0f7d21d2c5
* fix(renovate): add cosign to exclusion rules * remove cooldown for now * also add zizmor to excludes
74 lines
2.2 KiB
Text
74 lines
2.2 KiB
Text
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:best-practices"
|
|
],
|
|
|
|
"baseBranchPatterns": ["main", "/^stable-f[0-9][0-9]$/"],
|
|
|
|
// Do not rebase when the default branch is updated
|
|
"rebaseWhen": "never",
|
|
|
|
"packageRules": [
|
|
{
|
|
"automerge": true,
|
|
"matchUpdateTypes": ["pin", "pinDigest"]
|
|
},
|
|
{
|
|
"automerge": true,
|
|
"matchManagers": ["dockerfile"],
|
|
"matchUpdateTypes": ["digest"]
|
|
},
|
|
{
|
|
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
|
"matchUpdateTypes": ["major"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"matchDepNames": [
|
|
"ghcr.io/ublue-os/brew",
|
|
"ghcr.io/get-aurora-dev/common"
|
|
],
|
|
"matchBaseBranches": ["main"],
|
|
"automerge": true,
|
|
"matchUpdateTypes": ["digest"]
|
|
},
|
|
{
|
|
"matchDepNames": [
|
|
"ghcr.io/ublue-os/brew",
|
|
"ghcr.io/get-aurora-dev/common"
|
|
],
|
|
// Brew and common are not "security updates", they have to go through :testing/main first
|
|
// to reach a stable release
|
|
"matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"matchManagers": ["github-actions"],
|
|
"matchDepNames": [
|
|
"!oras-project/setup-oras",
|
|
"!sigstore/cosign-installer",
|
|
"!sigstore/cosign",
|
|
"!zizmorcore/zizmor-action",
|
|
"!anchore/sbom-action"
|
|
],
|
|
"schedule": ["on sunday"]
|
|
},
|
|
// these two are needed because we don't really run images based on a schedule
|
|
// :testing/main branch must be defined first or else it overwrites rules for stable
|
|
{
|
|
"description": "Automerge kinoite digest updates on main with default merge strategy",
|
|
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
|
"matchUpdateTypes": ["digest"],
|
|
"automerge": true
|
|
},
|
|
{
|
|
"description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions",
|
|
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
|
"matchUpdateTypes": ["digest"],
|
|
"matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
|
|
"automergeStrategy": "merge-commit",
|
|
"automerge": true
|
|
}
|
|
]
|
|
}
|