ci: Add Renovate configuration #72
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,21 @@ | ||||||||||
| { | ||||||||||
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||||||||||
| "extends": [ | ||||||||||
| "security:only-security-updates", | ||||||||||
| ":semanticCommitTypeAll(deps)" | ||||||||||
| ], | ||||||||||
| "semanticCommitScope": "", | ||||||||||
| "packageRules": [ | ||||||||||
| { | ||||||||||
| "description": "Eagerly bump flagsmith-go-client on every version release", | ||||||||||
| "matchPackageNames": ["flagsmith-go-client"], | ||||||||||
| "enabled": true, | ||||||||||
| "rangeStrategy": "bump", | ||||||||||
| "matchUpdateTypes": ["minor", "major"] | ||||||||||
| }, | ||||||||||
| { | ||||||||||
| "matchManagers": ["go"], | ||||||||||
| "addLabels": ["cli", "dependencies"] | ||||||||||
|
Comment on lines
+17
to
+18
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🌐 Web query:
💡 Result: In Renovate, matchManagers is a configuration option used within packageRules to target specific dependency managers [1]. To target Go modules specifically, you use the identifier "gomod" [2][1]. Common usage patterns for matchManagers: ["gomod"] include: 1. Filtering Go module updates: You can combine matchManagers: ["gomod"] with other matchers like matchDepTypes or constraintsFiltering to fine-tune which dependencies Renovate updates [2][3][4]. For example, using {"matchManagers": ["gomod"], "constraintsFiltering": "strict"} limits updates to versions that stay within the current minor version defined by your go.mod go directive [3][5]. 2. Disabling or enabling specific update types: You can use this to apply rules specifically to Go dependencies, such as disabling go version updates or enabling indirect dependency updates [2][4][6]. 3. Applying post-update options: While not directly a matchManager setting, the gomod manager supports specific postUpdateOptions like gomodTidy or gomodMassage to handle go.sum files and replace directives [7]. When configuring Renovate for Go projects, "gomod" is the required identifier to ensure your rules apply correctly to the contents of go.mod files [2]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Renovate files:"
git ls-files | rg '(^|/)renovate(\.json5|\.json|\.cjs|mjs|\.ts|\.js)$|(^|/)package\.json$|(^|/)README' || true
echo
if [ -f renovate.json ]; then
echo "renovate.json relevant lines:"
nl -ba renovate.json | sed -n '1,80p'
fiRepository: Flagsmith/flagsmith-cli Length of output: 273 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "renovate.json:"
awk '{printf "%6\t%s\n", NR, $0}' renovate.json
echo
echo "Search for matchManagers/usages:"
rg -n 'matchManagers|go|gomod|datasource' renovate.json README.md || trueRepository: Flagsmith/flagsmith-cli Length of output: 938 Use the
Proposed fix- "matchManagers": ["go"],
+ "matchManagers": ["gomod"],📝 Committable suggestion
Suggested change
|
||||||||||
| } | ||||||||||
| ] | ||||||||||
| } | ||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Flagsmith/flagsmith-cli
Length of output: 3302
🏁 Script executed:
Repository: Flagsmith/flagsmith-cli
Length of output: 4140
🌐 Web query:
Renovate Go modules postUpdateOptions gomodUpdateImportPaths major module path change documentation💡 Result:
To handle major module path changes (e.g., when a Go module bumps its major version and requires a change to the import path, such as v80 to v81), you should use the
gomodUpdateImportPathsoption in your Renovate configuration [1][2]. By default, Renovate only updatesgo.modfiles for major upgrades, leaving it to the user to manually update import paths in source code [2]. AddinggomodUpdateImportPathsto yourpostUpdateOptionsinstructs Renovate to use the marwan-at-work/mod tool to automatically update import paths within your Go source files during the update process [1][2][3]. Key considerations and best practices: 1. EnablinggomodUpdateImportPathsimplicitly triggersgomodTidy[2]. Runninggo mod tidyis essential to ensure that thego.modandgo.sumfiles are cleaned up correctly after the import path updates are applied [2][3]. 2. Major Go upgrades often require changes beyond just import paths (such as application logic modifications), so these PRs may still require manual intervention before they are ready to be merged [2]. 3. For major updates, it is highly recommended to setdependencyDashboardApproval=true[2]. This allows you to trigger and review these potentially breaking updates on demand rather than having them automatically opened as PRs [2]. 4. Be aware that users have reported issues where Renovate may occasionally struggle to correctly replace existing major version entries ingo.mod, sometimes resulting in duplicate version entries or update cycles [4]. If you encounter such issues, manual verification or adjustment of thego.modfile may be necessary [4][5]. Example configuration snippet: { "postUpdateOptions": [ "gomodUpdateImportPaths", "gomodTidy" ], "dependencyDashboardApproval": true }Citations:
Handle Go major-module import path changes.
