renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "automerge": false,
  "commitHourlyLimit": 1,
  "customManagers": [
    {
      "customType": "regex",
      "datasourceTemplate": "go",
      "depNameTemplate": "{{#if depName}}{{{depName}}}{{else}}go.opentelemetry.io/collector/otelcol{{/if}}",
      "description": "OCB manifest versions for the custom OTel Collector; excludes this repository's own modules",
      "extractVersionTemplate": "{{#if depName}}^(?<version>.+)${{else}}^v(?<version>.+)${{/if}}",
      "managerFilePatterns": [
        "/^infra\\/otel\\/custom-collector\\/builder\\.yaml$/"
      ],
      "matchStrings": [
        "-\\s+gomod:\\s+(?<depName>(?:go\\.opentelemetry\\.io|github\\.com\\/open-telemetry)\\/\\S+)\\s+(?<currentValue>v\\d\\S*)",
        "otelcol_version:\\s+(?<currentValue>\\d\\S*)"
      ]
    }
  ],
  "dependencyDashboard": true,
  "draftPR": true,
  "extends": [
    "config:recommended",
    ":semanticCommits",
    "helpers:pinGitHubActionDigests",
    "docker:pinDigests"
  ],
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["* 0-6 * * 1"]
  },
  "osvVulnerabilityAlerts": true,
  "packageRules": [
    {
      "dependencyDashboardApproval": true,
      "description": "Major updates require an explicit dashboard decision",
      "matchUpdateTypes": ["major"]
    },
    {
      "description": "Let new patch releases settle before proposing them",
      "matchUpdateTypes": ["patch"],
      "minimumReleaseAge": "3 days"
    },
    {
      "description": "Format pnpm workspace changes before committing npm updates",
      "matchManagers": ["npm"],
      "postUpgradeTasks": {
        "commands": ["node tools/renovate/format-pnpm-workspace.mjs"],
        "fileFilters": ["pnpm-workspace.yaml"]
      }
    },
    {
      "description": "Keep Nx core and plugins on the same version",
      "groupName": "Nx workspace",
      "matchManagers": ["npm"],
      "matchPackageNames": ["nx", "@nx/**"]
    },
    {
      "description": "Review compatible Vite build-tool updates together; approve major migrations separately",
      "groupName": "Vite build tools",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "vite",
        "@vitejs/plugin-react",
        "vite-plugin-dts",
        "vite-plugin-singlefile"
      ],
      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "allowedVersions": "<9.0.0",
      "description": "Nx 22 supports Vite 5 through 8",
      "matchManagers": ["npm"],
      "matchPackageNames": ["vite"]
    },
    {
      "description": "Keep Vitest and its official companion packages aligned",
      "groupName": "Vitest",
      "matchManagers": ["npm"],
      "matchPackageNames": ["vitest", "@vitest/**"]
    },
    {
      "allowedVersions": "<5.0.0",
      "description": "Nx 22 supports Vitest 3 and 4; review a newer major with Nx compatibility first",
      "matchManagers": ["npm"],
      "matchPackageNames": ["vitest", "@vitest/**"]
    },
    {
      "allowedVersions": "<5.10.0",
      "description": "Nx 22 supports TypeScript 5.4 through 5.9",
      "matchManagers": ["npm"],
      "matchPackageNames": ["typescript"]
    },
    {
      "description": "Review Fastify and plugin updates together without bundling unrelated major migrations",
      "groupName": "Fastify",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "fastify",
        "fastify-plugin",
        "@fastify/**",
        "@getlarge/fastify-mcp",
        "@scalar/fastify-api-reference"
      ],
      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "description": "Keep React runtime and type declarations aligned",
      "groupName": "React",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "react",
        "react-dom",
        "@types/react",
        "@types/react-dom"
      ]
    },
    {
      "description": "Review React companion tooling with routine React updates",
      "groupName": "React",
      "matchManagers": ["npm"],
      "matchPackageNames": [
        "@testing-library/react",
        "eslint-plugin-react-hooks"
      ],
      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "automerge": false,
      "description": "Review action and reusable workflow versions together, apart from toolchain inputs",
      "groupName": "GitHub Actions",
      "matchDepTypes": ["action", "workflow"],
      "matchManagers": ["github-actions"]
    },
    {
      "description": "The Rust action SHA is intentionally fixed to the repository's Rust 1.90.0 toolchain",
      "enabled": false,
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["dtolnay/rust-toolchain"]
    },
    {
