github-actions/renovate.json at main · loft-sh/github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
  "packageRules": [
    {
      "description": "Group all GitHub Actions updates into a single PR",
      "matchManagers": ["github-actions"],
      "groupName": "github-actions"
    },
    {
      "description": "Group linear-pr-commenter Go dependencies",
      "matchManagers": ["gomod"],
      "matchFileNames": [".github/actions/linear-pr-commenter/**"],
      "groupName": "linear-pr-commenter"
    },
    {
      "description": "Group linear-release-sync Go dependencies",
      "matchManagers": ["gomod"],
      "matchFileNames": [".github/actions/linear-release-sync/**"],
      "groupName": "linear-release-sync"
    },
    {
      "description": "Group link-backport-prs Go dependencies",
      "matchManagers": ["gomod"],
      "matchFileNames": [".github/actions/link-backport-prs/**"],
      "groupName": "link-backport-prs"
    },
    {
      "description": "Keep in-house actions on rolling tags so shared fixes reach every caller.",
      "matchManagers": [
        "github-actions"
      ],
      "matchPackageNames": [
        "loft-sh/**"
      ],
      "pinDigests": false,
      "enabled": false
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "description": "Update zizmor version pinned inline in CI workflow",
      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yaml$/"],
      "matchStrings": ["pip install zizmor==(?<currentValue>[^\\s&]+)"],
      "depNameTemplate": "zizmor",
      "datasourceTemplate": "pypi"
    },
    {
      "customType": "regex",
      "description": "Update renovate version pinned in validate-renovate workflow",
      "managerFilePatterns": ["/^\\.github/workflows/validate-renovate\\.yaml$/"],
      "matchStrings": ["renovate@(?<currentValue>[^\\s]+)"],
      "depNameTemplate": "renovate",
      "datasourceTemplate": "npm"
    },
    {
      "customType": "regex",
      "description": "Update releases pinned as DEFAULT_VERSION in action scripts (setup-semstat installer, cve-scan snyk adapter)",
      "managerFilePatterns": [
        "/^\\.github/actions/setup-semstat/src/install-semstat\\.sh$/",
        "/^\\.github/actions/cve-scan/src/scanners/snyk\\.sh$/"
      ],
      "matchStrings": ["# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+DEFAULT_VERSION=(?<currentValue>\\S+)"]
    },
    {
      "customType": "regex",
      "description": "Update versions annotated with `# renovate: datasource=X depName=Y` in workflow inputs and composite action inputs",
      "managerFilePatterns": [
        "/^\\.github/workflows/.+\\.ya?ml$/",
        "/^\\.github/actions/[^/]+/action\\.ya?ml$/"
      ],
      "matchStrings": ["# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+(?:default|version): (?<currentValue>\\S+)"]
    }
  ]
}