fix: automate tested dependency updates

[patrickleet]

Summary

• Track Crossplane package constraints and runtime chart/image versions with Renovate.
• Loosen upbound.yaml requirements to major-only ranges and group AWS provider-family updates.
• Keep all dependency updates manual because this repository does not have an effective PR e2e suite; major updates remain manual as well.

Validation

• Renovate configuration validation passed across all 42 active Hops configurations.
• Local Renovate extraction found valid package/runtime values and major-only Crossplane ranges.
• git diff --check and YAML/JSON parsing passed across all 42 repositories.
• up project build could not run because the local Docker daemon is stopped.

GitKB task: 01a04f21-8382-72f1-9503-7d1e40c1d54d

Summary by CodeRabbit

• Chores
  • Improved tracking for Helm chart and runtime dependency versions.
  • Refined dependency upgrade handling and grouped related provider updates.
  • Updated Crossplane dependency version constraints.
  • Synchronized dependency metadata across configuration and validation files.
  • Disabled automatic merging of dependency upgrades pending end-to-end validation.
  • Ensured pull request checks run when dependency automation settings change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 45bd05df-ab63-4c65-9a7f-61b0969a9b8c

📥 Commits

Reviewing files that changed from the base of the PR and between 86c2ecc and 128363e.

📒 Files selected for processing (3)

• .github/workflows/on-pr.yaml
• renovate.json
• upbound.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• upbound.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Renovate now tracks annotated dependencies, disables automatic merging, groups selected packages, and updates matching rules. Helm chart annotations were added to templates and tests. Crossplane dependency constraints now use caret ranges. Pull request workflows also run when renovate.json changes.

Changes

Renovate tracking

Layer / File(s)	Summary
Renovate configuration and workflow trigger renovate.json, .github/workflows/on-pr.yaml	Renovate now requires manual merging for major, minor, and patch updates, groups AWS provider packages, updates custom managers and ignore paths, extracts annotated dependencies, and triggers the pull request workflow when renovate.json changes.
Helm dependency annotations functions/render/000-state-init.yaml.gotmpl, tests/test-render/main.k	Trivy Operator, Falco, and Kubescape Operator chart versions now include Renovate metadata in the render template and test fixture.

Crossplane version constraints

Layer / File(s)	Summary
Caret dependency version ranges upbound.yaml	The function-auto-ready constraint changed to ^v0. The provider-helm and provider-kubernetes constraints changed to ^v1.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 12836

The change automates dependency tracking while keeping updates manual; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and directly relates to the main change: configuring Renovate to manage dependency updates with test-based validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/renovate-xr-dependencies

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Published Crossplane Package

The following Crossplane package was published as part of this PR:

Package: ghcr.io/hops-ops/security-stack:pr-9-5add727964e2fa60fe9386f42a5e5e63d82bf047

View Package