renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "forkProcessing": "enabled",
  "baseBranchPatterns": ["main", "gh-pages"],
  "extends": [
    ":dependencyDashboard",
    ":ignoreUnstable",
    ":prImmediately",
    ":semanticPrefixFixDepsChoreOthers",
    ":updateNotScheduled",
    ":automergeDisabled",
    "helpers:disableTypesNodeMajor",
    ":prHourlyLimitNone",
    ":prConcurrentLimitNone",
    "docker:enableMajor",
    "group:allDigest"
  ],
  "customManagers": [
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/(^|/)Makefile$/",
        "/(^|/)Dockerfile$/",
        "/(^|/)\\.github/workflows/regenerate-crd-docs\\.yaml$/",
        "/(^|/)scripts/install_kustomize\\.sh$/"
      ],
      "matchStrings": [
        "(?<depName>[A-Z][A-Z0-9_]*)_VERSION\\s*=\\s*(?<currentValue>[^\\s]+)\\s*#\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s*depName=(?<packageName>[^\\s]+)(?:\\s*extractVersion=(?<extractVersion>[^\\s]+))?"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}",
      "extractVersionTemplate": "{{#if extractVersion}}{{{extractVersion}}}{{/if}}"
    },
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/tests/e2e/versions\\.go$/"
      ],
      "matchStrings": [
        "\\s*(?<depName>\\w+)\\s*=\\s*\"(?<currentValue>[^\"]+)\"\\s*//\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s*depName=(?<packageName>[^\\s]+)\\s*registryUrl=(?<registryUrl>\\S+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}",
      "registryUrlTemplate": "{{registryUrl}}"
    },
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/tests/e2e/versions\\.go$/"
      ],
      "description": "Same file as above, but for datasource=docker entries, which have no notion of a Helm repo registryUrl and so never carry one. Kept as a separate manager (RE2 has no lookaround, so the split is done by requiring the literal 'docker' datasource rather than a negative match on registryUrl) so registryUrlTemplate is never evaluated for these - a templated empty string is still a defined (invalid) registryUrl to Renovate, not the same as omitting it.",
      "matchStrings": [
        "\\s*(?<depName>\\w+)\\s*=\\s*\"(?<currentValue>[^\"]+)\"\\s*//\\s*renovate:\\s*datasource=(?<datasource>docker)\\s*depName=(?<packageName>[^\\s]+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}"
    },
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/api/v1beta1/kafkacluster_types\\.go$/"
      ],
      "matchStrings": [
        "(?<depName>\\w+)\\s*=\\s*\"[^:]+:(?<currentValue>[^\"]+)\"\\s*//\\s*renovate:\\s*datasource=(?<datasource>\\w+)\\s*depName=(?<packageName>[^\\s]+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}"
    },
    {
      "customType": "regex",
      "managerFilePatterns": [
        "/(^|/)\\.github/actions/kind-create/action\\.yaml$/",
        "/(^|/)\\.github/workflows/e2e-test\\.yaml$/"
      ],
      "matchStrings": [
        "(?:default|version):\\s*'?(?<currentValue>[^\\s'#]+)'?\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<packageName>\\S+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}"
    },
    {
      "customType": "regex",
      "description": "go install <module>@<version> pins inside composite action shell steps (e.g. .github/actions/kind-create/action.yaml). Not covered by any built-in manager.",
      "managerFilePatterns": [
        "/(^|/)\\.github/actions/kind-create/action\\.yaml$/"
      ],
      "matchStrings": [
        "go install \\S+@(?<currentValue>\\S+)\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<packageName>\\S+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}"
    },
    {
      "customType": "regex",
      "description": "Docker images embedded as flat 'repo:tag' strings in KafkaCluster sample manifests, benchmark infra YAML, and kustomize strategic-merge patches. The built-in helm-values manager only matches files literally named values.yaml/values.yml with a nested {repository,tag} shape, kustomize only reads the kustomization.yaml 'images:' transformer (unused in this repo), and the kubernetes manager has no default managerFilePatterns and is not configured here - so none of these were previously watched.",
      "managerFilePatterns": [
        "/(^|/)config/samples/.*\\.yaml$/",
        "/(^|/)docs/benchmarks/infrastructure/.*\\.yaml$/",
        "/(^|/)tests/e2e/templates/.*\\.tmpl$/",
        "/(^|/)config/base/manager/manager\\.yaml$/",
        "/(^|/)config/overlays/.*/manager_auth_proxy_patch\\.yaml$/",
