ci: Add Renovate configuration - #72
Conversation
📝 WalkthroughWalkthroughThe change adds a Estimated code review effort: 1 (Trivial) | ~5 minutes Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| "description": "Eagerly bump flagsmith-go-client on every version release", | ||
| "matchPackageNames": ["flagsmith-go-client"], | ||
| "enabled": true, | ||
| "rangeStrategy": "bump", | ||
| "matchUpdateTypes": ["minor", "major"] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files =="
git ls-files | sed -n '1,120p'
echo "== renovate.json =="
if [ -f renovate.json ]; then
cat -n renovate.json
else
fd -a 'renovate\.json' . || true
fi
echo "== go module/import references =="
fd -a 'go.mod|go.sum' . || true
for f in $(git ls-files 'go.mod' 'go.sum' '*.go'); do
case "$f" in
*.go)
rg -n "github.com/Flagsmith/flagsmith-go-client" "$f" || true
;;
*)
rg -n "github.com/Flagsmith/flagsmith-go-client|module " "$f" || true
;;
esac
done
echo "== renovate settings =="
rg -n "postUpdateOptions|gomodUpdateImportPaths|enabled|matchUpdateTypes|rangeStrategy|flagsmith-go-client" renovate.json || trueRepository: Flagsmith/flagsmith-cli
Length of output: 3302
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go command availability =="
command -v go || true
go version 2>/dev/null || true
echo "== module contents =="
cat -n go.mod
echo "== direct import occurrence =="
cat -n main.go | sed -n '1,80p'
echo "== package path in source =="
rg -n "github.com/Flagsmith/flagsmith-go-client/v5|flagsmith-go-client" .
echo "== Read lockfile for current version =="
python3 - <<'PY'
from pathlib import Path
mods = Path("go.sum").read_text().splitlines()
for line in mods:
if "github.com/Flagsmith/flagsmith-go-client/v5" in line or "github.com/Flagsmith/flagsmith-go-client " in line:
print(line)
PYRepository: Flagsmith/flagsmith-cli
Length of output: 4140
🌐 Web query:
Renovate Go modules postUpdateOptions gomodUpdateImportPaths major module path change documentation
💡 Result:
To handle major module path changes (e.g., when a Go module bumps its major version and requires a change to the import path, such as v80 to v81), you should use the gomodUpdateImportPaths option in your Renovate configuration [1][2]. By default, Renovate only updates go.mod files for major upgrades, leaving it to the user to manually update import paths in source code [2]. Adding gomodUpdateImportPaths to your postUpdateOptions instructs Renovate to use the marwan-at-work/mod tool to automatically update import paths within your Go source files during the update process [1][2][3]. Key considerations and best practices: 1. Enabling gomodUpdateImportPaths implicitly triggers gomodTidy [2]. Running go mod tidy is essential to ensure that the go.mod and go.sum files are cleaned up correctly after the import path updates are applied [2][3]. 2. Major Go upgrades often require changes beyond just import paths (such as application logic modifications), so these PRs may still require manual intervention before they are ready to be merged [2]. 3. For major updates, it is highly recommended to set dependencyDashboardApproval=true [2]. This allows you to trigger and review these potentially breaking updates on demand rather than having them automatically opened as PRs [2]. 4. Be aware that users have reported issues where Renovate may occasionally struggle to correctly replace existing major version entries in go.mod, sometimes resulting in duplicate version entries or update cycles [4]. If you encounter such issues, manual verification or adjustment of the go.mod file may be necessary [4][5]. Example configuration snippet: { "postUpdateOptions": [ "gomodUpdateImportPaths", "gomodTidy" ], "dependencyDashboardApproval": true }
Citations:
- 1: https://docs.renovatebot.com/golang/
- 2: https://docs.renovatebot.com/modules/manager/gomod/
- 3: feat(gomod): Update source import paths on major upgrade renovatebot/renovate#9144
- 4: Go major version updates add duplicate module entries instead of replacing, causing update cycles renovatebot/renovate#40797
- 5: Go module major version update PR doesn't actually update version renovatebot/renovate#11901
Handle Go major-module import path changes.
