renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigestsToSemver",
    ":semanticCommits",
    ":dependencyDashboard"
  ],
  "schedule": ["before 6pm on friday"],
  "timezone": "America/New_York",
  "assignees": ["bakerkj"],
  "pre-commit": {
    "enabled": true
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "GitHub runner versions in shell scripts and YAML within workflows",
      "managerFilePatterns": ["/.github/workflows/.+\\.ya?ml$/"],
      "matchStrings": [
        "runner=\"(?<depName>ubuntu|macos|windows)-(?<currentValue>[\\w.-]+)\"",
        "runs-on:\\s*(?<depName>ubuntu|macos|windows)-(?<currentValue>[\\w.-]+)"
      ],
      "datasourceTemplate": "github-runners"
    },
    {
      "customType": "regex",
      "description": "npm packages pinned via pre-commit additional_dependencies (e.g. @commitlint/config-conventional@N in .pre-commit-config.yaml). The built-in pre-commit manager only bumps the `rev:` on each hook — it doesn't touch the additional_dependencies array, so without this regex those pins go stale.",
      "managerFilePatterns": ["/^\\.pre-commit-config\\.yaml$/"],
      "matchStrings": [
        "\"(?<depName>@?[^\"@\\s]+)@(?<currentValue>[^\"\\s]+)\""
      ],
      "datasourceTemplate": "npm",
      "versioningTemplate": "npm"
    },
    {
      "customType": "regex",
      "description": "Renovate npm package version pinned in CI workflows",
      "managerFilePatterns": ["/.github/workflows/.+\\.ya?ml$/"],
      "matchStrings": ["npx --package renovate@(?<currentValue>[\\d.]+)"],
      "depNameTemplate": "renovate",
      "datasourceTemplate": "npm"
    },
    {
      "customType": "regex",
      "description": "home-assistant/builder build-image action (calver-tagged sub-path). Versioning is explicitly 'loose' so the calver tags (2026.06.0) compare correctly — the helpers:pinGitHubActionDigestsToSemver preset would otherwise apply semver to this depName globally, which silently ignores calver and surfaces the old pre-calver semver tags (4.x, 7.x) as 'latest'.",
      "managerFilePatterns": ["/.github/workflows/.+\\.ya?ml$/"],
      "matchStrings": [
        "home-assistant/builder/actions/build-image@(?<currentValue>[\\w.-]+)"
      ],
      "depNameTemplate": "home-assistant/builder",
      "datasourceTemplate": "github-releases",
      "versioningTemplate": "loose"
    },
    {
      "customType": "regex",
      "description": "frenck/action-addon-linter schema URLs in pre-commit config",
      "managerFilePatterns": ["/\\.pre-commit-config\\.ya?ml$/"],
      "matchStrings": ["frenck/action-addon-linter/(?<currentValue>v[\\d.]+)/"],
      "depNameTemplate": "frenck/action-addon-linter",
      "datasourceTemplate": "github-tags"
    },
    {
      "customType": "regex",
      "description": "uv tool required-version pin in pyproject.toml [tool.uv]",
      "managerFilePatterns": ["/(^|/)pyproject\\.toml$/"],
      "matchStrings": ["required-version\\s*=\\s*\"(?<currentValue>[^\"]+)\""],
      "depNameTemplate": "uv",
      "datasourceTemplate": "pypi",
      "versioningTemplate": "pep440"
    },
    {
      "customType": "regex",
      "description": "Pinned Debian apt package versions in Dockerfiles. Main trixie goes directly to deb.debian.org; the two trixie sub-suites (updates + security) resolve through a helper service that transforms Debian's .xz index into the .gz format the deb datasource requires. Full URL list lives on the matchDatasources: [deb] packageRule below (customManagers don't accept multi-URL fields).",
      "managerFilePatterns": ["/[^/]+/Dockerfile$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>\\S+)\\s+\\S+=(?<currentValue>[^\\s\\\\]+)"
      ],
      "registryUrlTemplate": "https://deb.debian.org/debian?suite=trixie&components=main&binaryArch=amd64",
      "versioningTemplate": "deb"
    }
  ],
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "groupName": "github-actions"
    },
    {
      "matchManagers": ["pre-commit"],
      "groupName": "pre-commit hooks"
    },
    {
      "description": "Dev and test tooling only, scoped by depType: dependency-groups and tool.uv.dev-dependencies. Deliberately excludes project.dependencies, project.optional-dependencies and build-system.requires, so a runtime dependency added later defaults to manual review instead of inheriting auto-merge -- the pypi datasource is not in the denial above, so scoping here is the only guard. Repos that already ship runtime packages also deny them by name in the final rule. Only pep621 is listed because renovate has no separate uv manager: pep621 is the manager that handles uv projects, covering pyproject.toml, uv.lock and uv workspaces, so naming uv here would match nothing.",
      "matchManagers": ["pep621"],
      "groupName": "python dependencies"
    },
    {
      "description": "Fully overrides the customManager's single registryUrlTemplate with the three URLs the deb datasource must merge across: main trixie direct from deb.debian.org, plus trixie-updates and trixie-security via our helper service. Debian publishes those two sub-suites only as .xz which the built-in deb datasource cannot decompress (upstream renovatebot/renovate#35865). The deb datasource declares registryStrategy = 'merge' so all three URLs are queried and version lists unioned. Auth for the helper host is injected out-of-band: the Renovate service uses an org-level Host Rule; the renovate-validate CI dry-run uses a RENOVATE_HOST_RULES env-var overlay.",
      "matchDatasources": ["deb"],
      "groupName": "apt packages",
      "registryUrls": [
        "https://deb.debian.org/debian?suite=trixie&components=main&binaryArch=amd64",
        "https://github-apt-helper.keneli.org/debian?suite=trixie-updates&components=main&binaryArch=amd64",
        "https://github-apt-helper.keneli.org/debian?suite=trixie-security&components=main&binaryArch=amd64"
      ]
    },
    {
