renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>netresearch/renovate-config"
  ],
  "lockFileMaintenance": {
    "enabled": true
  },
  "packageRules": [
    {
      "description": "dhi.io serves no anonymous requests and Renovate holds no credentials for it, so every lookup fails with no-result and lands in the dependency dashboard. The hardened images ride a floating tag that docker compose pull refreshes on each deploy, so there is nothing here for Renovate to raise. Both concrete images are named because that is provably matched today, and the host pattern is there so a further dhi.io image does not reintroduce the warning.",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["dhi.io/mariadb", "dhi.io/caddy", "/^dhi\\.io\\//"],
      "enabled": false
    }
  ],
  "hostRules": [
    {
      "description": "composer.json declares a VCS repository at git.netresearch.de for netresearch/nr-ai-search. That project is internal, so an anonymous fetch answers 401, Renovate cannot resolve the pool, and every composer lockfile update fails with 'Artifact file update failure' - leaving a pull request that cannot build. The credential is a project access token on support/nr-ai-search carrying read_api and read_repository at Reporter level: it can read that one project and write nothing.",
      "hostType": "gitlab",
      "matchHost": "git.netresearch.de",
      "token": "{{ secrets.GITLAB_COMPOSER_TOKEN }}"
    }
  ]
}