From f07e0e8212d82ecf5dca438197c2498872803303 Mon Sep 17 00:00:00 2001 From: adamXbot <111877622+adamXbot@users.noreply.github.com> Date: Sun, 19 Jul 2026 21:03:53 +1000 Subject: [PATCH] ci: teach Renovate to bump the Dockerfile ARG PNPM_VERSION MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate already bumps pnpm in package.json's packageManager field and in the pnpm/action-setup version inputs across the workflows, but the Dockerfile's ARG PNPM_VERSION was invisible to it — PR #125 moved everything to 11.12.0 while the ARG stayed 11.1.2, exactly the drift the Dockerfile comment warns about. Docker builds then bootstrap an old pnpm that self-switches to the packageManager version at build time (non-hermetic, and it crashed outright on the broken pnpm@11.12.0). Add a customManagers regex entry that treats the ARG as the npm `pnpm` package. No packageRules change needed: the existing "all non-major" group has no manager filter, so the ARG bump lands in the same single grouped PR, and major bumps park on the Dependency Dashboard like the rest. The regex requires the literal `=` so the value-less ARG redeclaration inside the build stage is not matched. Verified: regex extraction against the current Dockerfile (one match, currentValue=11.1.2), renovate-config-validator --strict, Biome on renovate.json. Co-Authored-By: Claude Fable 5 --- AGENTS.md | 2 +- Dockerfile | 3 +++ renovate.json | 11 +++++++++++ 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 40245c3..19b7e80 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -30,7 +30,7 @@ Separate Python companion script in `scripts/ios-app-import/` (stdlib-only, Pyth ## Dependency updates (Renovate, not Dependabot) -Dependency bumps are driven by **Renovate**, not Dependabot — `.github/dependabot.yml` was removed because its pnpm support left `pnpm-lock.yaml` stale (needing a manual regen) and it fanned each ecosystem out into separate, mutually-conflicting PRs. Renovate regenerates the lockfile natively and, per `renovate.json`, bundles every **non-major** update across all four ecosystems (npm, cargo, docker, github-actions) into a **single** PR on a stable branch. **Major** upgrades are held on the Dependency Dashboard issue (`dependencyDashboardApproval`) for one-at-a-time review — tick one there to let Renovate raise its PR. Do NOT reintroduce a `dependabot.yml`; that would duplicate Renovate's PRs. +Dependency bumps are driven by **Renovate**, not Dependabot — `.github/dependabot.yml` was removed because its pnpm support left `pnpm-lock.yaml` stale (needing a manual regen) and it fanned each ecosystem out into separate, mutually-conflicting PRs. Renovate regenerates the lockfile natively and, per `renovate.json`, bundles every **non-major** update across all four ecosystems (npm, cargo, docker, github-actions) into a **single** PR on a stable branch. A `customManagers` regex additionally treats the Dockerfile's `ARG PNPM_VERSION` as the npm `pnpm` package, so the Docker pnpm pin rides in that same PR instead of drifting from `packageManager` (which is what happened in PR #125). **Major** upgrades are held on the Dependency Dashboard issue (`dependencyDashboardApproval`) for one-at-a-time review — tick one there to let Renovate raise its PR. Do NOT reintroduce a `dependabot.yml`; that would duplicate Renovate's PRs. Activation is one of two mutually-exclusive paths (pick one): the self-hosted `.github/workflows/renovate.yml` (weekly cron + a `workflow_dispatch` **dry-run** button that previews the PR without opening it — needs a `RENOVATE_TOKEN` secret for live-run PRs to trigger CI, since GITHUB_TOKEN-authored PRs don't), **or** the hosted Mend Renovate GitHub App (its PRs trigger CI automatically; delete the workflow if you install the app). Both read the same `renovate.json`. See the header comment in the workflow for the token rationale. diff --git a/Dockerfile b/Dockerfile index b9fa82a..415cfaf 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,6 +11,9 @@ ARG NODE_IMAGE=node:24.15.0-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c # Keep this in lockstep with `packageManager` in package.json and the # `pnpm/action-setup` version in every .github/workflows/*. A drift here # means Docker builds resolve deps with a different pnpm than CI does. +# Renovate bumps this line itself (customManagers regex in renovate.json), +# in the same grouped PR as the other pnpm pins — don't edit it by hand +# unless you're changing all of them together. ARG PNPM_VERSION=11.1.2 FROM ${NODE_IMAGE} AS builder diff --git a/renovate.json b/renovate.json index 6f455b9..e9cbf8b 100644 --- a/renovate.json +++ b/renovate.json @@ -41,5 +41,16 @@ "matchPackageNames": ["ghcr.io/privacykey/privacytracker"], "enabled": false } + ], + "customManagers": [ + { + "description": "The Dockerfile bootstraps pnpm from ARG PNPM_VERSION, which must stay in lockstep with `packageManager` in package.json and the pnpm/action-setup pins in the workflows. Treat it as the npm `pnpm` package so the same bump lands in the same grouped non-major PR — without this it drifts (PR #125 moved everything to 11.12.0 while the ARG stayed 11.1.2).", + "customType": "regex", + "managerFilePatterns": ["/^Dockerfile$/"], + "matchStrings": ["ARG PNPM_VERSION=(?.*)"], + "datasourceTemplate": "npm", + "packageNameTemplate": "pnpm", + "versioningTemplate": "npm" + } ] }