From 76c1d93e53c2b705b1b697ea13181d46c3f7f10d Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 15:54:56 -0500 Subject: [PATCH 1/7] fix: automate tested dependency updates --- apis/authstacks/definition.yaml | 1 + functions/render/000-state-init.yaml.gotmpl | 2 + renovate.json | 41 +++++++++++++++++---- upbound.yaml | 6 +-- 4 files changed, 40 insertions(+), 10 deletions(-) diff --git a/apis/authstacks/definition.yaml b/apis/authstacks/definition.yaml index ab6aebe..423c168 100644 --- a/apis/authstacks/definition.yaml +++ b/apis/authstacks/definition.yaml @@ -186,6 +186,7 @@ spec: version: description: Postgres major version. Defaults to "17". type: string + # renovate: datasource=docker depName=library/postgres registryUrl=https://index.docker.io default: "17" parameters: description: postgres.conf parameters merged into the composed Cluster.spec.postgresql.parameters. diff --git a/functions/render/000-state-init.yaml.gotmpl b/functions/render/000-state-init.yaml.gotmpl index ada0d37..c17b382 100644 --- a/functions/render/000-state-init.yaml.gotmpl +++ b/functions/render/000-state-init.yaml.gotmpl @@ -96,6 +96,7 @@ {{- if not $embStorage.size }}{{- $embStorage = set $embStorage "size" "2Gi" }}{{- end }} {{- if not $embStorage.class }}{{- $embStorage = set $embStorage "class" "psql" }}{{- end }} {{- $embPostgres := $dbEmbedded.postgresql | default dict }} +# renovate: datasource=docker depName=library/postgres registryUrl=https://index.docker.io {{- if not $embPostgres.version }}{{- $embPostgres = set $embPostgres "version" "17" }}{{- end }} {{- $embInstances := 1 }} {{- if hasKey $dbEmbedded "instances" }}{{- $embInstances = $dbEmbedded.instances }}{{- end }} @@ -167,6 +168,7 @@ {{- $overrideAllValues := $spec.overrideAllValues | default dict }} # Chart version pin +# renovate: datasource=helm depName=zitadel registryUrl=https://charts.zitadel.com {{- $chartVersion := $spec.version | default "9.34.1" }} # Domain & TLS diff --git a/renovate.json b/renovate.json index 687f256..e9c2047 100644 --- a/renovate.json +++ b/renovate.json @@ -12,9 +12,13 @@ }, "packageRules": [ { - "description": "Automerge minor and patch updates that pass all checks", - "matchUpdateTypes": ["minor", "patch"], - "automerge": true + "description": "Require manual merge until an e2e suite exists", + "matchUpdateTypes": [ + "major", + "minor", + "patch" + ], + "automerge": false }, { "description": "Disable automatic updates for all hops-ops Docker images", @@ -26,6 +30,14 @@ "/^hops-ops//" ] }, + { + "description": "Group AWS provider-family packages", + "matchPackageNames": [ + "/provider-family-aws/", + "/provider-aws-.*/" + ], + "groupName": "aws-providers" + }, { "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)", "matchManagers": [ @@ -80,11 +92,26 @@ }, { "customType": "regex", - "fileMatch": ["\\.yaml\\.gotmpl$"], - "matchStrings": [ - "\\s*chart:\\s*name:\\s+(?.*?)\\s*repository:\\s*(?.*?)\\s*version:\\s*\"?(?.*?)\"?\\s" + "description": "Annotated runtime dependencies in schemas, templates, examples, and tests", + "managerFilePatterns": [ + "apis/**/*.yaml", + "examples/**/*.yaml", + "functions/**/*.yaml.gotmpl", + "tests/**/*.k" ], - "datasourceTemplate": "helm" + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" + ] } + ], + "ignorePaths": [ + "**/node_modules/**", + "**/bower_components/**", + "**/vendor/**", + "**/__tests__/**", + "**/test/**", + "**/__fixtures__/**" ] } diff --git a/upbound.yaml b/upbound.yaml index 5305d7e..557f652 100644 --- a/upbound.yaml +++ b/upbound.yaml @@ -7,7 +7,7 @@ spec: - apiVersion: pkg.crossplane.io/v1 kind: Function package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready - version: '>=v0.7.0' + version: '>=v0' - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-helm @@ -19,11 +19,11 @@ spec: - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-upjet-zitadel - version: '>=v0.1.1' + version: '>=v0' - apiVersion: pkg.crossplane.io/v1 kind: Provider package: xpkg.crossplane.io/crossplane-contrib/provider-aws-secretsmanager - version: '>=v2.7.0' + version: '>=v2' description: AuthStack installs Zitadel as the platform identity provider via the upstream Helm chart, with typed integration points for PostgreSQL and Gateway API. Also hosts the auth.hops.ops.com.ai primitive XRDs that wrap multi-resource From d0b811eabeac1259494c877fd2229482209299ea Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 16:59:07 -0500 Subject: [PATCH 2/7] fix: bound dependencies below next major --- renovate.json | 16 ++++++++++++---- upbound.yaml | 10 +++++----- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/renovate.json b/renovate.json index e9c2047..1b36f17 100644 --- a/renovate.json +++ b/renovate.json @@ -65,30 +65,38 @@ { "customType": "regex", "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)", + "matchStringsStrategy": "recursive", "managerFilePatterns": [ "apis/**/configuration.yaml", "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=(?.