feat: Add Renovate bot integration to automatically update dependency…

.github/dependabot.yml

@@ -20,7 +20,6 @@ updates:
       - '/nginx'
       - '/node'
       - '/opensearch'
-      - '/prettier'
       - '/prometheus-apache-exporter'
       - '/prometheus-elasticsearch-exporter'
       - '/prometheus-nginx-exporter'

.github/renovate.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ],
+  "enabledManagers": ["regex"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Update _VERSION variables in Dockerfiles",
+      "managerFilePatterns": [
+        "/(^|/|\\.)Dockerfile$/",
+        "/(^|/)Dockerfile\\.[^/]*$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>[a-z-]+?)(?: depName=(?<depName>.+?))? packageName=(?<packageName>.+?)(?: versioning=(?<versioning>[a-z-]+?))?\\s(?:ENV|ARG) .+?_VERSION=(?<currentValue>.+?)\\s"
+      ]
+    }
+  ]
+}

.github/workflows/php.yml

@@ -35,13 +35,11 @@ jobs:
           build-args: |
             PHP_VERSION=7.2
             UBUNTU_VERSION=24.04
-            XDEBUG_VERSION=3.1.6
         - version: 7.3
           file: 7.x.Dockerfile
           build-args: |
             PHP_VERSION=7.3
             UBUNTU_VERSION=24.04
-            XDEBUG_VERSION=3.1.6
         - version: 7.4
           file: Dockerfile
           build-args: |
@@ -53,31 +51,26 @@ jobs:
           build-args: |
             PHP_VERSION=8.0
             UBUNTU_VERSION=24.04
-            XDEBUG_VERSION=3.4.1
         - version: 8.1
           file: Dockerfile
           build-args: |
             PHP_VERSION=8.1
             UBUNTU_VERSION=22.04
-            XDEBUG_VERSION=3.4.1
         - version: 8.2
           file: 8.x.Dockerfile
           build-args: |
             PHP_VERSION=8.2
             UBUNTU_VERSION=24.04
-            XDEBUG_VERSION=3.4.1
         - version: 8.3
           file: Dockerfile
           build-args: |
             PHP_VERSION=8.3
             UBUNTU_VERSION=24.04
-            XDEBUG_VERSION=3.4.1
         - version: 8.4
           file: 8.x.Dockerfile
           build-args: |
             PHP_VERSION=8.4
             UBUNTU_VERSION=24.04
-            XDEBUG_VERSION=3.4.1
 
     steps:
       - name: Checkout

.github/workflows/renovate.yml

@@ -0,0 +1,30 @@
+name: Renovate
+on:
+  schedule:
+    - cron: "0 6 * * *" # Runs daily at 6 AM UTC
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v44.0.2
+        with:
+          token: "${{secrets.GITHUB_TOKEN}}"
+        env:
+          LOG_LEVEL: 'debug'

cfssl/Dockerfile

@@ -6,7 +6,10 @@ ARG TARGETARCH
 
 WORKDIR /src
 
-RUN git clone -b 'v1.6.4' --single-branch --depth 1 https://github.com/cloudflare/cfssl.git .
+# renovate: datasource=github-tags depName=cfssl packageName=cloudflare/cfssl
+ARG CFSSL_VERSION=1.6.4
+
+RUN git clone -b ${CFSSL_VERSION} --single-branch --depth 1 https://github.com/cloudflare/cfssl.git .
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags "-s -w -X github.com/cloudflare/cfssl/cli/version.version=1.6.5" -o /out/cfssl ./cmd/cfssl
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags "-s -w -X github.com/cloudflare/cfssl/cli/version.version=1.6.5" -o /out/cfssl-bundle ./cmd/cfssl-bundle

nginx/Dockerfile

@@ -74,8 +74,10 @@ RUN apt-get update \
 # SEE: https://github.com/coreruleset/modsecurity-crs-docker/blob/main/nginx/Dockerfile
 FROM nginx:1.29.3 AS modsecurity-builder
 
