diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml index f7da594..019bb01 100644 --- a/.github/workflows/on-pr.yaml +++ b/.github/workflows/on-pr.yaml @@ -10,6 +10,7 @@ on: - reopened - synchronize paths: + - 'renovate.json' - '.github/workflows/on-pr.yaml' - 'apis/**' - 'examples/**' diff --git a/functions/render/000-state-init.yaml.gotmpl b/functions/render/000-state-init.yaml.gotmpl index 4f2ef1a..de3943f 100644 --- a/functions/render/000-state-init.yaml.gotmpl +++ b/functions/render/000-state-init.yaml.gotmpl @@ -78,6 +78,7 @@ {{- end }} {{- $tvNamespace := $tv.namespace | default "trivy-system" }} {{- $tvReleaseName := $tv.releaseName | default "trivy-operator" }} +# renovate: datasource=helm depName=trivy-operator registryUrl=https://aquasecurity.github.io/helm-charts/ {{- $tvChartVersion := $tv.chartVersion | default "0.30.0" }} # ============================================================================== @@ -90,6 +91,7 @@ {{- end }} {{- $flNamespace := $fl.namespace | default "falco" }} {{- $flReleaseName := $fl.releaseName | default "falco" }} +# renovate: datasource=helm depName=falco registryUrl=https://falcosecurity.github.io/charts {{- $flChartVersion := $fl.chartVersion | default "6.2.0" }} {{- $flDriver := $fl.driver | default "modern_ebpf" }} @@ -103,6 +105,7 @@ {{- end }} {{- $ksNamespace := $ks.namespace | default "kubescape" }} {{- $ksReleaseName := $ks.releaseName | default "kubescape" }} +# renovate: datasource=helm depName=kubescape-operator registryUrl=https://kubescape.github.io/helm-charts/ {{- $ksChartVersion := $ks.chartVersion | default "1.40.1" }} # Kubescape StorageClass (composed when kubescape.storageClass.enabled) diff --git a/renovate.json b/renovate.json index 820ceb8..85f0cfc 100644 --- a/renovate.json +++ b/renovate.json @@ -12,27 +12,62 @@ }, "packageRules": [ { - "description": "Automerge minor and patch updates that pass all checks", - "matchUpdateTypes": ["minor", "patch"], - "automerge": true + "description": "Require manual merge until an e2e suite exists", + "matchUpdateTypes": [ + "major", + "minor", + "patch" + ], + "automerge": false }, { "description": "Disable automatic updates for all hops-ops Docker images", - "matchDatasources": ["docker"], + "matchDatasources": [ + "docker" + ], "enabled": false, - "matchPackageNames": ["/^hops-ops//"] + "matchPackageNames": [ + "/^hops-ops//" + ] + }, + { + "description": "Group AWS provider-family packages", + "matchPackageNames": [ + "/provider-family-aws/", + "/provider-aws-.*/" + ], + "groupName": "aws-providers" }, { "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)", - "matchManagers": ["custom.regex"], - "matchDatasources": ["github-releases"], + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "github-releases" + ], + "semanticCommitType": "feat", + "semanticCommitScope": "deps" + }, + { + "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "github-releases" + ], "semanticCommitType": "feat", "semanticCommitScope": "deps" }, { "description": "Use feat(deps): commit prefix for other Crossplane packages from Docker registries", - "matchManagers": ["custom.regex"], - "matchDatasources": ["docker"], + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], "semanticCommitType": "feat", "semanticCommitScope": "deps" } @@ -41,30 +76,62 @@ { "customType": "regex", "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)", + "matchStringsStrategy": "recursive", "managerFilePatterns": [ "apis/**/configuration.yaml", "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=(?.*?)(\"|')\\s*" + "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*", + "(?\\^v?[0-9]+)" ], "datasourceTemplate": "github-releases", - "packageNameTemplate": "hops-ops/{{depName}}" + "versioningTemplate": "npm", + "packageNameTemplate": "hops-ops/{{depName}}", + "autoReplaceStringTemplate": "^v{{{newMajor}}}" }, { "customType": "regex", - "description": "Crossplane packages from other registries (tracked via Docker tags)", + "description": "Crossplane packages from xpkg registries (tracked via Docker tags)", + "matchStringsStrategy": "recursive", "managerFilePatterns": [ "apis/**/configuration.yaml", "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*(?[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=(?.*?)(\"|')\\s*" + "\\s*(configuration|function|package|provider):\\s*(?xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*", + "(?\\^v?[0-9]+)" ], "datasourceTemplate": "docker", + "versioningTemplate": "npm", "registryUrlTemplate": "https://{{registryUrl}}", "depNameTemplate": "{{orgName}}/{{repoName}}", - "packageNameTemplate": "{{orgName}}/{{repoName}}" + "packageNameTemplate": "{{orgName}}/{{repoName}}", + "autoReplaceStringTemplate": "^v{{{newMajor}}}" + }, + { + "customType": "regex", + "description": "Annotated runtime dependencies in schemas, templates, examples, and tests", + "managerFilePatterns": [ + "apis/**/*.yaml", + "examples/**/*.yaml", + "functions/**/*.yaml.gotmpl", + "tests/**/*.k" + ], + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?[^\"]+)\"" + ] } + ], + "ignorePaths": [ + "**/node_modules/**", + "**/bower_components/**", + "**/vendor/**", + "**/__tests__/**", + "**/test/**", + "**/__fixtures__/**", + "**/fixtures/**" ] } diff --git a/tests/test-render/main.k b/tests/test-render/main.k index 5387fbc..fad516d 100644 --- a/tests/test-render/main.k +++ b/tests/test-render/main.k @@ -34,6 +34,7 @@ _items = [ chart = { name = "trivy-operator" repository = "https://aquasecurity.github.io/helm-charts/" + # renovate: datasource=helm depName=trivy-operator registryUrl=https://aquasecurity.github.io/helm-charts/ version = "0.30.0" } namespace = "trivy-system" @@ -47,6 +48,7 @@ _items = [ chart = { name = "falco" repository = "https://falcosecurity.github.io/charts" + # renovate: datasource=helm depName=falco registryUrl=https://falcosecurity.github.io/charts version = "6.2.0" } namespace = "falco" @@ -60,6 +62,7 @@ _items = [ chart = { name = "kubescape-operator" repository = "https://kubescape.github.io/helm-charts/" + # renovate: datasource=helm depName=kubescape-operator registryUrl=https://kubescape.github.io/helm-charts/ version = "1.40.1" } namespace = "kubescape" diff --git a/upbound.yaml b/upbound.yaml index 34b6fb6..650442f 100644 --- a/upbound.yaml +++ b/upbound.yaml @@ -7,15 +7,15 @@ spec: - apiVersion: pkg.crossplane.io/v1 kind: Function package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready - version: '>=v0.7.0' + version: '^v0' - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-helm - version: '>=v1' + version: '^v1' - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-kubernetes - version: '>=v1' + version: '^v1' description: Security stack — Trivy Operator (workload vuln + IaC + RBAC + exposed-secret + SBOM scanning), Falco (eBPF runtime threat detection), and Kubescape (CNCF Incubating posture + framework reports + per-node CIS via DaemonSet host-scanner). Cloud-neutral.