        "/(^|/)hack/kafka-test-pod/manifest_certmanager\\.yaml$/"
      ],
      "matchStrings": [
        "[\"']?[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)*(?:/[a-zA-Z0-9._-]+)+:(?<currentValue>[a-zA-Z0-9._-]+)[\"']?\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<packageName>\\S+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}"
    },
    {
      "customType": "regex",
      "description": "Docker images embedded as nested helm-style {repository, tag} blocks in tests/e2e/templates/*.tmpl fixtures. The .tmpl extension is never matched by the built-in helm-values manager (values.yaml/.yml only), even though the shape matches.",
      "managerFilePatterns": [
        "/(^|/)tests/e2e/templates/.*\\.tmpl$/"
      ],
      "matchStrings": [
        "tag:\\s*(?<currentValue>\\S+)\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<packageName>\\S+)"
      ],
      "datasourceTemplate": "{{datasource}}",
      "depNameTemplate": "{{packageName}}"
    }
  ],
  "packageRules": [
    {
      "matchManagers": [
        "gomod"
      ],
      "matchBaseBranches": ["main"],
      "enabled": false,
      "description": "Disable Go module updates on main - handled by automated workflow: .github/workflows/update-go-deps.yml. gh-pages' go.mod is Hugo Modules (theme deps like docsy), not app code, so it stays enabled there."
    },
    {
      "matchManagers": [
        "gomod"
      ],
      "matchDepNames": ["go"],
      "matchBaseBranches": ["main"],
      "enabled": true,
      "rangeStrategy": "bump",
      "postUpdateOptions": ["gomodTidy"],
      "description": "Re-enable just the 'go' directive (depName 'go', covers a future 'toolchain' directive too) so go.mod's Go version tracks upstream instead of drifting from the Dockerfile's golang image, which bumps independently (see PR #302). rangeStrategy=bump: default 'replace' treats 'go X.Y.Z' as a caret range, so newer releases always 'satisfy' it and no update is ever proposed. postUpdateOptions=gomodTidy: without it Renovate only runs 'go get', not 'go mod tidy', and CI's tidy-check job would reject the PR."
    },
    {
      "matchCategories": [
        "docker"
      ],
      "pinDigests": true
    },
    {
      "groupName": "config samples docker images",
      "groupSlug": "config-samples-docker",
      "description": "Was scoped to matchManagers: [helm-values], but that manager only reads files literally named values.yaml/values.yml with a nested {repository,tag} shape - it never matched anything under these paths, so this rule was a no-op. The images here are now tracked via explicit '# renovate:' comment annotations (custom.regex manager); see the customManagers entries covering config/samples, docs/benchmarks/infrastructure, tests/e2e/templates, config/base/manager, config/overlays, and hack/kafka-test-pod.",
      "matchFileNames": [
        "config/samples/**",
        "docs/benchmarks/infrastructure/**",
        "tests/e2e/templates/**",
        "config/base/manager/**",
        "config/overlays/**",
        "hack/kafka-test-pod/**"
      ],
      "matchManagers": [
        "custom.regex"
      ],
      "matchUpdateTypes": [
        "major",
        "minor",
        "patch"
      ]
    },
    {
      "matchPackageNames": [
        "apache/kafka"
      ],
      "allowedVersions": "<4.0.0",
      "description": "Kafka 4.x drops ZooKeeper support (KRaft-only) and needs an operator-side migration. Keep Renovate on the 3.x line until docker/kafka/Dockerfile is ready for that jump, then remove this rule."
    },
    {
      "matchCurrentValue": "/^\\d+\\.\\d+\\.\\d+-ado?be-\\d+$/",
      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(?:-ado?be-(?<build>\\d+))?$",
      "description": "Self-scoping: applies to ANY docker dep whose current pin is <semver>-adbe|adobe-<yyyymmdd> (cruise-control uses 'adbe', zookeeper-operator 'adobe'; new adobe-fork images inherit this with no config change). Default docker versioning treats that suffix as an immutable compatibility string, so newer daily builds are never offered; capturing the date as a purely-numeric 'build' (handled like patch) makes e.g. 3.0.3-adbe-20250804 -> 3.0.3-adbe-20260722 and 0.2.15-adobe-20250923 track their newest build. matchCurrentValue requires the suffix, so only these deps are touched; the versioning's suffix is optional so the same image can still publish a plain-semver tag. Trailing '$' excludes '-rc'."
