1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
// SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
// Renovate proposes the version updates of this repository. Dependabot keeps
// its alerts and its security updates, which are repository settings; its
// version updates are off, so that two bots do not open the same pull
// request.
{
$schema: "https://docs.renovatebot.com/renovate-schema.json",
extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
// This repository is a fork, which Renovate leaves alone unless it is told
// that the fork is maintained in its own right.
forkProcessing: "enabled",
timezone: "Europe/Istanbul",
// Once a week, before the working day.
schedule: ["before 6am on monday"],
// A release is taken a week after it is published: one that turns out to
// be broken or malicious is usually withdrawn within days.
minimumReleaseAge: "7 days",
// A pull request is rebased when it conflicts, not whenever the default
// branch moves, so that a merge does not start the tests of every open
// update again.
rebaseWhen: "conflicted",
prConcurrentLimit: 2,
prHourlyLimit: 2,
// The dashboard is an issue, and this repository has issues turned off.
// What is pending shows as pull requests only.
dependencyDashboard: false,
// Security fixes come from Dependabot security updates. Renovate does not
// open its own for the same advisory.
vulnerabilityAlerts: { enabled: false },
ignorePaths: ["third_party/**", "**/node_modules/**"],
// What Dependabot watched here, and the libraries vendored in third_party/.
enabledManagers: [
"github-actions",
"bazel-module",
"pip_requirements",
"custom.regex",
],
// third_party/ holds copies of release archives, which
// tools/scripts/updateThirdParty.py pins by version and sha256. Renovate
// changes the version; the pull request then needs the new digest and
// --update, which the third_party check of CI asks for.
customManagers: [
{
customType: "regex",
managerFilePatterns: ["/^tools/scripts/updateThirdParty\\.py$/"],
matchStrings: [
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( extractVersion=(?<extractVersion>\\S+))?\\s+\"version\": \"(?<currentValue>[^\"]+)\"",
],
},
],
// One pull request for each kind of dependency.
packageRules: [
{ matchManagers: ["github-actions"], groupName: "GitHub Actions" },
{ matchManagers: ["bazel-module"], groupName: "Bazel modules" },
{ matchManagers: ["pip_requirements"], groupName: "Python tools of CI" },
{ matchManagers: ["custom.regex"], groupName: "Vendored libraries" },
],
}
|