Skip to content

Commit 32d7a67

Browse files
iaviav
committed
ci: track pinned CLI tool versions with Renovate
Adds a Renovate custom-regex manager that keeps the CLI tools pinned in the build scripts (shellcheck, shfmt, oras, bat) up to date — it opens a PR when a newer GitHub release is published. depName is read from the release URL the scripts already carry, so the sources need no extra markup; an explicit variable-name allow-list limits tracking to these tools. Config lives in renovate.json5 with the line contract documented in plain language. Scoped to custom.regex so GitHub Actions and Python stay with Dependabot.
1 parent ac11efc commit 32d7a67

1 file changed

Lines changed: 101 additions & 0 deletions

File tree

‎renovate.json5‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
{
2+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
3+
extends: ["config:recommended"],
4+
5+
// Run ONLY our custom regex manager. We deliberately do NOT enable the
6+
// github-actions / pip managers — those are owned by Dependabot
7+
// (.github/dependabot.yml); no point duplicating it.
8+
enabledManagers: ["custom.regex"],
9+
10+
dependencyDashboard: true,
11+
labels: ["dependencies"],
12+
timezone: "Europe/Zagreb",
13+
schedule: ["* 1 * * 6"], // Saturday, 01:00–01:59 Zagreb time
14+
15+
customManagers: [
16+
{
17+
customType: "regex",
18+
managerFilePatterns: ["/^lib/.*\\.sh$/"],
19+
20+
// ════════════════════════════════════════════════════════════════
21+
// HOW TO MAKE A PINNED TOOL VERSION TRACKED BY RENOVATE
22+
// (read THIS, not the regex — humans are bad at reading regexes)
23+
// ════════════════════════════════════════════════════════════════
24+
//
25+
// Several build scripts pin a CLI tool to a version that is then
26+
// downloaded from GitHub Releases. Renovate keeps that pin fresh
27+
// by opening a PR when a newer release appears. For Renovate to
28+
// see a line, the line must look EXACTLY like this (leading tabs
29+
// / indentation are fine):
30+
//
31+
// SHELLCHECK_VERSION=${SHELLCHECK_VERSION:-0.11.0} # https://github.com/koalaman/shellcheck/releases
32+
// └──────┬─────────┘ └────────┬─────────┘└──┬──┘ └──────────────────────┬────────────────────────┘
33+
// NAME_VERSION ${ … :- VERSION } bare single "#" + https://github.com/OWNER/REPO/releases
34+
// (allow-listed) default-value form brace
35+
//
36+
// From that line Renovate takes:
37+
// • the version ("0.11.0") → currentValue
38+
// • OWNER/REPO from the URL → depName
39+
// datasource is forced to github-releases; a leading "v" on the
40+
// upstream tag (v0.11.0) is stripped automatically.
41+
//
42+
// Note: depName comes from the github.com URL that the upstream
43+
// scripts already write — so NO extra "# renovate:" annotation is
44+
// added to those files. That keeps them byte-identical to upstream
45+
// and conflict-free when iav-main is synced.
46+
//
47+
// ─── STRICT RULES ───────────────────────────────────────────────
48+
// Break ANY of these and the line is SILENTLY dropped: Renovate
49+
// just stops tracking it, the version quietly rots, and the only
50+
// visible sign is that the tool disappears from the Dependency
51+
// Dashboard issue. So:
52+
//
53+
// 1. NAME must be in the allow-list inside `matchStrings` below
54+
// (currently SHELLFMT | SHELLCHECK | ORAS | BATCAT). A brand
55+
// new tool is NOT tracked until you add its NAME there. This
56+
// is intentional — it stops Renovate from grabbing pins that
57+
// must stay fixed (e.g. a RUST_VERSION held back on purpose).
58+
//
59+
// 2. The version after ":-" must be BARE digits and dots — no
60+
// quotes, no leading "v":
61+
// OK ${ORAS_VERSION:-1.3.2}
62+
// BAD ${ORAS_VERSION:-"1.3.2"} ← quotes kill the match
63+
// BAD ${ORAS_VERSION:-v1.3.2} ← leading v kills it
64+
//
65+
// 3. Use the default-value form ${NAME:-VERSION} — with the
66+
// "${", the ":-", and the closing "}". A plain NAME=1.3.2
67+
// (no braces) is NOT matched.
68+
//
69+
// 4. The version and its github.com URL comment MUST be on the
70+
// same physical line. No line-continuation "\", no wrapping.
71+
//
72+
// 5. Between the closing "}" and the comment there may only be
73+
// spaces/tabs. Code BEFORE the assignment is fine (indent, an
74+
// `if`, a leading `&&`), but nothing may come AFTER the "}"
75+
// except the comment:
76+
// OK [[ -n $x ]] && ORAS_VERSION=${ORAS_VERSION:-1.3.2} # https://github.com/oras-project/oras/releases
77+
// BAD ORAS_VERSION=${ORAS_VERSION:-1.3.2} && do_thing # … ← trailing code kills the match
78+
// Keep the "# https://…/releases" comment LAST on the line.
79+
//
80+
// 6. The comment must be a single "#" then the canonical URL
81+
// https://github.com/OWNER/REPO/releases :
82+
// OK # https://github.com/sharkdp/bat/releases
83+
// BAD ## https://… ← double hash kills it
84+
// BAD # http://github.com/… ← must be https
85+
// BAD # see github.com/x/y ← must start https://github.com/ and end /releases
86+
//
87+
// 7. To track a NEW tool: (a) write its line in the shape above,
88+
// and (b) add its NAME to the alternation in `matchStrings`.
89+
// ════════════════════════════════════════════════════════════════
90+
matchStrings: [
91+
// separator is [[:blank:]] (space/tab only, NOT \s) so the version
92+
// and its release-URL comment must sit on ONE physical line —
93+
// \s would also cross newlines and could grab an unrelated URL.
94+
"\\b(?:SHELLFMT|SHELLCHECK|ORAS|BATCAT)_VERSION=\\$\\{[A-Z_]+:-(?<currentValue>[0-9][0-9.]*)\\}[[:blank:]]*#[[:blank:]]*https://github\\.com/(?<depName>[^/]+/[^/\\s]+)/releases",
95+
],
96+
datasourceTemplate: "github-releases",
97+
extractVersionTemplate: "^v?(?<version>.+)$",
98+
versioningTemplate: "semver",
99+
},
100+
],
101+
}

0 commit comments

Comments
 (0)