renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices",
    ":semanticCommitType(chore)"
  ],
  "enabledManagers": [
    "gomod",
    "github-actions",
    "dockerfile",
    "mise",
    "custom.regex"
  ],
  "postUpdateOptions": [
    "gomodTidy"
  ],
  "commitMessagePrefix": "chore(all): ",
  "commitMessageAction": "update",
  "commitBody": "Signed-off-by: Renovate Bot <bot@renovateapp.com>",
  "labels": [
    "dependencies"
  ],
  "prConcurrentLimit": 50,
  "prHourlyLimit": 0,
  "platformAutomerge": true,
  "automerge": true,
  "automergeType": "pr",
  "automergeStrategy": "squash",
  "ignoreTests": false,
  "vulnerabilityAlerts": {
    "labels": [
      "security"
    ],
    "automerge": true,
    "minimumReleaseAge": "0 days"
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "Update Makefile tool versions via inline renovate comments (supports both := and ?= assignment)",
      "managerFilePatterns": ["/^Makefile$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[^\\s]+) depName=(?<depName>[^\\s]+)( versioning=(?<versioning>[^\\s]+))?\\n[A-Z_]+\\s*[:?]=\\s*(?<currentValue>[^\\s]+)"
      ]
    },
    {
      "customType": "regex",
      "description": "Update workflow-YAML env-var pins via inline renovate comments (e.g. CST_VERSION in ci.yml)",
      "managerFilePatterns": ["/^\\.github/workflows/.+\\.ya?ml$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[^\\s]+) depName=(?<depName>[^\\s]+)( versioning=(?<versioning>[^\\s]+))?( extractVersion=(?<extractVersion>[^\\s]+))?\\n\\s+[A-Z_]+:\\s*'?(?<currentValue>[^'\\s]+)'?"
      ]
    },
    {
      "customType": "regex",
      "description": "Track Go version ARG defaults in Dockerfiles",
      "managerFilePatterns": ["/Dockerfile/"],
      "matchStrings": [
        "ARG GO_VER[= ]+\"?(?<currentValue>\\d+\\.\\d+\\.\\d+)\"?\\n"
      ],
      "depNameTemplate": "golang",
      "datasourceTemplate": "docker"
    },
    {
      "customType": "regex",
      "description": "Track go-face/dlib{19,20} builder images pinned in ci.yml matrix",
      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"],
      "matchStrings": [
        "builder:\\s*'(?<depName>ghcr\\.io/andriykalashnykov/go-face/dlib\\d+):(?<currentValue>[^@']+)@(?<currentDigest>sha256:[a-f0-9]+)'"
      ],
      "datasourceTemplate": "docker",
      "versioningTemplate": "docker"
    },
    {
      "customType": "regex",
      "description": "Track go-face builder image default in Makefile (BUILDER_IMAGE ?= ...)",
      "managerFilePatterns": ["/^Makefile$/"],
      "matchStrings": [
        "BUILDER_IMAGE\\s*\\?=\\s*(?<depName>ghcr\\.io/andriykalashnykov/go-face/dlib\\d+):(?<currentValue>[^\\s@]+)"
      ],
      "datasourceTemplate": "docker",
      "versioningTemplate": "docker"
    },
    {
      "customType": "regex",
      "description": "Track per-lineage builder image pins in Makefile (BUILDER_DLIB19/DLIB20 :=) that back `make image-verify` — must stay in lockstep with the ci.yml docker matrix",
      "managerFilePatterns": ["/^Makefile$/"],
      "matchStrings": [
        "BUILDER_DLIB\\d+\\s*:=\\s*(?<depName>ghcr\\.io/andriykalashnykov/go-face/dlib\\d+):(?<currentValue>[^\\s@]+)@(?<currentDigest>sha256:[a-f0-9]+)"
      ],
      "datasourceTemplate": "docker",
      "versioningTemplate": "docker"
    }
  ],
  "packageRules": [
    {
      "description": "Wait 3 days before automerging major updates",
      "matchUpdateTypes": [
        "major"
      ],
      "minimumReleaseAge": "3 days"
    },
    {
      "description": "Group GitHub Actions into one PR",
      "matchManagers": [
        "github-actions"
      ],
      "groupName": "GitHub Actions"
    },
    {
      "description": "Bump Go version in go.mod to latest patch",
      "matchManagers": [
        "gomod"
      ],
      "matchDepNames": [
        "go"
      ],
      "rangeStrategy": "bump"
    },
    {
      "description": "Group Makefile tool version updates",
      "matchManagers": [
        "custom.regex"
      ],
      "matchFileNames": [
        "Makefile"
      ],
      "groupName": "Makefile tool versions"
    },
    {
      "description": "Group mise tool version bumps (.mise.toml) into one PR — single source of truth for hadolint/golangci-lint/actionlint/shellcheck/gitleaks/trivy/govulncheck/act and Go/Node toolchains",
      "matchManagers": [
        "mise"
      ],
      "groupName": "mise tool versions"
    },
    {
      "description": "Group go-face builder image bumps (dlib19/dlib20) into one PR so both matrix lineages update together",
      "matchDepNames": [
        "ghcr.io/andriykalashnykov/go-face/dlib19",
        "ghcr.io/andriykalashnykov/go-face/dlib20"
      ],
      "groupName": "go-face builder images"
    }
  ]
}