Sergei Poljanski
428df5896d
Some checks failed
deploy / ansible (push) Failing after 17m57s
Floating tags (17-alpine, 3.4-slim, nginx:alpine, :latest, :debug, @v7) change under a deploy without anyone deciding it: the storage deploy moved Postgres to 17.12 on its own because of postgres:17-alpine. Pin every image and action to its exact current version, so each change arrives as a reviewed Renovate PR and a rollback is a revert. Assisted-by: Claude:opus-5-5
105 lines
3 KiB
JSON
105 lines
3 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"local>asxpi/renovate"
|
|
],
|
|
"customManagers": [
|
|
{
|
|
"description": "Versions in Ansible vars, marked with a comment: # renovate: datasource=<ds> depName=<name>",
|
|
"customType": "regex",
|
|
"managerFilePatterns": [
|
|
"/^ansible/.+\\.ya?ml$/"
|
|
],
|
|
"matchStrings": [
|
|
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+[a-z_0-9]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
|
|
]
|
|
},
|
|
{
|
|
"description": "Runner job images, pinned in the labels: docker://<image>:<tag>",
|
|
"customType": "regex",
|
|
"managerFilePatterns": [
|
|
"/^ansible/roles/forgejo_runner/(templates/config\\.yaml\\.j2|tasks/main\\.yaml)$/"
|
|
],
|
|
"matchStrings": [
|
|
"docker://(?<depName>[a-z0-9./_-]+):(?<currentValue>[A-Za-z0-9._-]+)"
|
|
],
|
|
"datasourceTemplate": "docker"
|
|
}
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"description": "Paper needs Java 21: patch updates of the 21 JRE only",
|
|
"matchPackageNames": [
|
|
"eclipse-temurin"
|
|
],
|
|
"allowedVersions": "/^21\\./"
|
|
},
|
|
{
|
|
"description": "Runner labels name their line (node-20, debian-12, python-3.11): never leave it",
|
|
"matchFileNames": [
|
|
"ansible/roles/forgejo_runner/**"
|
|
],
|
|
"matchUpdateTypes": [
|
|
"major"
|
|
],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "python-3.11 / python-3.12 labels stay on their minor line",
|
|
"matchFileNames": [
|
|
"ansible/roles/forgejo_runner/**"
|
|
],
|
|
"matchPackageNames": [
|
|
"python"
|
|
],
|
|
"matchCurrentValue": "/^3\\.11\\./",
|
|
"allowedVersions": "/^3\\.11\\./"
|
|
},
|
|
{
|
|
"matchFileNames": [
|
|
"ansible/roles/forgejo_runner/**"
|
|
],
|
|
"matchPackageNames": [
|
|
"python"
|
|
],
|
|
"matchCurrentValue": "/^3\\.12\\./",
|
|
"allowedVersions": "/^3\\.12\\./"
|
|
},
|
|
{
|
|
"description": "archlinux tags are base-YYYYMMDD.0.BUILD",
|
|
"matchPackageNames": [
|
|
"archlinux"
|
|
],
|
|
"versioning": "regex:^base-(?<major>\\d{8})\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
|
|
},
|
|
{
|
|
"description": "Both label files carry the same pins: one PR per image",
|
|
"matchFileNames": [
|
|
"ansible/roles/forgejo_runner/**"
|
|
],
|
|
"groupName": "runner job images",
|
|
"matchUpdateTypes": [
|
|
"minor",
|
|
"patch"
|
|
]
|
|
},
|
|
{
|
|
"description": "Every job runs this image and a nix-store volume tied to its version",
|
|
"matchPackageNames": [
|
|
"nixos/nix"
|
|
],
|
|
"prBodyNotes": [
|
|
"After merging, remove the old `nix-store-<old version>` volume on asxpio-services (see forgejo_runner.yaml)."
|
|
]
|
|
},
|
|
{
|
|
"description": "A runner change recreates the runner mid-job",
|
|
"matchPackageNames": [
|
|
"code.forgejo.org/forgejo/runner"
|
|
],
|
|
"prBodyNotes": [
|
|
"The deploy job that applies this shows as cancelled; the next run confirms the result."
|
|
]
|
|
}
|
|
]
|
|
}
|