jlab-cluster/helm-charts
3
0 Fork 0
Code Issues 15 Pull Requests 3 Actions Packages Wiki Activity

renovate: align the config with cluster-config #35

Merged
jklein merged 1 commits from chore/renovate-align-cluster-config into main 2026-09-22 21:49:06 +02:00
Conversation 1 Commits 1 Files Changed 3
+88 -35
jlab-bot commented 2026-09-22 21:46:40 +02:00
Member
Copy link
Copy source

Aligns renovate.json5 with the Renovate configuration of cluster-config, so both repositories behave the same way on the shared jlab-renovate-bot instance.

Fixes #34

What changed in renovate.json5

  • extends: added config:best-practices (:semanticCommitsDisabled kept).
  • labels: ["dependencies"] → ["renovate"]; dependencyDashboard: true now explicit.
  • prHourlyLimit: 4 → 0, prConcurrentLimit: 10 → 100.
  • separateMinorPatch: true (new) — minor and patch arrive as separate PRs.
  • Global automerge: true, automergeType: "pr", platformAutomerge: true, majors included.
  • New rule: pinDigests: false for matchManagers: ["custom.regex", "helm-values"].

Kept on purpose: minimumReleaseAge: "3 days" for patch/minor/digest (every merge here publishes a chart), ignorePaths, the ci/** opt-out, every per-chart customManagers block, the nginx even-minor constraint, the qbittorrent tag exclusions, separateMultipleMajor and postUpgradeTasks.

The part that is not a settings change: comments that had become false

A review requirement and validate-charts as a required check are both active on main now. Several passages asserted the opposite in so many words, and they are rewritten rather than left to rot — with the reason the value changed, not just the new value:

  • renovate.json5, the platformAutomerge: false comment ("validate-charts is not (yet) a required check on either side"). That comment itself named the condition under which true becomes the better value; the condition arrived.
  • renovate.json5, the automerge rule's "Majors stay manual". The rule is now an age gate, not an automerge switch, and says so.
  • renovate.json5, the helmv3/subchart block ("A major arrives as a PR to merge by hand") and the mediathekarr block ("automerged under the 'digest' update type in the rule above").
  • renovate.json5, the searxng comment calling the measured downgrade "unattended".
  • README.md → "PR policy": rewritten completely.
  • README.md → "Where this repo lives": says now that validate-charts is required as the single context the matrix reports under — per chart is the part that is impossible, not required checks as such.
  • CLAUDE.md, the two forge bullets on auto-merge and required checks. Flagging this explicitly for review, since it is the binding file: the edit is factual (auto-merge waits for the check and the review; validate-charts is required), rules 1–8 of the workflow are untouched.

The knock-on effect, stated once where it belongs: with platformAutomerge: true the PR is armed and the forge merges it when the required check passes and the review exists. Automerging majors is therefore not unattended merging — the review is the gate. That is the same reasoning cluster-config records.

Heads-up: config:best-practices will rewrite the workflow files

It pulls in helpers:pinGitHubActionDigests, so Renovate will start proposing SHA pins for actions/checkout@v7 and friends across .github/workflows/. That is wanted (cluster-config keeps it deliberately), but it is a visible, repo-wide diff and should not arrive as a surprise.

It also pulls in docker:pinDigests, which is why the new pinDigests: false rule exists: an appVersion: is a tag by construction — templates render <repo>:{{ .Chart.AppVersion }} and the chart version's +up suffix is built from the same string — so a digest has nowhere to go. helm-values opts out too, for now: pinning sidecar digests would make every digest change a chart patch plus a publish, and that is its own decision.

The other members of the preset (:configMigration, :pinDevDependencies, abandonments:recommended, security:minimumReleaseAgeNpm, :maintainLockFilesWeekly) are inert in a repository without a package manager.

Known cost, written down rather than discovered

With no hourly limit and 23 charts, the first run after a quiet week can open many PRs at once, and every chart PR starts a k3d install-test. On a Gitea runner a whole matrix runs inside one job, so those queue instead of fanning out. Accepted trade for lifting the caps.

Wiki

Updated and pushed in the same round of work: Renovate (PR policy rewritten), Forge-and-Tooling (auto-merge and the required check), Versioning (majors automerge too, so the order of a stepwise major jump is kept at the review), CI-CD (required check, and why the install-test blocking counts double now), plus Lessons-Learned and searxng, which quoted the searxng downgrade as something that happened "unattended".