    },
    {
      "matchDatasources": [
        "docker"
      ],
      "matchPackageNames": [
        "ghcr.io/adobe/zookeeper-operator/zookeeper"
      ],
      "allowedVersions": "/^\\d+\\.\\d+\\.\\d+-\\d+\\.\\d+\\.\\d+-adobe-\\d{8}$/",
      "versioning": "loose"
    },
    {
      "matchPackageNames": [
        "ghcr.io/adobe/koperator/kafka"
      ],
      "matchCurrentValue": "/^\\d+\\.\\d+-\\d+\\.\\d+\\.\\d+(-jdk\\d+\\.\\d+\\.\\d+)?$/",
      "versioning": "regex:^(?<compatibility>\\d+\\.\\d+)-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(?:-jdk(?<build>\\d+)\\.\\d+\\.(?<revision>\\d+))?$",
      "description": "Tag format is <scala_version>-<kafka_version>[-jdk<jdk_version>], e.g. 2.13-3.9.1 or 2.13-3.9.2-jdk21.0.11 (the latter shape shipped starting with the 3.9.2 release tag). Verified live against ghcr.io: default docker versioning parses currentVersion as just '2.13' and silently drops everything after the first hyphen, so Renovate can never see a real 3.9.1->3.9.2 bump (only digest-pin updates fire, via the docker pinDigests rule below) - this affects every '# renovate:' annotated occurrence of this image. Pinning the scala prefix as 'compatibility' (never auto-changed) and parsing the kafka release as major.minor.patch fixes real version comparison. The optional '-jdk<major>.<interim>.<update>' suffix maps jdk major to 'build' and jdk update to 'revision' (Renovate's regex versioning caps out at 5 numeric levels: major/minor/patch/build/revision, each required to be purely numeric, so the always-0 jdk interim segment is matched but not captured); tags without the suffix default build/revision to 0 and still compare correctly against suffixed ones since a differing kafka patch alone already resolves ordering. This does NOT gate jdk-major jumps (e.g. jdk21.x -> jdk25.x) the way 'compatibility' gates scala - that's covered by the same operator-side migration as the apache/kafka 4.x bump below (see docker/kafka/Dockerfile's java_version comment); revisit if jdk25 lands before that migration."
    },
    {
      "groupName": "kafka docker images (major)",
      "groupSlug": "kafka-docker-major",
      "matchFileNames": [
        "docker/**"
      ],
      "matchManagers": [
        "dockerfile",
        "custom.regex"
      ],
      "matchUpdateTypes": [
        "major"
      ]
    },
    {
      "groupName": "kafka docker images (minor/patch)",
      "groupSlug": "kafka-docker-minor-patch",
      "matchFileNames": [
        "docker/**"
      ],
      "matchManagers": [
        "dockerfile",
        "custom.regex"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch"
      ]
    },
    {
      "groupName": "all major dependencies",
      "groupSlug": "all-major",
      "matchUpdateTypes": [
        "major"
      ],
      "matchManagers": [
        "github-actions",
        "maven",
        "dockerfile",
        "docker-compose",
        "custom.regex",
        "helm-values",
        "gomod"
      ],
      "commitMessagePrefix": "chore(deps):",
      "commitMessageAction": "update",
      "commitMessageTopic": "all major dependencies",
      "commitMessageExtra": ""
    },
    {
      "groupName": "all non-major dependencies",
      "groupSlug": "all-minor-patch",
      "matchUpdateTypes": [
        "minor",
        "patch",
        "digest"
      ],
      "matchManagers": [
        "github-actions",
        "maven",
        "dockerfile",
        "docker-compose",
        "custom.regex",
        "helm-values",
        "docker",
        "gomod"
      ],
      "commitMessagePrefix": "chore(deps):",
      "commitMessageAction": "update",
      "commitMessageTopic": "all non-major dependencies",
      "commitMessageExtra": ""
    },
    {
       "matchBaseBranches": ["gh-pages"],
       "groupName": "gh-pages dependencies",
       "groupSlug": "gh-pages-deps",
       "commitMessagePrefix": "chore(deps):",
       "commitMessageAction": "update",
       "commitMessageTopic": "gh-pages dependencies",
       "commitMessageExtra": ""
     }
  ]
}