fix: automate tested dependency updates

.github/workflows/on-pr.yaml

@@ -10,6 +10,7 @@ on:
       - reopened
       - synchronize
     paths:
+      - 'renovate.json'
       - ".github/workflows/on-pr.yaml"
       - ".gitops/**"
       - "apis/**"

apis/authstacks/definition.yaml

@@ -186,6 +186,7 @@ spec:
                           version:
                             description: Postgres major version. Defaults to "17".
                             type: string
+                            # renovate: datasource=docker depName=library/postgres registryUrl=https://index.docker.io
                             default: "17"
                           parameters:
                             description: postgres.conf parameters merged into the composed Cluster.spec.postgresql.parameters.

functions/render/000-state-init.yaml.gotmpl

@@ -96,6 +96,7 @@
 {{- if not $embStorage.size }}{{- $embStorage = set $embStorage "size" "2Gi" }}{{- end }}
 {{- if not $embStorage.class }}{{- $embStorage = set $embStorage "class" "psql" }}{{- end }}
 {{- $embPostgres := $dbEmbedded.postgresql | default dict }}
+# renovate: datasource=docker depName=library/postgres registryUrl=https://index.docker.io
 {{- if not $embPostgres.version }}{{- $embPostgres = set $embPostgres "version" "17" }}{{- end }}
 {{- $embInstances := 1 }}
 {{- if hasKey $dbEmbedded "instances" }}{{- $embInstances = $dbEmbedded.instances }}{{- end }}
@@ -167,6 +168,7 @@
 {{- $overrideAllValues := $spec.overrideAllValues | default dict }}
 
 # Chart version pin
+# renovate: datasource=helm depName=zitadel registryUrl=https://charts.zitadel.com
 {{- $chartVersion := $spec.version | default "9.34.1" }}
 
 # Domain & TLS

renovate.json

@@ -12,9 +12,13 @@
   },
   "packageRules": [
     {
-      "description": "Automerge minor and patch updates that pass all checks",
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true
+      "description": "Require manual merge until an e2e suite exists",
+      "matchUpdateTypes": [
+        "major",
+        "minor",
+        "patch"
+      ],
+      "automerge": false
     },
     {
       "description": "Disable automatic updates for all hops-ops Docker images",
@@ -26,6 +30,14 @@
         "/^hops-ops//"
       ]
     },
+    {
+      "description": "Group AWS provider-family packages",
+      "matchPackageNames": [
+        "/provider-family-aws/",
+        "/provider-aws-.*/"
+      ],
+      "groupName": "aws-providers"
+    },
     {
       "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)",
       "matchManagers": [
@@ -53,38 +65,62 @@
     {
       "customType": "regex",
       "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "github-releases",
-      "packageNameTemplate": "hops-ops/{{depName}}"
+      "versioningTemplate": "npm",
+      "packageNameTemplate": "hops-ops/{{depName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "description": "Crossplane packages from other registries (tracked via Docker tags)",
+      "description": "Crossplane packages from xpkg registries (tracked via Docker tags)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>xpkg\\.[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "docker",
+      "versioningTemplate": "npm",
       "registryUrlTemplate": "https://{{registryUrl}}",
       "depNameTemplate": "{{orgName}}/{{repoName}}",
-      "packageNameTemplate": "{{orgName}}/{{repoName}}"
+      "packageNameTemplate": "{{orgName}}/{{repoName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "fileMatch": ["\\.yaml\\.gotmpl$"],
-      "matchStrings": [
-        "\\s*chart:\\s*name:\\s+(?<depName>.*?)\\s*repository:\\s*(?<registryUrl>.*?)\\s*version:\\s*\"?(?<currentValue>.*?)\"?\\s"
+      "description": "Annotated runtime dependencies in schemas, templates, examples, and tests",
+      "managerFilePatterns": [
+        "apis/**/*.yaml",
+        "examples/**/*.yaml",
+        "functions/**/*.yaml.gotmpl",
+        "tests/**/*.k"
       ],
-      "datasourceTemplate": "helm"
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?<currentValue>v?[0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?<currentValue>v?[A-Za-z0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?<currentValue>[^\"]+)\""
+      ]
     }
+  ],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/__fixtures__/**",
+    "**/fixtures/**"
   ]
 }

upbound.yaml

@@ -7,23 +7,23 @@ spec:
   - apiVersion: pkg.crossplane.io/v1
     kind: Function
     package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready
-    version: '>=v0.7.0'
+    version: '^v0'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-helm
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-kubernetes
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-upjet-zitadel
-    version: '>=v0.1.1'
+    version: '^v0'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-aws-secretsmanager
-    version: '>=v2.7.0'
+    version: '^v2'
   description: AuthStack installs Zitadel as the platform identity provider via the
     upstream Helm chart, with typed integration points for PostgreSQL and Gateway
     API. Also hosts the auth.hops.ops.com.ai primitive XRDs that wrap multi-resource