Validation

  • renovate-config-validator could not be run: this workspace has no node/npm/npx at all, so there is no way to execute it here. Said plainly rather than skipped over.
  • JSON5 parse check, with the parsed result dumped and read back key by key: all top-level settings are as listed above, 7 packageRules and 24 customManagers survive the change unchanged in substance.
  • Setting-by-setting diff against cluster-config/renovate.json, which is the reference. The deliberate differences are this repo's own: ignorePaths: ["template-chart/**"], the ci/** opt-out, the per-chart managers, the nginx/qbittorrent constraints, postUpgradeTasks, and pinDigests: false on custom.regex + helm-values where cluster-config uses fleet + custom.regex (its manager, our managers, same reason).
  • ci/run-quantity-render-test.sh: passes, 22 charts exercised, 0 failed. The config is not a chart, so there is no version bump and no install-test fixture entry.

Not verifiable from this workspace, at all: the instance-side behaviour. Whether the shared instance picks up config:best-practices, how many PRs the first run actually opens, and whether auto-merge on Gitea behaves as described can only be observed after the merge, on the instance.

Aligns `renovate.json5` with the Renovate configuration of **cluster-config**, so both repositories behave the same way on the shared `jlab-renovate-bot` instance. Fixes #34 ## What changed in `renovate.json5` - `extends`: added `config:best-practices` (`:semanticCommitsDisabled` kept). - `labels`: `["dependencies"]` → `["renovate"]`; `dependencyDashboard: true` now explicit. - `prHourlyLimit: 4` → `0`, `prConcurrentLimit: 10` → `100`. - `separateMinorPatch: true` (new) — minor and patch arrive as separate PRs. - Global `automerge: true`, `automergeType: "pr"`, `platformAutomerge: true`, **majors included**. - New rule: `pinDigests: false` for `matchManagers: ["custom.regex", "helm-values"]`. Kept on purpose: `minimumReleaseAge: "3 days"` for patch/minor/digest (every merge here publishes a chart), `ignorePaths`, the `ci/**` opt-out, every per-chart `customManagers` block, the nginx even-minor constraint, the qbittorrent tag exclusions, `separateMultipleMajor` and `postUpgradeTasks`. ## The part that is not a settings change: comments that had become false A review requirement and `validate-charts` as a required check are both active on `main` now. Several passages asserted the opposite in so many words, and they are rewritten rather than left to rot — with the reason the value changed, not just the new value: - `renovate.json5`, the `platformAutomerge: false` comment ("validate-charts is not (yet) a required check on either side"). That comment itself named the condition under which `true` becomes the better value; the condition arrived. - `renovate.json5`, the automerge rule's "Majors stay manual". The rule is now an age gate, not an automerge switch, and says so. - `renovate.json5`, the `helmv3`/subchart block ("A major arrives as a PR to merge by hand") and the mediathekarr block ("automerged under the 'digest' update type in the rule above"). - `renovate.json5`, the searxng comment calling the measured downgrade "unattended". - `README.md` → "PR policy": rewritten completely. - `README.md` → "Where this repo lives": says now that `validate-charts` **is** required as the single context the matrix reports under — *per chart* is the part that is impossible, not required checks as such. - `CLAUDE.md`, the two forge bullets on auto-merge and required checks. **Flagging this explicitly for review**, since it is the binding file: the edit is factual (auto-merge waits for the check *and* the review; `validate-charts` is required), rules 1–8 of the workflow are untouched. The knock-on effect, stated once where it belongs: with `platformAutomerge: true` the PR is armed and the forge merges it when the required check passes **and** the review exists. Automerging majors is therefore not unattended merging — the review is the gate. That is the same reasoning cluster-config records. ## Heads-up: `config:best-practices` will rewrite the workflow files It pulls in `helpers:pinGitHubActionDigests`, so Renovate will start proposing SHA pins for `actions/checkout@v7` and friends across `.github/workflows/`. That is wanted (cluster-config keeps it deliberately), but it is a visible, repo-wide diff and should not arrive as a surprise. It also pulls in `docker:pinDigests`, which is why the new `pinDigests: false` rule exists: an `appVersion:` is a tag by construction — templates render `<repo>:{{ .Chart.AppVersion }}` and the chart version's `+up` suffix is built from the same string — so a digest has nowhere to go. `helm-values` opts out too, for now: pinning sidecar digests would make every digest change a chart patch plus a publish, and that is its own decision. The other members of the preset (`:configMigration`, `:pinDevDependencies`, `abandonments:recommended`, `security:minimumReleaseAgeNpm`, `:maintainLockFilesWeekly`) are inert in a repository without a package manager. ## Known cost, written down rather than discovered With no hourly limit and 23 charts, the first run after a quiet week can open many PRs at once, and every chart PR starts a k3d install-test. On a Gitea runner a whole matrix runs inside one job, so those queue instead of fanning out. Accepted trade for lifting the caps. ## Wiki Updated and pushed in the same round of work: `Renovate` (PR policy rewritten), `Forge-and-Tooling` (auto-merge and the required check), `Versioning` (majors automerge too, so the order of a stepwise major jump is kept at the review), `CI-CD` (required check, and why the install-test blocking counts double now), plus `Lessons-Learned` and `searxng`, which quoted the searxng downgrade as something that happened "unattended". ## Validation - **`renovate-config-validator` could not be run**: this workspace has no node/npm/npx at all, so there is no way to execute it here. Said plainly rather than skipped over. - **JSON5 parse check**, with the parsed result dumped and read back key by key: all top-level settings are as listed above, 7 `packageRules` and 24 `customManagers` survive the change unchanged in substance. - **Setting-by-setting diff against `cluster-config/renovate.json`**, which is the reference. The deliberate differences are this repo's own: `ignorePaths: ["template-chart/**"]`, the `ci/**` opt-out, the per-chart managers, the nginx/qbittorrent constraints, `postUpgradeTasks`, and `pinDigests: false` on `custom.regex` + `helm-values` where cluster-config uses `fleet` + `custom.regex` (its manager, our managers, same reason). - **`ci/run-quantity-render-test.sh`**: passes, 22 charts exercised, 0 failed. The config is not a chart, so there is no version bump and no install-test fixture entry. **Not verifiable from this workspace, at all:** the instance-side behaviour. Whether the shared instance picks up `config:best-practices`, how many PRs the first run actually opens, and whether auto-merge on Gitea behaves as described can only be observed after the merge, on the instance.
jlab-bot added 1 commit 2026-09-22 21:46:40 +02:00
renovate: align the config with cluster-config
Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s
Details
Validate Helm Charts / Build ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} (pull_request) Skipped
Details
Validate Helm Charts / Trivy config ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }} (pull_request) Skipped
Details
Validate Helm Charts / Install-test ${{ fromJSON(needs.detect-changed-charts.outputs.install-charts) }} (pull_request) Skipped
Details
Validate Helm Charts / Resource quantities (pull_request) Successful in 8s
Details
02b3c3ce75 
The shared jlab-renovate-bot instance serves this repo and cluster-config,
and two repos behaving differently under one bot is a source of surprises
rather than of safety. This adopts cluster-config's configuration:
config:best-practices in extends, labels ["renovate"], no PR caps
(prHourlyLimit 0, prConcurrentLimit 100), separateMinorPatch, an explicit
dependencyDashboard, and global automerge with platformAutomerge.