renovate.json allows auto-generated major updates for flagsmith-go-client, while github.com/Flagsmith/flagsmith-cli/v2 imports github.com/Flagsmith/flagsmith-go-client/v5. A future major bump requires the module path and internal/cmd/evaluate.go imports to move to the next major path; by default Renovate only updates go.mod. This can create a build-breaking PR. Add postUpdateOptions: ["gomodUpdateImportPaths"], or keep major updates manually approved.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files relevant =="
git ls-files | grep -E '(^|/)(renovate\.json|go\.mod|go\.sum)$' || true
echo
echo "== renovate.json =="
if [ -f renovate.json ]; then
cat -n renovate.json
fi
echo
echo "== go.mod module and require lines =="
if [ -f go.mod ]; then
rg -n '^(module|require) |Flagsmith/flagsmith-go-client|github\.com/Flagsmith/flagsmith-go-client' go.mod go.sum || true
fi
echo
echo "== any other flagsmith references =="
rg -n 'flagsmith-go-client|Flagsmith/flagsmith' . --glob '!vendor/**' || trueRepository: Flagsmith/flagsmith-cli
Length of output: 12822
🌐 Web query:
Renovate Bot Go module matchPackageNames full module path github.com Flagsmith flagsmith-go-client v5 import slash module
💡 Result:
In Renovate, matchPackageNames primarily matches against the depName (dependency name) property, though it historically includes a fallback to check packageName [1][2]. Because this fallback behavior is deprecated, it is recommended to use matchDepNames instead of matchPackageNames to target specific dependencies [2]. Regarding Go modules like github.com/Flagsmith/flagsmith-go-client, Renovate treats the full module path (e.g., github.com/Flagsmith/flagsmith-go-client) as the primary identifier [3]. When matching these in Renovate configuration: 1. Recommended Approach: Use matchDepNames for explicit matching against the dependency name [2][4]. 2. Experimental Matching: If you require matching against the specific packageName property (which often contains the full module path for Go), you can enable the experimental environment variable RENOVATE_X_MATCH_PACKAGE_NAMES_MORE on self-hosted instances [1][5][6]. When this is enabled, Renovate will attempt to match your configured values against the packageName in addition to the depName [5]. For Go modules specifically, major version changes (e.g., v5) involve appending or updating a version suffix (like /v5) to the import path [3]. Renovate handles these versioned import paths automatically as part of its gomod manager logic [4][3]. When writing package rules for these, ensure your patterns account for the module path structure, typically github.com/org/repo [3]. If you encounter matching issues, checking your Renovate logs for warnings about matchPackageNames will help identify if the tool is falling back to depName or successfully matching against the full module path [2].
Citations:
- 1: matchPackageNames -- what does it match? packageName? depName? renovatebot/renovate#20213
- 2: WARN: Use matchDepNames instead of matchPackageNames renovatebot/renovate#28753
- 3: [gomod] major updates break for packages with few `/` in package name renovatebot/renovate#35507
- 4: https://docs.renovatebot.com/modules/manager/gomod/
- 5: renovatebot/renovate@2de4260
- 6: "matchPackageNames" vs "matchDepName" - both seem to use "depName" anyway renovatebot/renovate#20416
🌐 Web query:
Renovate Bot gomod manager depName package github.com org repo module path
💡 Result:
In Renovate Bot, the gomod manager handles Go modules by automatically identifying and updating dependencies defined in go.mod files [1]. Key concepts regarding how it handles dependency identifiers include: 1. depName and Module Paths: The depName typically represents the full module path (e.g., github.com/org/repo) as declared in the go.mod file [2]. In internal logic, Renovate distinguishes between the full package name and the base name (often referred to as the name without a version) to manage major version updates correctly, particularly when handling version suffixes like /v2 [3][4]. 2. Configuration and Matching: You can use depName in your configuration to target specific modules for updates or to apply custom rules. For example, the matchDepNames configuration option allows you to match against these module paths [1]. 3. Custom Managers: If you need to process files that are not automatically detected or require custom extraction logic, you can use custom managers. When configuring a custom manager, you must extract or define the depName (or packageName) using either named capture groups in a regex matchStrings or via a template (e.g., depNameTemplate) [5][6]. Renovate recommends using either a regex capture group or a template, but not both simultaneously, to avoid configuration conflicts [5][6]. 4. Recent Changes: Renovate has undergone internal refactoring regarding how it handles package names, especially as it introduced logic to differentiate between the source and target package names during updates [7]. For official documentation on configuring the gomod manager, see the Renovate documentation for the gomod manager [1] and the general configuration options [6].
