Skip to content

chore: Configure Renovate - #1

Open
alaudaa-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/configure
Open

alaudaa-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/configure

Conversation

@alaudaa-renovate

Copy link
Copy Markdown

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.


Detected Package Files

  • Dockerfile (dockerfile)
  • dockerfiles/authors.Dockerfile (dockerfile)
  • dockerfiles/docs.Dockerfile (dockerfile)
  • dockerfiles/git.Dockerfile (dockerfile)
  • dockerfiles/lint.Dockerfile (dockerfile)
  • dockerfiles/vendor.Dockerfile (dockerfile)
  • project/dev-image/Dockerfile (dockerfile)
  • go.mod (gomod)

Configuration Summary

Based on the default config's presets, Renovate will:

  • Start dependency updates only once this onboarding PR is merged
  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Update _VERSION variables in Dockerfiles.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch and select the Retry/Rebase checkbox below. Renovate will update the Pull Request description the next time it runs.


You have configured Renovate to use branch main as base branch.

What to Expect

With your current configuration, Renovate will create 13 Pull Requests:

chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [security]
chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [security]
chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [security]
chore(deps): update module google.golang.org/grpc to v1.79.3 [security]
  • Branch name: renovate/go-google.golang.org-grpc-vulnerability
  • Merge into: main
  • Upgrade google.golang.org/grpc to v1.79.3
fix(deps): update module github.com/go-jose/go-jose/v4 to v4.1.4 [security]
fix(deps): update module go.opentelemetry.io/otel/sdk to v1.43.0 [security]
fix(deps): update module golang.org/x/crypto to v0.45.0 [security]
  • Branch name: renovate/go-golang.org-x-crypto-vulnerability
  • Merge into: main
  • Upgrade golang.org/x/crypto to v0.45.0
fix(deps): update module golang.org/x/net to v0.45.0 [security]
  • Branch name: renovate/go-golang.org-x-net-vulnerability
  • Merge into: main
  • Upgrade golang.org/x/net to v0.45.0
chore(deps): update all patch dependencies (patch)
  • Schedule: ["at any time"]
  • Branch name: renovate/patch-patch-upgrades
  • Merge into: main
  • Upgrade golang to 1.23.12-alpine3.21
  • Upgrade ubuntu to 14.04.5
chore(deps): update alpine docker tag to v3.23
  • Schedule: ["at any time"]
  • Branch name: renovate/alpine-3.x
  • Merge into: main
  • Upgrade alpine to 3.23
chore(deps): update golang docker tag to v1.25.5
  • Schedule: ["at any time"]
  • Branch name: renovate/go-official-packages
  • Merge into: main
  • Upgrade golang to 1.25.5-alpine3.21
chore(deps): update psampaz/go-mod-outdated docker tag to v0.9.0
  • Schedule: ["at any time"]
  • Branch name: renovate/psampaz-go-mod-outdated-0.x
  • Merge into: main
  • Upgrade psampaz/go-mod-outdated to v0.9.0
chore(deps): update tonistiigi/xx docker tag to v1.9.0
  • Schedule: ["at any time"]
  • Branch name: renovate/tonistiigi-xx-1.x
  • Merge into: main
  • Upgrade tonistiigi/xx to 1.9.0

🚸 Branch creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prhourlylimit for details.


❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.


  • If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by Renovate Bot.

@alaudabot

Copy link
Copy Markdown

🤖 AI Code Review

Property Value
Model opencode/minimax-m2.5-free
Style strict
Issues Found 0
Config Source centralized
Profile ❌ Not Found
Personalized Prompt ❌ No
Prompt Path .github/review/profiles/alaudadevops/goharbor-distribution/pr-review.md
Alauda Skills ✅ base-authoring, base-m365, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-publish-errata, builders-story-split, devops-autodns, devops-bulk-string-replace, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-write-user-docs, devops-docker-keyword-analysis, devops-gen-advanced-form-descriptors, devops-go-vuln-fix, devops-knowledge-adoption, devops-refresh-alauda-tags, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-update-containerfile-digests, devops-upgrade-go
Reviewed at 2026-04-22 04:03:39 UTC

Summary

This PR adds a Renovate configuration file to enable automated dependency updates. The configuration extends the centralized AlaudaDevops/renovate-config:base shared config and sets the default base branch. Changes are clean, minimal, and follow Renovate best practices.

Review Statistics

Category Count
Critical Issues 0
Warnings 0
Suggestions 1
Files Reviewed 1

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

None.

Warnings

Issues that SHOULD be addressed but are not blocking

None.

Suggestions

Recommendations for improvement (nice to have)

  • [renovate.json:6] (style/consistency): Consider adding a comment explaining what $default base branch means for this repository, especially if there are multiple active branches.

Positive Feedback

  • The configuration is well-structured and follows the Renovate JSON schema
  • Using the centralized shared config (github>AlaudaDevops/renovate-config:base) promotes consistency across repositories
  • The $schema is properly included for IDE validation support


ℹ️ About this review

This review was automatically generated using the run-actions workflow.

  • Shared prompt: .github/prompts/code-review.md
  • Config source: centralized
  • Profile path: Not Found
  • Profile ref: 32955711ef1af066b0af463dc0cecc5ccc39be41
  • No repository-specific prompt configured
  • Alauda skills: base-authoring, base-m365, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-publish-errata, builders-story-split, devops-autodns, devops-bulk-string-replace, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-write-user-docs, devops-docker-keyword-analysis, devops-gen-advanced-form-descriptors, devops-go-vuln-fix, devops-knowledge-adoption, devops-refresh-alauda-tags, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-update-containerfile-digests, devops-upgrade-go

@alaudabot

Copy link
Copy Markdown

🚨 Stale Pull Request Warning

This pull request has been inactive for 33 days.

Automated Actions Schedule:

  • ⚠️ Warning: After 30 days (now)
  • 🔒 Auto-close: After 60 days
  • 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

  • Add new commits
  • Reply to this comment
  • Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

@alaudabot

Copy link
Copy Markdown

🚨 Stale Pull Request Warning

This pull request has been inactive for 35 days.

Automated Actions Schedule:

  • ⚠️ Warning: After 30 days (now)
  • 🔒 Auto-close: After 60 days
  • 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

  • Add new commits
  • Reply to this comment
  • Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant