renovate.json5

{
  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
  extends: [
    'config:recommended',
    'docker:enableMajor',
    ':semanticCommits',
  ],
  labels: [
    'dependencies',
    'filigran team',
  ],
  minimumReleaseAge: '3 days',
  // high limits so that all PRs are created at once during the schedule window rather than being drip-fed across multiple runs
  prHourlyLimit: 100,
  prConcurrentLimit: 100,
  branchConcurrentLimit: 100,
  timezone: 'Europe/Paris',
  // weekdays outside working hours (22h-5h) + all weekend
  schedule: [
    '* 0-4,22-23 * * 1-5',
    '* * * * 0,6',
  ],
  // prevent Renovate from updating existing PRs outside the schedule window
  updateNotScheduled: false,
  // only rebase when there is a conflict; avoids unnecessary CI runs on every base branch change, can be removed when number of open PR is low
  rebaseWhen: 'conflicted',
  vulnerabilityAlerts: {
    // as we don't rely on Renovate to be informed of dependency security advisories,
    // vulnerabilityAlerts is disabled since it can cause problems by skipping minimumReleaseAge, schedule and other constraints
    enabled: false,
  },
  // The legacy images compile OpenSSL and CPython from pinned sources, so these
  // pins are the only way they receive security fixes. Scoped to legacy/ on
  // purpose: the root Dockerfile's PYTHON_VERSION is a tag assertion, not a
  // source version, and must not be bumped by a bot.
  customManagers: [
    {
      customType: 'regex',
      managerFilePatterns: ['/^legacy/Dockerfile/'],
      matchStrings: ['ARG OPENSSL_VERSION=(?<currentValue>.*?)\\s'],
      datasourceTemplate: 'github-tags',
      depNameTemplate: 'openssl/openssl',
      extractVersionTemplate: '^openssl-(?<version>.*)$',
      versioningTemplate: 'semver',
    },
    {
      customType: 'regex',
      managerFilePatterns: ['/^legacy/Dockerfile/'],
      matchStrings: ['ARG PYTHON_VERSION=(?<currentValue>.*?)\\s'],
      datasourceTemplate: 'github-tags',
      depNameTemplate: 'python/cpython',
      extractVersionTemplate: '^v(?<version>.*)$',
      versioningTemplate: 'semver',
    },
  ],
  packageRules: [
    // group non-major devDependencies and GitHub Actions once a week to avoid Renovate noise
    {
      groupName: 'devDependencies (non-major)',
      groupSlug: 'dev-dependencies-non-major',
      description: 'Batch non-major updates of dev dependencies and GitHub Actions once a week on Sunday',
      schedule: [
        '* * * * 0',
      ],
      matchDepTypes: [
        'devDependencies',
        'action',
      ],
      matchUpdateTypes: [
        'minor',
        'patch',
        'pin',
        'digest',
      ],
      // use 'auto' here so grouped PRs stay up-to-date automatically,
      // since we batch them and want them merge-ready on Monday
      rebaseWhen: 'auto',
    },
    {
      matchPackageNames: ['python/cpython'],
      allowedVersions: '<=3.12',
    },
  ],
  // do lock file maintenance once a week on Sunday
  lockFileMaintenance: {
    schedule: [
      '* * * * 0',
    ],
    rebaseWhen: 'auto',
    enabled: true,
  },
}