default.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>projectbluefin/renovate-config"
  ],
  "customManagers": [
    {
      "description": "Track chunkah OCI image version and digest pinned as shell variables in chunka/action.yml",
      "customType": "regex",
      "managerFilePatterns": ["bootc-build/chunka/action.yml"],
      "matchStrings": [
        "CHUNKAH_VERSION=\"(?<currentValue>[^\"]+)\"[\\s\\S]*?CHUNKAH_SHA=\"(?<currentDigest>sha256:[a-f0-9]+)\""
      ],
      "depNameTemplate": "quay.io/coreos/chunkah",
      "datasourceTemplate": "docker"
    }
  ],
  "packageRules": [
    {
      "description": "Automerge chore dep updates (digest, pin, patch, minor) when CI passes",
      "matchUpdateTypes": ["digest", "pin", "patch", "minor"],
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash"
    },
    {
      "description": "Never manage projectbluefin/actions refs - first-party actions use the floating @v1 tag, advanced deliberately by the actions release process. SHA pinning defends against tag hijacking on repos we do not control; it does not apply to first-party code. Keep last so it wins over the automerge rule above.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["projectbluefin/actions"],
      "enabled": false
    }
  ]
}