Citations:
- 1: https://docs.renovatebot.com/modules/manager/gomod/
- 2: fix(gomod): support local module paths in
replacedirectives renovatebot/renovate#41520 - 3: fix(gomod): getting dep name with no version renovatebot/renovate#19273
- 4: [gomod] major updates break for packages with few `/` in package name renovatebot/renovate#35507
- 5: https://github.com/renovatebot/renovate/blob/main/docs/usage/configuration-options.md
- 6: https://docs.renovatebot.com/configuration-options/
- 7: refactor(gomod): rename
depNamerenovatebot/renovate#30030
🌐 Web query:
Renovate Bot docs gomod matchPackageNames matchDepNames dependency names
💡 Result:
In Renovate Bot, dependency matching uses specific criteria to target packages within your configuration, such as inside packageRules [1]. Key Differences in Matching Criteria: - matchPackageNames: Historically, this property has been used to match against the dependency name (depName), but it is intended to match against the formal packageName [2][3]. Renovate currently attempts to match the packageName first and falls back to the depName [2]. Using this property may trigger a warning because this behavior is subject to future changes [2]. - matchDepNames: This is the recommended property for matching based on the dependency's name (depName) [2]. It targets the identifier used to reference the dependency within the specific manager [3]. Context in Go Modules (gomod): When working with the gomod manager, these matchers are commonly used within packageRules to customize update behavior for specific dependencies [4]. Examples: - To target the Go toolchain version defined in go.mod, you can combine matchManagers with matchDepNames [4]: { "packageRules": [ { "matchManagers": ["gomod"], "matchDepNames": ["go"], "matchDepTypes": ["golang"], "rangeStrategy": "bump" } ] } - General usage of matchPackageNames in rules (for example, to set versioning or other properties) typically targets the package identifier [5]: { "packageRules": [ { "matchPackageNames": ["example/package"], "versioning": "semver" } ] } Best Practices: - Use matchDepNames when you need to match against the dependency's display name or reference name [2]. - Prefer matchPackageNames only when you are targeting the formal package name, and be aware of potential warnings during the transition period as Renovate shifts toward stricter distinction between packageName and depName [2][3]. - Always test your rules to ensure they are targeting the intended dependencies, especially when using regex patterns in matchers [6][1].
Citations:
- 1: https://docs.mend.io/wsk/renovate-package-rules-guide
- 2: WARN: Use matchDepNames instead of matchPackageNames renovatebot/renovate#28753
- 3: "matchPackageNames" vs "matchDepName" - both seem to use "depName" anyway renovatebot/renovate#20416
- 4: https://docs.renovatebot.com/modules/manager/gomod/
- 5: https://docs.renovatebot.com/modules/versioning/
- 6: https://docs.renovatebot.com/modules/manager/regex/
🌐 Web query:
Renovate Bot gomod parser fullModulePath depName packageName
💡 Result:
In the context of the Renovate Bot gomod (Go Modules) parser, depName and packageName are standard internal configuration properties used to manage dependencies [1][2]. While these terms are general to Renovate's architecture, their application within the gomod manager follows these principles: depName: This serves as the "display name" or the user-facing identifier for the dependency [1][2]. Renovate uses this value in logs, commit messages, Pull Request titles, and the Dependency Dashboard [1][2]. For the gomod manager, the depName is typically the module path (e.g., github.com/user/repo) [3]. packageName: This is the full, exact name used by Renovate to perform the actual lookup against package registries (e.g., the Go proxy) [1][2]. In the case of Go modules, the packageName is generally identical to the module path, making it effectively the same as the depName [1][2]. Regarding "fullModulePath," this is not a distinct, formal configuration option for the gomod parser's primary identification logic. Instead, the gomod manager extracts dependencies directly from go.mod file directives such as require, replace, and tool [4]. The parser identifies the module path (which acts as the unique identifier/name) during this extraction process [3]. If you are working with custom regex managers, these fields (depName and packageName) are used to map captured regex groups to the dependency's display and lookup identifiers [2][5]. In summary, for standard Go modules, both depName and packageName typically correspond to the Go module path [1][2]. When they differ—which is rare for Go modules but common in other ecosystems like Docker or Gradle—depName provides a human-readable identifier while packageName ensures accurate registry resolution [1][2].