-ARG MODSECURITY_VERSION="3.0.14"
-ARG MODSECURITY_NGINX_VERSION="1.0.4"
+# renovate: datasource=github-releases depName=ModSecurity packageName=owasp-modsecurity/ModSecurity
+ARG MODSECURITY_VERSION="v3.0.14"
+# renovate: datasource=github-releases depName=ModSecurity-nginx packageName=owasp-modsecurity/ModSecurity-nginx
+ARG MODSECURITY_NGINX_VERSION="v1.0.4"
 
 USER root
 
@@ -110,7 +112,7 @@ RUN set -eux; \
 WORKDIR /sources
 
 RUN set -eux; \
-    git clone https://github.com/owasp-modsecurity/ModSecurity.git --branch "v${MODSECURITY_VERSION}" --depth 1 --recursive; \
+    git clone https://github.com/owasp-modsecurity/ModSecurity.git --branch "${MODSECURITY_VERSION}" --depth 1 --recursive; \
     cd ModSecurity; \
     ARCH=$(gcc -print-multiarch); \
     sed -ie "s/i386-linux-gnu/${ARCH}/g" build/ssdeep.m4; \
@@ -122,7 +124,7 @@ RUN set -eux; \
 
 RUN set -eux; \
     NGINX_VERSION=$(nginx -v 2>&1 | sed -E 's#.*nginx/([0-9.]+).*#\1#'); \
-    git clone https://github.com/owasp-modsecurity/ModSecurity-nginx.git --branch "v${MODSECURITY_NGINX_VERSION}" --depth 1; \
+    git clone https://github.com/owasp-modsecurity/ModSecurity-nginx.git --branch "${MODSECURITY_NGINX_VERSION}" --depth 1; \
     curl -sSL "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" -o nginx-${NGINX_VERSION}.tar.gz; \
     tar -xzf nginx-${NGINX_VERSION}.tar.gz; \
     cd ./nginx-${NGINX_VERSION}; \

opensearch/Dockerfile

@@ -6,6 +6,7 @@ ENV ES_JAVA_OPTS="-Xms1g -Xmx1g"
 ENV logger.level=WARN
 ENV plugins.security.ssl.http.enabled=false
 
+# renovate: datasource=github-releases depName=jq packageName=jqlang/jq
 ARG JQ_VERSION=1.7
-ADD --chmod=755 https://github.com/stedolan/jq/releases/download/jq-$JQ_VERSION/jq-linux64 /usr/bin/jq
+ADD --chmod=755 https://github.com/jqlang/jq/releases/download/jq-$JQ_VERSION/jq-linux64 /usr/bin/jq
 HEALTHCHECK --interval=1s --timeout=5s --retries=60 CMD if [ "$(curl --silent --fail -u admin:${OPENSEARCH_INITIAL_ADMIN_PASSWORD} localhost:9200/_cluster/health | jq .number_of_nodes)" -gt 0 ]; then exit 0; else exit 1; fi

php/8.x.Dockerfile

@@ -3,6 +3,7 @@
 ARG UBUNTU_VERSION=24.04
 FROM ubuntu:${UBUNTU_VERSION} AS base
 ARG PHP_VERSION=8.4
+# renovate: datasource=github-releases depName=xdebug packageName=xdebug/xdebug
 ARG XDEBUG_VERSION=3.4.1
 
 ENV DEBIAN_FRONTEND=noninteractive \

php/Dockerfile

@@ -3,6 +3,7 @@
 ARG UBUNTU_VERSION=24.04
 FROM ubuntu:${UBUNTU_VERSION} AS base
 ARG PHP_VERSION=8.3
+# renovate: datasource=github-releases depName=xdebug packageName=xdebug/xdebug
 ARG XDEBUG_VERSION=3.4.1
 
 ENV DEBIAN_FRONTEND=noninteractive \

prettier/.nvmrc

@@ -1 +1 @@
-lts/jod
+lts/krypton

prettier/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:25-alpine AS prettier
+FROM node:24-alpine AS prettier
 
 RUN apk add --no-cache bash