Lumpiasty
ea0d90d8f0
Add .woodpecker/pr-build.yaml: builds all three arches (dry-run, no push) on PRs and pushes to main, reporting status to Gitea. This is the gate for automerge. renovate.json automerge rules (platformAutomerge, merged only after the PR build passes): - tailscale stable patch AND minor - Go/Alpine/busybox PATCH only - base-image digest refreshes Minor/major of build deps and tooling stay manual. Move pinDigests into a dockerfile packageRule (top-level dockerfile.* is deprecated). Document the automerge policy and its caveat (PR build proves build-only, not runtime) in DESIGN.md.
48 lines
1.7 KiB
JSON
48 lines
1.7 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":dependencyDashboard",
|
|
":semanticCommits"
|
|
],
|
|
"labels": ["dependencies"],
|
|
"rebaseWhen": "behind-base-branch",
|
|
"packageRules": [
|
|
{
|
|
"matchManagers": ["dockerfile"],
|
|
"description": "Keep base-image tags pinned to a digest.",
|
|
"pinDigests": true
|
|
},
|
|
{
|
|
"matchDatasources": ["github-releases"],
|
|
"matchPackageNames": ["tailscale/tailscale"],
|
|
"description": "TAILSCALE_VERSION ARG: only stable releases. Tailscale uses EVEN minor versions for stable (v1.98.x); ODD minors (v1.99.x) are unstable, so filter to even minors and ignore pre-releases.",
|
|
"extractVersion": "^v(?<version>\\d+\\.\\d+\\.\\d+)$",
|
|
"allowedVersions": "/^\\d+\\.\\d*[02468]\\.\\d+$/",
|
|
"ignoreUnstable": true
|
|
},
|
|
{
|
|
"matchDatasources": ["github-releases"],
|
|
"matchPackageNames": ["tailscale/tailscale"],
|
|
"description": "Automerge all stable Tailscale releases (patch AND minor) once the PR build passes.",
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"automerge": true
|
|
},
|
|
{
|
|
"matchManagers": ["dockerfile"],
|
|
"matchPackageNames": ["golang", "alpine", "busybox"],
|
|
"description": "Automerge PATCH-only bumps of build components (Go/Alpine/busybox) once the PR build passes; review minor/major manually.",
|
|
"matchUpdateTypes": ["patch"],
|
|
"automerge": true
|
|
},
|
|
{
|
|
"matchManagers": ["dockerfile"],
|
|
"matchUpdateTypes": ["digest", "pinDigest"],
|
|
"description": "Automerge base-image digest refreshes (same tag, new sha256) once the PR build passes.",
|
|
"automerge": true
|
|
}
|
|
],
|
|
"automergeType": "pr",
|
|
"platformAutomerge": true
|
|
}
|