Citations:
- 1: https://docs.renovatebot.com/faq/
- 2: Difference between `depName` and `packageName`? renovatebot/renovate#14885
- 3: renovatebot/renovate@5aa2ebf
- 4: https://docs.renovatebot.com/modules/manager/gomod/
- 5: https://docs.renovatebot.com/configuration-options/
Match the full Go module path.
The dependency in go.mod is github.com/Flagsmith/flagsmith-go-client/v5, and Renovate’s Go module identifier is the full module path. Use github.com/Flagsmith/flagsmith-go-client/v5 here, or matchDepNames for the current dependency name.
Proposed fix
- "matchPackageNames": ["flagsmith-go-client"],
+ "matchPackageNames": ["github.com/Flagsmith/flagsmith-go-client/v5"],📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "description": "Eagerly bump flagsmith-go-client on every version release", | |
| "matchPackageNames": ["flagsmith-go-client"], | |
| "enabled": true, | |
| "rangeStrategy": "bump", | |
| "matchUpdateTypes": ["minor", "major"] | |
| "description": "Eagerly bump flagsmith-go-client on every version release", | |
| "matchPackageNames": ["github.com/Flagsmith/flagsmith-go-client/v5"], | |
| "enabled": true, | |
| "rangeStrategy": "bump", | |
| "matchUpdateTypes": ["minor", "major"] |
| "matchManagers": ["go"], | ||
| "addLabels": ["cli", "dependencies"] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Renovate matchManagers gomod manager identifier
💡 Result:
In Renovate, matchManagers is a configuration option used within packageRules to target specific dependency managers [1]. To target Go modules specifically, you use the identifier "gomod" [2][1]. Common usage patterns for matchManagers: ["gomod"] include: 1. Filtering Go module updates: You can combine matchManagers: ["gomod"] with other matchers like matchDepTypes or constraintsFiltering to fine-tune which dependencies Renovate updates [2][3][4]. For example, using {"matchManagers": ["gomod"], "constraintsFiltering": "strict"} limits updates to versions that stay within the current minor version defined by your go.mod go directive [3][5]. 2. Disabling or enabling specific update types: You can use this to apply rules specifically to Go dependencies, such as disabling go version updates or enabling indirect dependency updates [2][4][6]. 3. Applying post-update options: While not directly a matchManager setting, the gomod manager supports specific postUpdateOptions like gomodTidy or gomodMassage to handle go.sum files and replace directives [7]. When configuring Renovate for Go projects, "gomod" is the required identifier to ensure your rules apply correctly to the contents of go.mod files [2].
Citations:
- 1: https://docs.renovatebot.com/configuration-options/
- 2: https://docs.renovatebot.com/modules/manager/gomod/
- 3: https://www.jvt.me/posts/2026/05/02/renovate-only-go-directive/
- 4: Disable go version updates by default renovatebot/renovate#16715
- 5: https://engineered.at/articles/configuring-renovate-to-only-suggest-updates-that-match-your-go-directive
- 6: https://docs.renovatebot.com/presets-security/
- 7: https://docs.renovatebot.com/golang/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Renovate files:"
git ls-files | rg '(^|/)renovate(\.json5|\.json|\.cjs|mjs|\.ts|\.js)$|(^|/)package\.json$|(^|/)README' || true
echo
if [ -f renovate.json ]; then
echo "renovate.json relevant lines:"
nl -ba renovate.json | sed -n '1,80p'
fiRepository: Flagsmith/flagsmith-cli
Length of output: 273
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "renovate.json:"
awk '{printf "%6\t%s\n", NR, $0}' renovate.json
echo
echo "Search for matchManagers/usages:"
rg -n 'matchManagers|go|gomod|datasource' renovate.json README.md || trueRepository: Flagsmith/flagsmith-cli
Length of output: 938
Use the gomod manager identifier.
matchManagers must use Renovate manager names. Renovate’s Go Modules manager is gomod; go is the datasource name. This rule misses Go module updates and will not add cli / dependencies labels.
Proposed fix
- "matchManagers": ["go"],
+ "matchManagers": ["gomod"],📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "matchManagers": ["go"], | |
| "addLabels": ["cli", "dependencies"] | |
| "matchManagers": ["gomod"], | |
| "addLabels": ["cli", "dependencies"] |
1 participant
No description provided.