      "description": "Pin the unit-test venv to the Python 3.13 series — it must match python3 in the add-on image's Debian trixie base. A 3.14 bump would make uv build a standalone 3.14 that diverges from the shipped interpreter. Lift when the base moves to a Debian release with 3.14.",
      "matchPackageNames": ["python"],
      "allowedVersions": "<3.14"
    },
    {
      "description": "sdr-enthusiasts images are pinned to their latest-build-NNN tag (they publish no semver). Track the build counter as a patch version — NOT major — so Renovate's maxMajorIncrement (500) doesn't cap large build-number jumps, and the PR shows a readable build-N -> build-M delta plus the resolved sourceUrl. commitMessageTopic strips the ghcr.io/sdr-enthusiasts/docker- prefix from the image name: the default full-path topic plus the squash-merge ' (#NN)' suffix pushes several of these headers past commitlint's 100-char header-max-length.",
      "matchManagers": ["dockerfile"],
      "matchPackageNames": ["/^ghcr\\.io/sdr-enthusiasts//"],
      "groupName": "sdr-enthusiasts base images",
      "commitMessageTopic": "{{{replace 'ghcr\\.io/sdr-enthusiasts/docker-' '' depName}}} image",
      "versioning": "regex:^latest-build-(?<patch>\\d+)$"
    },
    {
      "description": "Override the helpers:pinGitHubActionDigestsToSemver preset's semver versioning for home-assistant/builder, which moved from semver tags (1.x-7.x) to calver tags (2026.06.0+).",
      "matchPackageNames": ["home-assistant/builder"],
      "versioning": "loose"
    },
    {
      "description": "Auto-merge rules below are order-dependent: renovate applies packageRules in array order and the last match wins. Deny anything that could reach a shipped artifact, so a future Dockerfile or runtime requirement defaults to manual review.",
      "matchDatasources": [
        "docker",
        "deb",
        "custom.aports",
        "github-releases",
        "git-refs",
        "github-tags"
      ],
      "automerge": false
    },
    {
      "description": "Actions here run in lint, test and release jobs that never produce an image. The container users install is built only on a release tag, by home-assistant/builder, which is carved out below and stays manual. The docker/build-push-action uses in the test workflows build throwaway images with load:true and never push, so they cannot reach a user either.",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "Lint and format tooling. Never shipped.",
      "matchManagers": ["pre-commit"],
      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "npm packages pinned in .pre-commit-config.yaml additional_dependencies. These come from the custom regex manager, which renovate names custom.regex, so the pre-commit rule above does not reach them.",
      "matchManagers": ["custom.regex"],
      "matchDatasources": ["npm"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "CI runner images.",
      "matchDatasources": ["github-runners"],
      "matchUpdateTypes": ["minor", "patch", "pin"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "Dev and test tooling only, scoped by depType: dependency-groups and tool.uv.dev-dependencies. Deliberately excludes project.dependencies, project.optional-dependencies and build-system.requires, so a runtime dependency added later defaults to manual review instead of inheriting auto-merge -- the pypi datasource is not in the denial above, so scoping here is the only guard. Repos that already ship runtime packages also deny them by name in the final rule. Only pep621 is listed because renovate has no separate uv manager: pep621 is the manager that handles uv projects, covering pyproject.toml, uv.lock and uv workspaces, so naming uv here would match nothing.",
      "matchManagers": ["pep621"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "matchDepTypes": ["dependency-groups", "tool.uv.dev-dependencies"]
    },
    {
      "description": "The uv required-version pin in [tool.uv], which comes from the custom regex manager rather than the native pep621 manager. Scoped by depName + pypi datasource so it does not sweep in other custom.regex managers or an apk `uv=` pin should one appear later.",
      "matchManagers": ["custom.regex"],
      "matchDepNames": ["uv"],
      "matchDatasources": ["pypi"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "Group the two lockstep uv bumps (ghcr.io/astral-sh/uv image + [tool.uv] required-version pin) into one PR. The shared 3-day release-age gate makes both members eligible on the same run so they land together — the pin already has it, this extends it to the docker half (which otherwise has none). Stays manual review: the docker half ships in the image (shipped-artifact deny rule above), and grouping doesn't grant auto-merge.",
      "matchPackageNames": ["uv", "ghcr.io/astral-sh/uv"],
      "groupName": "uv",
      "minimumReleaseAge": "3 days"
    },
    {
      "description": "Majors always get a human. Must stay last to override every opt-in above.",
      "matchUpdateTypes": ["major"],
      "automerge": false
    },
    {
      "description": "MANUAL REVIEW: home-assistant/builder builds the container users install. Also broken out of the github-actions group so a builder bump does not block auto-merge of every other action riding in the same PR.",
      "matchPackageNames": ["home-assistant/builder"],
      "groupName": "home-assistant builder",
      "automerge": false
    },
    {
      "description": "MANUAL REVIEW: paho-mqtt is pinned to == the version the image installs via apt (python3-paho-mqtt in the Dockerfile). It is a test dependency, but the exact-pin coupling to the shipped version is the point -- an automatic bump silently desyncs the test venv from what the add-on actually runs on.",
      "matchPackageNames": ["paho-mqtt"],
      "automerge": false
    }
  ],
  "prConcurrentLimit": 5,
  "automergeStrategy": "squash"
}