ci: teach Renovate to bump the Dockerfile ARG PNPM_VERSION

[adamXbot]

Summary

Renovate bumps pnpm in package.json's packageManager field and in the pnpm/action-setup version: inputs across the workflows, but the Dockerfile's ARG PNPM_VERSION was invisible to it. PR #125 showed the resulting drift: everything moved to 11.12.0 while the ARG stayed 11.1.2 — exactly what the Dockerfile's own lockstep comment warns about. Docker builds then bootstrap an old pnpm which self-switches to the packageManager version at build time (non-hermetic, and it crashed outright when the target was the broken pnpm@11.12.0 release).

This adds a customManagers regex entry to renovate.json that treats the ARG as the npm pnpm package:

• managerFilePatterns: ["/^Dockerfile$/"], matchStrings: ["ARG PNPM_VERSION=(?<currentValue>.*)"], datasource=npm, packageName=pnpm, versioning=npm (same semantics as the packageManager bump).
• No packageRules change needed: the existing "all non-major dependencies" group has no manager/datasource filter, so the ARG bump lands in the same single grouped non-major PR on the stable branch, and a major pnpm bump parks on the Dependency Dashboard like everything else.
• The regex requires the literal =, so the value-less ARG PNPM_VERSION stage redeclaration on line 18 is not matched.

Also updates the Dockerfile lockstep comment and the AGENTS.md Renovate section to note the ARG is now automated.

Verification

• Simulated Renovate's extraction against the current Dockerfile: exactly one match, currentValue = "11.1.2"; the value-less redeclaration doesn't match; /^Dockerfile$/ matches the root Dockerfile only.
• renovate-config-validator --strict renovate.json (renovate v46 generation, matching the pinned renovatebot/github-action v46.1.18): validated successfully, no deprecation warnings (uses the current managerFilePatterns field, not the deprecated fileMatch).
• pnpm exec biome check renovate.json: clean. (The repo-wide pnpm lint checks 0 files from inside a .claude/worktrees/ checkout because biome.jsonc excludes **/.claude — worktree artifact, not a repo issue.)

🤖 Generated with Claude Code

[adamXbot]

Dry-run verification — triggered the Renovate workflow via workflow_dispatch (dryRun=full, logLevel=debug) from this PR's branch, so the action loaded this PR's renovate.json as its config while Renovate extracted dependencies from main's files — a faithful preview of post-merge behaviour. Renovate CLI in the run: ghcr.io/renovatebot/renovate:43 (43.272.0); config loaded with no migration/validation warnings. The dry-run changed nothing.

Run: https://github.com/privacykey/privacytracker/actions/runs/29712772410

1. The custom manager extracts the ARG

Manager stats now include the regex manager with exactly one dependency — and only one, i.e. the value-less ARG PNPM_VERSION stage redeclaration on line 18 is correctly not matched:

INFO: Dependency extraction complete (repository=privacykey/privacytracker, baseBranch=main)
"stats": {
  "managers": {
    "cargo": {"fileCount": 1, "depCount": 25},
    "docker-compose": {"fileCount": 4, "depCount": 4},
    "dockerfile": {"fileCount": 1, "depCount": 2},
    "github-actions": {"fileCount": 9, "depCount": 93},
    "npm": {"fileCount": 2, "depCount": 35},
    "regex": {"fileCount": 1, "depCount": 1}
  },
  "total": {"fileCount": 18, "depCount": 160}
}

2. The dep resolves and lands in the grouped branch

pnpm 11.1.2 → 11.15.1, classified minor / bucket non-major, assigned to renovate/all-non-major — the same single grouped PR as every other pnpm pin (excerpt trimmed to the relevant fields):

"regex": [
  {
    "deps": [
      {
        "packageName": "pnpm",
        "currentValue": "11.1.2",
        "datasource": "npm",
        "versioning": "npm",
        "replaceString": "ARG PNPM_VERSION=11.1.2",
        "depName": "pnpm",
        "updates": [
          {
            "bucket": "non-major",
            "newVersion": "11.15.1",
            "updateType": "minor",
            "branchName": "renovate/all-non-major"
          }
        ]
      }
    ],
    "matchStrings": ["ARG PNPM_VERSION=(?<currentValue>.*)"],
    "packageNameTemplate": "pnpm",
    "datasourceTemplate": "npm",
    "versioningTemplate": "npm",
    "packageFile": "Dockerfile"
  }
]

3. The Dockerfile is in the would-commit file list

INFO: DRY-RUN: Would commit files to branch renovate/all-non-major.

The raw commit info for that branch (which is open PR #125) lists "path": "Dockerfile" with the line rewritten to ARG PNPM_VERSION=11.15.1, alongside package.json, all nine workflow files (pnpm/action-setup version: 11.15.1), src-tauri/Cargo.toml + Cargo.lock, and pnpm-lock.yaml — one grouped PR, as intended.

Notes

• Renovate's pnpm target has moved past the broken 11.12.0 to 11.15.1, so the next live run also heals fix(deps): update all non-major dependencies #125's existing drift — the branch's current Dockerfile still shows ARG PNPM_VERSION=11.1.2 in the log's existingContent, and the dry-run shows exactly that gap closing.
• Once this PR merges, the repo config on main carries the same customManagers entry, so scheduled runs behave identically to this preview.

🤖 Generated with Claude Code