hermes-bot
826042f3ea
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Home Assistant 2026.11.0 requires Z-Wave JS Server schema 51. zwave-js-ui
11.21.1 ships @zwave-js/server 3.10 (schema 50), so the zwave_js entry is
stuck in setup_retry. 11.24.2 is the first release on @zwave-js/server
^3.11.0 (schema 51); bump to the current 11.25.2, pinned by digest.
11.25.2 is built on Alpine 3.23 (was 3.22). The role now reads the
Alpine release from the image and names the musl libeatmydata.so after
it, instead of a hand-synced edge_zwave_alpine_base: Renovate bumps the
image from now on, and the old `creates:` never refreshed the .so.
Builds for other Alpine releases are removed.
Renovate never read ansible/roles/*/defaults/main.yml: enabledManagers
had no custom.regex and there were no customManagers. Add one for
edge_<name>_image (docker datasource and versioning), and give ansible/**
updates their own PR, since the play runs from a workstation after the
merge (no Ansible pipeline since 0c1fb0a2).
278 lines
9.0 KiB
JSON
278 lines
9.0 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"local>konairius/renovate-config"
|
|
],
|
|
"enabledManagers": [
|
|
"flux",
|
|
"kubernetes",
|
|
"woodpecker",
|
|
"dockerfile",
|
|
"custom.regex"
|
|
],
|
|
"ignorePaths": [
|
|
"kubernetes/clusters/homelab/flux-system/**",
|
|
"kubernetes/infrastructure/image-automation/**"
|
|
],
|
|
"flux": {
|
|
"managerFilePatterns": [
|
|
"/^kubernetes/.+\\.ya?ml$/"
|
|
]
|
|
},
|
|
"kubernetes": {
|
|
"managerFilePatterns": [
|
|
"/^kubernetes/.+\\.ya?ml$/"
|
|
]
|
|
},
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Container images of the Ansible roles: `edge_<name>_image: <image>:<tag>@<digest>` in ansible/roles/*/defaults/main.yml. No other manager reads these files.",
|
|
"managerFilePatterns": [
|
|
"/^ansible/roles/[^/]+/defaults/main\\.ya?ml$/"
|
|
],
|
|
"matchStrings": [
|
|
"(?:^|\\n)edge_[a-z0-9_]+_image:[ \\t]*[\"']?(?<depName>[^\\s:@\"']+):(?<currentValue>[^\\s@\"']+)(?:@(?<currentDigest>sha256:[a-f0-9]{64}))?"
|
|
],
|
|
"datasourceTemplate": "docker",
|
|
"versioningTemplate": "docker"
|
|
}
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"description": "Flux image automation (kubernetes/infrastructure/image-automation) already bumps these images. Renovate must not open a second, competing update. Keep this list equal to the ImageRepository images there.",
|
|
"matchDatasources": [
|
|
"docker"
|
|
],
|
|
"matchPackageNames": [
|
|
"apache/tika",
|
|
"deluan/navidrome",
|
|
"docker.gitea.com/gitea-mcp-server",
|
|
"eclipse-mosquitto",
|
|
"everythingsmarthome/everything-presence-mmwave-configurator",
|
|
"ghcr.io/advplyr/audiobookshelf",
|
|
"ghcr.io/cloudnative-pg/plugin-barman-cloud",
|
|
"ghcr.io/cloudnative-pg/plugin-barman-cloud-sidecar",
|
|
"ghcr.io/home-assistant/home-assistant",
|
|
"ghcr.io/immich-app/immich-machine-learning",
|
|
"ghcr.io/immich-app/immich-server",
|
|
"ghcr.io/linuxserver/lidarr",
|
|
"ghcr.io/matter-js/python-matter-server",
|
|
"ghcr.io/music-assistant/server",
|
|
"ghcr.io/paperless-ngx/paperless-ngx",
|
|
"ghcr.io/usetrmnl/terminus",
|
|
"ghcr.io/usetrmnl/trmnl-ha-amd64",
|
|
"gitea.renner.uno/konairius/alpine-jq",
|
|
"gitea.renner.uno/konairius/alpine-openssl",
|
|
"gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost",
|
|
"gitea.renner.uno/konairius/authentik-samba-bridge-server",
|
|
"gitea.renner.uno/konairius/cni-plugins",
|
|
"gitea.renner.uno/konairius/hermes",
|
|
"gitea.renner.uno/konairius/ical-proxy",
|
|
"gitea.renner.uno/konairius/mqtt-account-controller",
|
|
"gitea.renner.uno/konairius/shelly-manager",
|
|
"gitea.renner.uno/konairius/vsftpd",
|
|
"gitea.renner.uno/konairius/wiki",
|
|
"gotenberg/gotenberg",
|
|
"netbirdio/netbird",
|
|
"quay.io/ceph/ceph",
|
|
"redis",
|
|
"rhasspy/wyoming-openwakeword",
|
|
"rhasspy/wyoming-speech-to-phrase",
|
|
"rhasspy/wyoming-whisper",
|
|
"shenxn/protonmail-bridge",
|
|
"twinproduction/gatus",
|
|
"valkey/valkey",
|
|
"velero/velero-plugin-for-aws",
|
|
"woodpeckerci/woodpecker-agent",
|
|
"woodpeckerci/woodpecker-server"
|
|
],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "homelab only: pinning a digest changes the pod spec and restarts the workload. Keep these out of the version-update PR, so a reviewer can merge them in a window, separately.",
|
|
"matchUpdateTypes": [
|
|
"pinDigest"
|
|
],
|
|
"groupName": "pin image digests",
|
|
"groupSlug": "pin-image-digests"
|
|
},
|
|
{
|
|
"description": "Cilium and Rook-Ceph: a minor version is a planned change with a window (maintainer duties). One PR per update, never in the weekly group.",
|
|
"matchPackageNames": [
|