*?)(\"|')\\s*" + "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*=v{{{newMajor}}} [^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=(?.*?)(\"|')\\s*" + "\\s*(configuration|function|package|provider):\\s*(?[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*=v{{{newMajor}}} =v0' + version: '>=v0 =v1' + version: '>=v1 =v1' + version: '>=v1 =v0' + version: '>=v0 =v2' + version: '>=v2 Date: Sat, 29 Aug 2026 17:10:42 -0500 Subject: [PATCH 3/7] fix: avoid overlapping Renovate extraction --- renovate.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/renovate.json b/renovate.json index 1b36f17..3f60141 100644 --- a/renovate.json +++ b/renovate.json @@ -81,14 +81,14 @@ }, { "customType": "regex", - "description": "Crossplane packages from other registries (tracked via Docker tags)", + "description": "Crossplane packages from xpkg registries (tracked via Docker tags)", "matchStringsStrategy": "recursive", "managerFilePatterns": [ "apis/**/configuration.yaml", "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*(?[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", - "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?[\"']?image[\"']?\\s*[=:]\\s*[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" ] } From 6849283583de94289181f4714030944e5bf3216e Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 17:24:36 -0500 Subject: [PATCH 4/7] fix: address dependency review findings --- renovate.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/renovate.json b/renovate.json index 3f60141..c5eadf0 100644 --- a/renovate.json +++ b/renovate.json @@ -109,7 +109,7 @@ ], "matchStrings": [ "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", - "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?[\"']?image[\"']?\\s*[=:]\\s*[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" ] } @@ -120,6 +120,7 @@ "**/vendor/**", "**/__tests__/**", "**/test/**", - "**/__fixtures__/**" + "**/__fixtures__/**", + "**/fixtures/**" ] } From 81bfacb344f7a63f9825b00ffa2957cfc6140ef6 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 17:25:56 -0500 Subject: [PATCH 5/7] fix: scope package dependency extraction --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index c5eadf0..b0e7160 100644 --- a/renovate.json +++ b/renovate.json @@ -110,7 +110,7 @@ "matchStrings": [ "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?v?[0-9][^\\s\"'}]*)", "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?v?[A-Za-z0-9][^\\s\"'}]*)", - "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"[^\"]+:(?[^\"]+)\"" + "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: registryUrl=(?\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?[^\"]+)\"" ] } ], From fe5c7051428bd04774e544b3f1c7eba3be29fb02 Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 17:30:11 -0500 Subject: [PATCH 6/7] fix: validate Renovate configuration changes --- .github/workflows/on-pr.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml index cfe17eb..75695ab 100644 --- a/.github/workflows/on-pr.yaml +++ b/.github/workflows/on-pr.yaml @@ -10,6 +10,7 @@ on: - reopened - synchronize paths: + - 'renovate.json' - ".github/workflows/on-pr.yaml" - ".gitops/**" - "apis/**" From 70d5b39e12f8462be602bc89256f93a328bd4dfd Mon Sep 17 00:00:00 2001 From: Patrick Lee Scott Date: Sat, 29 Aug 2026 18:00:14 -0500 Subject: [PATCH 7/7] fix: use compatible major dependency ranges --- renovate.json | 12 ++++++------ upbound.yaml | 10 +++++----- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/renovate.json b/renovate.json index b0e7160..ac39749 100644 --- a/renovate.json +++ b/renovate.json @@ -71,13 +71,13 @@ "upbound.yaml" ], "matchStrings": [ - "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?.*?)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*", + "(?\\^v?[0-9]+)" ], "datasourceTemplate": "github-releases", "versioningTemplate": "npm", "packageNameTemplate": "hops-ops/{{depName}}", - "autoReplaceStringTemplate": ">=v{{{newMajor}}} xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*>=v?[0-9]+(?:\\.[0-9]+){0,2}(?:\\s*xpkg\\.[^/]+)\\/(?[^/]+)\\/(?[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*", + "(?\\^v?[0-9]+)" ], "datasourceTemplate": "docker", "versioningTemplate": "npm", "registryUrlTemplate": "https://{{registryUrl}}", "depNameTemplate": "{{orgName}}/{{repoName}}", "packageNameTemplate": "{{orgName}}/{{repoName}}", - "autoReplaceStringTemplate": ">=v{{{newMajor}}} =v0 =v1 =v1 =v0 =v2