openhands
43590f1509
CI / check (push) Successful in 31s
CI / tests-imaging-browsers (push) Successful in 1m31s
CI / tests-integration (push) Successful in 1m57s
CI / tests-unit (push) Successful in 2m3s
CI / tests-quality (push) Successful in 56s
CI / tests-ui (push) Successful in 2m48s
CI / preflight (push) Skipped
CI / deploy (push) Successful in 3m34s
Enable osvVulnerabilityAlerts (Gitea has no advisory feed of its own) with the OSV summary on the dependency dashboard, and let security fixes skip the 3-day minimumReleaseAge in their own labelled PR. Set automergeStrategy to squash so automerged dependency updates match the repository history.
65 lines
2.0 KiB
JSON
65 lines
2.0 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":timezone(Europe/Amsterdam)",
|
|
":semanticCommits",
|
|
"workarounds:all"
|
|
],
|
|
"labels": ["dependencies"],
|
|
"dependencyDashboard": true,
|
|
"dependencyDashboardOSVVulnerabilitySummary": "all",
|
|
"osvVulnerabilityAlerts": true,
|
|
"configMigration": true,
|
|
"automergeStrategy": "squash",
|
|
"prConcurrentLimit": 5,
|
|
"prHourlyLimit": 3,
|
|
"minimumReleaseAge": "3 days",
|
|
"lockFileMaintenance": {
|
|
"enabled": true
|
|
},
|
|
"packageRules": [
|
|
{
|
|
"description": "Minor en patch: één groeps-PR, automerge pas na groene CI",
|
|
"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
|
|
"groupName": "all non-major dependencies",
|
|
"automerge": true,
|
|
"platformAutomerge": false
|
|
},
|
|
{
|
|
"description": "Major updates vragen goedkeuring via het dependency-dashboard",
|
|
"matchUpdateTypes": ["major"],
|
|
"labels": ["major"],
|
|
"dependencyDashboardApproval": true
|
|
},
|
|
{
|
|
"description": "Beveiligingsfixes (OSV) niet tegenhouden door de wachttijd en in een eigen PR",
|
|
"matchCategories": ["security"],
|
|
"minimumReleaseAge": null,
|
|
"groupName": "security fixes",
|
|
"addLabels": ["security"]
|
|
},
|
|
{
|
|
"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
|
|
"matchManagers": ["docker-compose"],
|
|
"pinDigests": false
|
|
},
|
|
{
|
|
"description": "Node-upgrades worden handmatig gecoördineerd over .nvmrc, package.json engines, @types/node, de Docker-basisimage en de runner; Renovate mag .nvmrc niet los bumpen (check-node-toolchain faalt anders)",
|
|
"matchManagers": ["nvm"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "De Node-basisimage in de Dockerfile hoort bij dezelfde gecoördineerde Node-upgrade als .nvmrc",
|
|
"matchManagers": ["dockerfile"],
|
|
"matchPackageNames": ["node"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "De pnpm packageManager-pin is afgestemd op Docker en de runner-toolchain; niet automatisch bumpen",
|
|
"matchPackageNames": ["pnpm"],
|
|
"enabled": false
|
|
}
|
|
]
|
|
}
|