|
"cilium",
|
|
"rook-ceph",
|
|
"rook-ceph-cluster"
|
|
],
|
|
"matchUpdateTypes": [
|
|
"minor",
|
|
"major"
|
|
],
|
|
"groupName": null
|
|
},
|
|
{
|
|
"description": "Our own images (gitea.renner.uno) are pinned by DATED TAG, never by digest (REN-315, ci-manifests-test no-digest-pins). Registry GC deletes their old digests, and a pod that restarts on a deleted digest cannot pull. Existing digest pins still get digest updates.",
|
|
"matchDatasources": [
|
|
"docker"
|
|
],
|
|
"matchPackageNames": [
|
|
"gitea.renner.uno/**"
|
|
],
|
|
"pinDigests": false
|
|
},
|
|
{
|
|
"description": "Home Assistant namespace: one PR of its own, so Hestia can do the HA-impact review and it merges 02:00-05:00 (REN-240, REN-315).",
|
|
"matchFileNames": [
|
|
"kubernetes/apps/home-assistant/**"
|
|
],
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"groupName": "home-assistant non-major",
|
|
"groupSlug": "home-assistant-minor-patch"
|
|
},
|
|
{
|
|
"description": "CI only (pipelines and CI images): nothing here reaches the cluster, so it merges without a window (REN-315).",
|
|
"matchFileNames": [
|
|
".woodpecker/**",
|
|
"ci/images/**"
|
|
],
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"groupName": "CI non-major",
|
|
"groupSlug": "ci-minor-patch"
|
|
},
|
|
{
|
|
"description": "Edge-host images (ansible/): no pipeline deploys them, the play runs from a workstation after the merge. One PR of its own, so the merge and the play run go together.",
|
|
"matchFileNames": [
|
|
"ansible/**"
|
|
],
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"groupName": "edge hosts (ansible)",
|
|
"groupSlug": "edge-hosts-ansible"
|
|
},
|
|
{
|
|
"description": "Stateful apps and the CNI: one PR each, never in a group (REN-315). A git revert does not undo a DB migration or a CNI change, so each needs its own review and, where it can disrupt the cluster, a window.",
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"matchPackageNames": [
|
|
"gitea/gitea"
|
|
],
|
|
"groupName": "gitea",
|
|
"groupSlug": "gitea"
|
|
},
|
|
{
|
|
"description": "authentik: chart and images together, one PR (REN-315, DB migrations).",
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"matchPackageNames": [
|
|
"authentik",
|
|
"ghcr.io/goauthentik/**"
|
|
],
|
|
"groupName": "authentik",
|
|
"groupSlug": "authentik"
|
|
},
|
|
{
|
|
"description": "InfluxDB: chart and image together, one PR (REN-315, data migrations).",
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"matchPackageNames": [
|
|
"influxdb",
|
|
"influxdb2"
|
|
],
|
|
"groupName": "influxdb",
|
|
"groupSlug": "influxdb"
|
|
},
|
|
{
|
|
"description": "OpenBao: chart and image together, one PR (REN-315, raft storage, the secrets backend). rangeStrategy bump: the default (replace) rewrote the bounded chart range \">=0.28.4 <0.29.0\" to \"<0.30.0\" (homelab #1054) and dropped the lower bound. bump keeps the shape, e.g. \">=0.29.6 <0.30.0\".",
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"matchPackageNames": [
|
|
"openbao",
|
|
"quay.io/openbao/openbao"
|
|
],
|
|
"groupName": "openbao",
|
|
"groupSlug": "openbao"
|
|
},
|
|
{
|
|
"matchDatasources": [
|
|
"helm"
|
|
],
|
|
"matchPackageNames": [
|
|
"openbao"
|
|
],
|
|
"rangeStrategy": "bump"
|
|
},
|
|
{
|
|
"description": "Multus, whereabouts and the CNI plugins: one PR for the directory (REN-315). A CNI change can cut pod networking on every node.",
|
|
"matchFileNames": [
|
|
"kubernetes/infrastructure/multus/**"
|
|
],
|
|
"matchUpdateTypes": [
|
|
"patch",
|
|
"minor",
|
|
"digest",
|
|
"pin"
|
|
],
|
|
"groupName": "multus CNI",
|
|
"groupSlug": "multus"
|
|
},
|
|
{
|
|
"description": "LinuxServer tags are <semver>-ls<n>; the default docker versioning reads -ls<n> as a compatibility suffix and never proposes a new one. Beets (REN-350) is Renovate-tracked, not Flux image automation.",
|
|
"matchDatasources": [
|
|
"docker"
|
|
],
|
|
"matchPackageNames": [
|
|
"lscr.io/linuxserver/beets"
|
|
],
|
|
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<build>\\d+)$"
|
|
},
|
|
{
|
|
"description": "Hermes image (ci/images/hermes): its merge rolls out to the cluster via Flux image automation, so it is not CI-only. One PR of its own.",
|
|
"matchFileNames": [
|
|
"ci/images/hermes/**"
|
|
],
|
|
"groupName": "hermes image",
|
|
"groupSlug": "hermes-image"
|
|
},
|
|
{
|
|
"description": "nousresearch/hermes-agent also carries the retired date-versioned tags (v2026.x), which sort above v0.x.",
|
|
"matchDatasources": [
|
|
"docker"
|
|
],
|
|
"matchPackageNames": [
|
|
"nousresearch/hermes-agent"
|
|
],
|
|
"allowedVersions": "/^v0\\./"
|
|
}
|
|
]
|
|
}
|