Two of those choices were previously wrong here and are now right, because
the branch protection on main has caught up: a review requirement and
validate-charts as a required check are both active. platformAutomerge
therefore arms the PR on the forge and Gitea merges it when the check
passes AND the review exists - the review is the gate, which is what makes
automerging majors something other than unattended merging.

Comments that asserted the opposite are rewritten rather than left to rot:
the platformAutomerge: false comment ("not (yet) a required check on either
side"), the "Majors stay manual" rule, the README PR policy bullets and the
required-check paragraph, and the CLAUDE.md forge notes.

config:best-practices pulls in docker:pinDigests, which is switched off
again for custom.regex and helm-values: an appVersion: is a tag by
construction and has nowhere to put a digest. Kept deliberately:
minimumReleaseAge of three days on the routine updates (every merge here
publishes a chart), the ignorePaths and ci/** opt-outs, every per-chart
manager, the nginx and qbittorrent constraints, and postUpgradeTasks.

Fixes #34
jklein approved these changes 2026-09-22 21:49:03 +02:00
jklein merged commit 02b3c3ce75 into main 2026-09-22 21:49:06 +02:00
jklein deleted branch chore/renovate-align-cluster-config 2026-09-22 21:49:06 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
jklein
Labels
Clear labels
inhouse-chart
Inhouse-Chart aus der JLab-Git-Paketregistry
 renovate
Von Renovate angelegt
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jklein (Justin Klein) jlab-bot (jlab-git-bot) jlab-renovate-bot (jlab-renovate-bot)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jlab-cluster/helm-charts#35