       "description": "Disable automatic updates for all hops-ops Docker images",
       "matchDatasources": [
@@ -27,7 +37,7 @@
       ]
     },
     {
-      "description": "Group all AWS provider packages together for batched updates",
+      "description": "Group AWS provider-family packages",
       "matchPackageNames": [
         "/provider-family-aws/",
         "/provider-aws-.*/"
@@ -46,7 +56,7 @@
       "semanticCommitScope": "deps"
     },
     {
-      "description": "Use fix(deps): commit prefix for other Crossplane packages from Docker registries",
+      "description": "Use feat(deps): commit prefix for other Crossplane packages from Docker registries",
       "matchManagers": [
         "custom.regex"
       ],
@@ -61,46 +71,65 @@
     {
       "customType": "regex",
       "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "github-releases",
-      "packageNameTemplate": "hops-ops/{{depName}}"
+      "versioningTemplate": "npm",
+      "packageNameTemplate": "hops-ops/{{depName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "description": "Crossplane packages from other registries (tracked via Docker tags)",
+      "description": "Crossplane packages from xpkg registries (tracked via Docker tags)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>xpkg\\.[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "docker",
+      "versioningTemplate": "npm",
       "registryUrlTemplate": "https://{{registryUrl}}",
       "depNameTemplate": "{{orgName}}/{{repoName}}",
-      "packageNameTemplate": "{{orgName}}/{{repoName}}"
+      "packageNameTemplate": "{{orgName}}/{{repoName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "fileMatch": ["\\.yaml\\.gotmpl$"],
-      "matchStrings": [
-        "\\s*chart:\\s*name:\\s+(?<depName>.*?)\\s*repository:\\s*(?<registryUrl>.*?)\\s*version:\\s*\"?(?<currentValue>.*?)\"?\\s"
+      "description": "Annotated runtime dependencies in schemas, templates, examples, and tests",
+      "managerFilePatterns": [
+        "apis/**/*.yaml",
+        "examples/**/*.yaml",
+        "functions/**/*.yaml.gotmpl",
+        "tests/**/*.k"
       ],
-      "datasourceTemplate": "helm"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": ["\\.gitops/deploy/Chart\\.yaml$"],
-      "matchStrings": ["appVersion:\\s+(?<currentValue>.*)"],
-      "depNameTemplate": "base",
-      "registryUrlTemplate": "https://istio-release.storage.googleapis.com/charts",
-      "datasourceTemplate": "helm"
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?<currentValue>v?[0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?<currentValue>v?[A-Za-z0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?<currentValue>[^\"]+)\""
+      ]
     }
-  ]
+  ],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/__fixtures__/**",
+    "**/fixtures/**"
+  ],
+  "automergeType": "pr",
+  "platformAutomerge": false,
+  "ignoreTests": false
 }

tests/test-render/main.k

@@ -34,6 +34,7 @@ _items = [
                         chart = {
                             name = "base"
                             repository = "https://istio-release.storage.googleapis.com/charts"
+                            # renovate: datasource=helm depName=base registryUrl=https://istio-release.storage.googleapis.com/charts
                             version = "1.29.2"
                         }
                         namespace = "istio-system"
@@ -45,6 +46,7 @@ _items = [
                     metadata.name = "test-istiod"
                     spec.forProvider = {
                         chart.name = "istiod"
+                        # renovate: datasource=helm depName=base registryUrl=https://istio-release.storage.googleapis.com/charts
                         chart.version = "1.29.2"
                         namespace = "istio-system"
                         values = {
@@ -59,6 +61,7 @@ _items = [
                     metadata.name = "test-ztunnel"
                     spec.forProvider = {
                         chart.name = "ztunnel"
+                        # renovate: datasource=helm depName=base registryUrl=https://istio-release.storage.googleapis.com/charts
                         chart.version = "1.29.2"
                         namespace = "istio-system"
                         values.resources.requests = {cpu = "35m", memory = "100Mi"}

upbound.yaml

@@ -7,15 +7,15 @@ spec:
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-helm
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-kubernetes
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Function
     package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready
-    version: '>=v0.7.0'
+    version: '^v0'
   description: Installs Istio (base, istiod, gateways) via Helm with a minimal, stable
     interface.
   license: Apache-2.0