renovate.json5

{
  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
  extends: ['config:recommended'],

  // Only the custom regex manager below — do NOT let the built-in dockerfile /
  // github-actions managers open PRs for base images or action pins (out of scope).
  enabledManagers: ['custom.regex'],

  // Pins tools these images used to pull at build time. Replaces the daily cron:
  // a bump PR triggers the push-based build. No release -> no PR -> no rebuild.
  customManagers: [
    {
      customType: 'regex',
      managerFilePatterns: ['/(^|/)Dockerfile$/'],
      matchStrings: [
        '# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>\\S+)\\s+ARG [A-Z_]+_VERSION=(?<currentValue>\\S+)',
      ],
    },
  ],

  packageRules: [
    {
      // Strip the leading "v" so tags match the bare ARG value. Tags without one
      // pass through unchanged, so this is safe datasource-wide.
      matchDatasources: ['github-releases', 'github-tags'],
      extractVersion: '^v?(?<version>.+)$',
    },
    {
      // One grouped PR, auto-merged on green via Renovate's default
      // platformAutomerge. Setting it false broke this before: only a Renovate run
      // could merge, and each run force-pushed a newer claude-code before CI
      // finished (#121 sat green 3.5 weeks). Requires "Allow auto-merge" plus a
      // master ruleset requiring the "CI complete" check, or it silently regresses.
      matchPackageNames: [
        'rtk-ai/rtk',
        'umputun/ralphex',
        '@anthropic-ai/claude-code',
        'agent-browser',
        'cli/cli',            // gh — upstream .deb; apt's trixie build is frozen at 2.46.0
        'github/gh-stack',    // gh extension for native stacked PRs
        'cf',                 // Cloudflare CLI; in open beta, so npm `latest` is a prerelease
        'docker/cli',         // docker CLI static binary (download.docker.com).
                              // github-tags, NOT github-releases: moby/moby tags its
                              // releases 'docker-v29.8.0', which extractVersion cannot
                              // parse, so every candidate is silently discarded.
        'go',                 // ralphex-fe Go toolchain (go.dev)
        'node',               // hugo-bun-node musl build; base-image node is NOT managed here
      ],
      groupName: 'devcontainer tools',
      automerge: true,

      // These merge unreviewed and publish straight to ghcr.io, so let releases
      // soak. Too-young versions are simply not offered; the PR carries the rest.
      minimumReleaseAge: '3 days',
    },
    {
      // ...except claude-code, which is tracked at latest deliberately.
      // Later packageRules win, so this clears the soak period above.
      matchPackageNames: ['@anthropic-ai/claude-code'],
      minimumReleaseAge: null,
    },
    {
      // ralphex-fe has no mise and its tag is literally bun<BUN>-hugo<HUGO>, so
      // these are image-level versions. Bun uses npm: its tags are "bun-v1.4.2",
      // which the extractVersion above does not strip.
      matchPackageNames: ['bun', 'gohugoio/hugo'],
      groupName: 'ralphex-fe toolchain',
      automerge: true,
      minimumReleaseAge: '3 days',
    },
    {
      // hugo-bun-node's alpine base ships no node, so it installs the musl build.
      // Node 24 LTS by design — majors stay a deliberate call.
      matchDatasources: ['node-version'],
      allowedVersions: '^24',
    },
  ],
}