ci: teach Renovate to bump the Dockerfile ARG PNPM_VERSION

AGENTS.md

@@ -30,7 +30,7 @@ Separate Python companion script in `scripts/ios-app-import/` (stdlib-only, Pyth
 
 ## Dependency updates (Renovate, not Dependabot)
 
-Dependency bumps are driven by **Renovate**, not Dependabot — `.github/dependabot.yml` was removed because its pnpm support left `pnpm-lock.yaml` stale (needing a manual regen) and it fanned each ecosystem out into separate, mutually-conflicting PRs. Renovate regenerates the lockfile natively and, per `renovate.json`, bundles every **non-major** update across all four ecosystems (npm, cargo, docker, github-actions) into a **single** PR on a stable branch. **Major** upgrades are held on the Dependency Dashboard issue (`dependencyDashboardApproval`) for one-at-a-time review — tick one there to let Renovate raise its PR. Do NOT reintroduce a `dependabot.yml`; that would duplicate Renovate's PRs.
+Dependency bumps are driven by **Renovate**, not Dependabot — `.github/dependabot.yml` was removed because its pnpm support left `pnpm-lock.yaml` stale (needing a manual regen) and it fanned each ecosystem out into separate, mutually-conflicting PRs. Renovate regenerates the lockfile natively and, per `renovate.json`, bundles every **non-major** update across all four ecosystems (npm, cargo, docker, github-actions) into a **single** PR on a stable branch. A `customManagers` regex additionally treats the Dockerfile's `ARG PNPM_VERSION` as the npm `pnpm` package, so the Docker pnpm pin rides in that same PR instead of drifting from `packageManager` (which is what happened in PR #125). **Major** upgrades are held on the Dependency Dashboard issue (`dependencyDashboardApproval`) for one-at-a-time review — tick one there to let Renovate raise its PR. Do NOT reintroduce a `dependabot.yml`; that would duplicate Renovate's PRs.
 
 Activation is one of two mutually-exclusive paths (pick one): the self-hosted `.github/workflows/renovate.yml` (weekly cron + a `workflow_dispatch` **dry-run** button that previews the PR without opening it — needs a `RENOVATE_TOKEN` secret for live-run PRs to trigger CI, since GITHUB_TOKEN-authored PRs don't), **or** the hosted Mend Renovate GitHub App (its PRs trigger CI automatically; delete the workflow if you install the app). Both read the same `renovate.json`. See the header comment in the workflow for the token rationale.
 

Dockerfile

@@ -11,6 +11,9 @@ ARG NODE_IMAGE=node:24.15.0-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c
 # Keep this in lockstep with `packageManager` in package.json and the
 # `pnpm/action-setup` version in every .github/workflows/*. A drift here
 # means Docker builds resolve deps with a different pnpm than CI does.
+# Renovate bumps this line itself (customManagers regex in renovate.json),
+# in the same grouped PR as the other pnpm pins — don't edit it by hand
+# unless you're changing all of them together.
 ARG PNPM_VERSION=11.1.2
 
 FROM ${NODE_IMAGE} AS builder

renovate.json

@@ -41,5 +41,16 @@
       "matchPackageNames": ["ghcr.io/privacykey/privacytracker"],
       "enabled": false
     }
+  ],
+  "customManagers": [
+    {
+      "description": "The Dockerfile bootstraps pnpm from ARG PNPM_VERSION, which must stay in lockstep with `packageManager` in package.json and the pnpm/action-setup pins in the workflows. Treat it as the npm `pnpm` package so the same bump lands in the same grouped non-major PR — without this it drifts (PR #125 moved everything to 11.12.0 while the ARG stayed 11.1.2).",
+      "customType": "regex",
+      "managerFilePatterns": ["/^Dockerfile$/"],
+      "matchStrings": ["ARG PNPM_VERSION=(?<currentValue>.*)"],
+      "datasourceTemplate": "npm",
+      "packageNameTemplate": "pnpm",
+      "versioningTemplate": "npm"
+    }
   ]
 }