      "description": "Self-repository reusable workflows must continue to load from main",
      "matchDepTypes": ["workflow"],
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["getlarge/themoltnet"],
      "pinDigests": false
    },
    {
      "description": "The Renovate Docker version is a plain action input, not a pinned container reference",
      "matchDepTypes": ["uses-with"],
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
      "pinDigests": false
    },
    {
      "description": "Validate Go toolchain changes (.tool-versions, read by every setup-go step) with the Go CI lanes before merging",
      "groupName": "Go toolchain",
      "matchDepNames": ["golang"],
      "matchManagers": ["asdf"]
    },
    {
      "description": "Validate Python toolchain changes with the skill checks before merging",
      "groupName": "GitHub Actions Python toolchain",
      "matchDepTypes": ["uses-with"],
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["python"]
    },
    {
      "description": "Pin existing workflow refs promptly, then review future updates weekly",
      "groupName": "GitHub Actions SHA pins",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["pinDigest"],
      "schedule": ["at any time"]
    },
    {
      "description": "Pin Dockerfile bases separately from version updates",
      "groupName": "Dockerfile base digest pins",
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["pinDigest"],
      "schedule": ["at any time"]
    },
    {
      "description": "Keep Node.js tool-version files and node Docker base images in one update",
      "groupName": "Node.js toolchain",
      "matchDepNames": ["node", "nodejs"],
      "matchManagers": ["nvm", "asdf", "dockerfile"]
    },
    {
      "automerge": false,
      "description": "Require review for authentication and cryptography dependencies",
      "matchPackageNames": ["@ory/**", "@noble/**", "*sodium*", "jose"]
    },
    {
      "description": "Move golang.org/x modules together; they are released as one wave",
      "groupName": "golang.org/x",
      "matchManagers": ["gomod"],
      "matchPackageNames": ["golang.org/x/**"]
    },
    {
      "description": "Keep OTel Collector core, contrib and the OCB manifest on one version; builder.yaml requires every component at the same minor",
      "groupName": "OTel Collector",
      "matchManagers": ["gomod", "custom.regex"],
      "matchPackageNames": [
        "go.opentelemetry.io/collector",
        "go.opentelemetry.io/collector/**",
        "github.com/open-telemetry/opentelemetry-collector-contrib/**"
      ]
    },
    {
      "description": "Keep the OTel Go SDK packages on one version across modules",
      "groupName": "OTel Go SDK",
      "matchManagers": ["gomod"],
      "matchPackageNames": [
        "go.opentelemetry.io/otel",
        "go.opentelemetry.io/otel/**"
      ]
    },
    {
      "description": "ogen generates the Go API client; its runtime packages move with it and need regeneration",
      "groupName": "ogen",
      "matchManagers": ["gomod"],
      "matchPackageNames": [
        "github.com/ogen-go/ogen",
        "github.com/go-faster/**"
      ]
    },
    {
      "description": "IPFS CID and multiformats libraries used for content-addressed entries",
      "groupName": "IPFS multiformats",
      "matchManagers": ["gomod"],
      "matchPackageNames": ["github.com/ipfs/**", "github.com/multiformats/**"]
    },
    {
      "description": "go-keyring and its platform backends are tested together",
      "groupName": "OS keyring",
      "matchManagers": ["gomod"],
      "matchPackageNames": [
        "github.com/zalando/go-keyring",
        "github.com/danieljoos/wincred",
        "github.com/godbus/dbus/**"
      ]
    }
  ],
  "postUpdateOptions": ["gomodTidy", "pnpmDedupe"],
  "prConcurrentLimit": 4,
  "prHourlyLimit": 1,
  "schedule": ["* 0-6 * * *"],
  "timezone": "Europe/Paris",
  "vulnerabilityAlerts": {
    "draftPR": true,
    "enabled": true,
    "groupName": "{{#if (containsString depName \"golang.org/x/\")}}golang.org/x{{else if (containsString depName \"go.opentelemetry.io/collector\")}}OTel Collector{{else if (containsString depName \"opentelemetry-collector-contrib\")}}OTel Collector{{else}}dependency {{{depName}}}{{/if}}",
    "groupSlug": "{{#if (containsString depName \"golang.org/x/\")}}golang-org-x-vulnerability{{else if (containsString depName \"go.opentelemetry.io/collector\")}}otel-collector-vulnerability{{else if (containsString depName \"opentelemetry-collector-contrib\")}}otel-collector-vulnerability{{else}}{{{datasource}}}-{{{depNameSanitized}}}-vulnerability{{/if}}",
    "prConcurrentLimit": 5
  }
}