From 456bef60b2ce941ba123f9ac4b944d87304896e4 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 15:54:59 -0500 Subject: [PATCH 1/7] fix: automate tested dependency updates --- examples/tenantstacks/standard.yaml | 1 + examples/tenantstacks/with-auth.yaml | 1 + functions/render/000-state-init.yaml.gotmpl | 2 + renovate.json | 76 ++++++++++++++++++--- tests/test-render/main.k | 2 + upbound.yaml | 4 +- 6 files changed, 75 insertions(+), 11 deletions(-) diff --git a/examples/tenantstacks/standard.yaml b/examples/tenantstacks/standard.yaml index e823267..ed715b7 100644 --- a/examples/tenantstacks/standard.yaml +++ b/examples/tenantstacks/standard.yaml @@ -10,4 +10,5 @@ spec: environment: dev capsule: namespace: capsule-system + # renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts chartVersion: "0.12.4" diff --git a/examples/tenantstacks/with-auth.yaml b/examples/tenantstacks/with-auth.yaml index 6057313..25e1237 100644 --- a/examples/tenantstacks/with-auth.yaml +++ b/examples/tenantstacks/with-auth.yaml @@ -9,6 +9,7 @@ spec: team: platform capsule: namespace: capsule-system + # renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts chartVersion: "0.12.4" proxy: enabled: true diff --git a/functions/render/000-state-init.yaml.gotmpl b/functions/render/000-state-init.yaml.gotmpl index 2b28bbc..560c2ad 100644 --- a/functions/render/000-state-init.yaml.gotmpl +++ b/functions/render/000-state-init.yaml.gotmpl @@ -49,6 +49,7 @@ {{- end }} {{- $cpNamespace := $cp.namespace | default "capsule-system" }} {{- $cpReleaseName := $cp.releaseName | default "capsule" }} +# renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts {{- $cpChartVersion := $cp.chartVersion | default "0.12.4" }} # ============================================================================== @@ -60,6 +61,7 @@ {{- $cpProxyEnabled = $cpProxy.enabled }} {{- end }} {{- $cpProxyReleaseName := $cpProxy.releaseName | default "capsule-proxy" }} +# renovate: datasource=docker depName=projectcapsule/charts/capsule-proxy registryUrl=https://ghcr.io {{- $cpProxyChartVersion := $cpProxy.chartVersion | default "0.10.0" }} {{- $cpProxyUsernameClaim := $cpProxy.usernameClaim | default "sub" }} {{- $cpProxyReplicas := $cpProxy.replicas | default 1 }} diff --git a/renovate.json b/renovate.json index 820ceb8..a08be56 100644 --- a/renovate.json +++ b/renovate.json @@ -12,27 +12,62 @@ }, "packageRules": [ { - "description": "Automerge minor and patch updates that pass all checks", - "matchUpdateTypes": ["minor", "patch"], - "automerge": true + "description": "Require manual merge until an e2e suite exists", + "matchUpdateTypes": [ + "major", + "minor", + "patch" + ], + "automerge": false }, { "description": "Disable automatic updates for all hops-ops Docker images", - "matchDatasources": ["docker"], + "matchDatasources": [ + "docker" + ], "enabled": false, - "matchPackageNames": ["/^hops-ops//"] + "matchPackageNames": [ + "/^hops-ops//" + ] + }, + { + "description": "Group AWS provider-family packages", + "matchPackageNames": [ + "/provider-family-aws/", + "/provider-aws-.*/" + ], + "groupName": "aws-providers" }, { "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)", - "matchManagers": ["custom.regex"], - "matchDatasources": ["github-releases"], + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "github-releases" + ], + "semanticCommitType": "feat", + "semanticCommitScope": "deps" + }, + { + "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "github-releases" + ], "semanticCommitType": "feat", "semanticCommitScope": "deps" }, { "description": "Use feat(deps): commit prefix for other Crossplane packages from Docker registries", - "matchManagers": ["custom.regex"], - "matchDatasources": ["docker"], + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], "semanticCommitType": "feat", "semanticCommitScope": "deps" } @@ -65,6 +100,29 @@ "registryUrlTemplate": "https://{{registryUrl}}", "depNameTemplate": "{{orgName}}/{{repoName}}", "packageNameTemplate": "{{orgName}}/{{repoName}}" + }, + { + "customType": "regex", + "description": "Annotated runtime dependencies in schemas, templates, examples, and tests", + "managerFilePatterns": [ + "apis/**/*.yaml", + "examples/**/*.yaml", + "functions/**/*.yaml.gotmpl", + "tests/**/*.k" + ], + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" + ] } + ], + "ignorePaths": [ + "**/node_modules/**", + "**/bower_components/**", + "**/vendor/**", + "**/__tests__/**", + "**/test/**", + "**/__fixtures__/**" ] } diff --git a/tests/test-render/main.k b/tests/test-render/main.k index 81c7087..3935dde 100644 --- a/tests/test-render/main.k +++ b/tests/test-render/main.k @@ -33,6 +33,7 @@ _items = [ chart = { name = "capsule" repository = "https://projectcapsule.github.io/charts" + # renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts version = "0.12.4" } namespace = "capsule-system" @@ -242,6 +243,7 @@ _items = [ chart = { name = "capsule-proxy" repository = "oci://ghcr.io/projectcapsule/charts" + # renovate: datasource=docker depName=projectcapsule/charts/capsule-proxy registryUrl=https://ghcr.io version = "0.10.0" } namespace = "capsule-system" diff --git a/upbound.yaml b/upbound.yaml index baddd74..359cfd1 100644 --- a/upbound.yaml +++ b/upbound.yaml @@ -7,7 +7,7 @@ spec: - apiVersion: pkg.crossplane.io/v1 kind: Function package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready - version: '>=v0.7.0' + version: '>=v0' - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-helm @@ -19,7 +19,7 @@ spec: - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-upjet-zitadel - version: '>=v0.1.1' + version: '>=v0' - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-aws-eks From c36e6900bd1ba293d5a564e76df0f49b44506349 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 16:59:08 -0500 Subject: [PATCH 2/7] fix: bound dependencies below next major --- renovate.json | 16 ++++++++++++---- upbound.yaml | 10 +++++----- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/renovate.json b/renovate.json index a08be56..ec97457 100644 --- a/renovate.json +++ b/renovate.json @@ -76,30 +76,38 @@ { "customType": "regex", "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)", + "matchStringsStrategy": "recursive", "managerFilePatterns": [ "apis/**/configuration.yaml", "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=(?.*?)(\"|')\\s*" + "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*=v{{{newMajor}}} [^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=(?.*?)(\"|')\\s*" + "\\s*(configuration|function|package|provider):\\s*(?[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*=v{{{newMajor}}} =v0' + version: '>=v0 =v1' + version: '>=v1 =v1' + version: '>=v1 =v0' + version: '>=v0 =v2' + version: '>=v2 Date: Sat, 29 Aug 2026 17:10:42 -0500 Subject: [PATCH 3/7] fix: avoid overlapping Renovate extraction --- renovate.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/renovate.json b/renovate.json index ec97457..e44d9c6 100644 --- a/renovate.json +++ b/renovate.json @@ -92,14 +92,14 @@ }, { "customType": "regex", - "description": "Crossplane packages from other registries (tracked via Docker tags)", + "description": "Crossplane packages from xpkg registries (tracked via Docker tags)", "matchStringsStrategy": "recursive", "managerFilePatterns": [ "apis/**/configuration.yaml", "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*(?[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", - "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?[\"']?image[\"']?\\s*[=:]\\s*[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" ] } From 6d446ca65331fe64faf68c4c305591129d7de1f2 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 17:24:37 -0500 Subject: [PATCH 4/7] fix: address dependency review findings --- renovate.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/renovate.json b/renovate.json index e44d9c6..b46ecda 100644 --- a/renovate.json +++ b/renovate.json @@ -120,7 +120,7 @@ ], "matchStrings": [ "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", - "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?[\"']?image[\"']?\\s*[=:]\\s*[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" ] } @@ -131,6 +131,7 @@ "**/vendor/**", "**/__tests__/**", "**/test/**", - "**/__fixtures__/**" + "**/__fixtures__/**", + "**/fixtures/**" ] } From 16614cfbf90942e2156a73e0fe236b5fde51f76b Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 17:25:57 -0500 Subject: [PATCH 5/7] fix: scope package dependency extraction --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index b46ecda..9c5b0ea 100644 --- a/renovate.json +++ b/renovate.json @@ -121,7 +121,7 @@ "matchStrings": [ "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", - "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?[^\"]+)\"" ] } ], From f07d874dae4cc7adc297720e665222acaeda1915 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 17:30:12 -0500 Subject: [PATCH 6/7] fix: validate Renovate configuration changes --- .github/workflows/on-pr.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml index 7fcf677..3471b64 100644 --- a/.github/workflows/on-pr.yaml +++ b/.github/workflows/on-pr.yaml @@ -10,6 +10,7 @@ on: - reopened - synchronize paths: + - 'renovate.json' - '.github/workflows/on-pr.yaml' - 'apis/**' - 'examples/**' From b8febb5d304260d0edce3732eea9a99c96e421a2 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 18:00:17 -0500 Subject: [PATCH 7/7] fix: use compatible major dependency ranges --- renovate.json | 12 ++++++------ upbound.yaml | 10 +++++----- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/renovate.json b/renovate.json index 9c5b0ea..85f0cfc 100644 --- a/renovate.json +++ b/renovate.json @@ -82,13 +82,13 @@ "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*", + "(?\\^v?[0-9]+)" ], "datasourceTemplate": "github-releases", "versioningTemplate": "npm", "packageNameTemplate": "hops-ops/{{depName}}", - "autoReplaceStringTemplate": ">=v{{{newMajor}}} xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*", + "(?\\^v?[0-9]+)" ], "datasourceTemplate": "docker", "versioningTemplate": "npm", "registryUrlTemplate": "https://{{registryUrl}}", "depNameTemplate": "{{orgName}}/{{repoName}}", "packageNameTemplate": "{{orgName}}/{{repoName}}", - "autoReplaceStringTemplate": ">=v{{{newMajor}}} =v0 =v1 =v1 =v0 =v2