renovate.jsonallows auto-generated major updates forflagsmith-go-client, whilegithub.com/Flagsmith/flagsmith-cli/v2importsgithub.com/Flagsmith/flagsmith-go-client/v5. A future major bump requires the module path andinternal/cmd/evaluate.goimports to move to the next major path; by default Renovate only updatesgo.mod. This can create a build-breaking PR. AddpostUpdateOptions: ["gomodUpdateImportPaths"], or keep major updates manually approved.🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Flagsmith/flagsmith-cli
Length of output: 12822
🌐 Web query:
Renovate Bot Go module matchPackageNames full module path github.com Flagsmith flagsmith-go-client v5 import slash module💡 Result:
In Renovate, matchPackageNames primarily matches against the depName (dependency name) property, though it historically includes a fallback to check packageName [1][2]. Because this fallback behavior is deprecated, it is recommended to use matchDepNames instead of matchPackageNames to target specific dependencies [2]. Regarding Go modules like github.com/Flagsmith/flagsmith-go-client, Renovate treats the full module path (e.g., github.com/Flagsmith/flagsmith-go-client) as the primary identifier [3]. When matching these in Renovate configuration: 1. Recommended Approach: Use matchDepNames for explicit matching against the dependency name [2][4]. 2. Experimental Matching: If you require matching against the specific packageName property (which often contains the full module path for Go), you can enable the experimental environment variable RENOVATE_X_MATCH_PACKAGE_NAMES_MORE on self-hosted instances [1][5][6]. When this is enabled, Renovate will attempt to match your configured values against the packageName in addition to the depName [5]. For Go modules specifically, major version changes (e.g., v5) involve appending or updating a version suffix (like /v5) to the import path [3]. Renovate handles these versioned import paths automatically as part of its gomod manager logic [4][3]. When writing package rules for these, ensure your patterns account for the module path structure, typically github.com/org/repo [3]. If you encounter matching issues, checking your Renovate logs for warnings about matchPackageNames will help identify if the tool is falling back to depName or successfully matching against the full module path [2].
Citations:
🌐 Web query:
Renovate Bot gomod manager depName package github.com org repo module path💡 Result:
In Renovate Bot, the gomod manager handles Go modules by automatically identifying and updating dependencies defined in go.mod files [1]. Key concepts regarding how it handles dependency identifiers include: 1. depName and Module Paths: The depName typically represents the full module path (e.g., github.com/org/repo) as declared in the go.mod file [2]. In internal logic, Renovate distinguishes between the full package name and the base name (often referred to as the name without a version) to manage major version updates correctly, particularly when handling version suffixes like /v2 [3][4]. 2. Configuration and Matching: You can use depName in your configuration to target specific modules for updates or to apply custom rules. For example, the matchDepNames configuration option allows you to match against these module paths [1]. 3. Custom Managers: If you need to process files that are not automatically detected or require custom extraction logic, you can use custom managers. When configuring a custom manager, you must extract or define the depName (or packageName) using either named capture groups in a regex matchStrings or via a template (e.g., depNameTemplate) [5][6]. Renovate recommends using either a regex capture group or a template, but not both simultaneously, to avoid configuration conflicts [5][6]. 4. Recent Changes: Renovate has undergone internal refactoring regarding how it handles package names, especially as it introduced logic to differentiate between the source and target package names during updates [7]. For official documentation on configuring the gomod manager, see the Renovate documentation for the gomod manager [1] and the general configuration options [6].
Citations:
replacedirectives renovatebot/renovate#41520depNamerenovatebot/renovate#30030🌐 Web query:
Renovate Bot docs gomod matchPackageNames matchDepNames dependency names💡 Result:
In Renovate Bot, dependency matching uses specific criteria to target packages within your configuration, such as inside packageRules [1]. Key Differences in Matching Criteria: - matchPackageNames: Historically, this property has been used to match against the dependency name (depName), but it is intended to match against the formal packageName [2][3]. Renovate currently attempts to match the packageName first and falls back to the depName [2]. Using this property may trigger a warning because this behavior is subject to future changes [2]. - matchDepNames: This is the recommended property for matching based on the dependency's name (depName) [2]. It targets the identifier used to reference the dependency within the specific manager [3]. Context in Go Modules (gomod): When working with the gomod manager, these matchers are commonly used within packageRules to customize update behavior for specific dependencies [4]. Examples: - To target the Go toolchain version defined in go.mod, you can combine matchManagers with matchDepNames [4]: { "packageRules": [ { "matchManagers": ["gomod"], "matchDepNames": ["go"], "matchDepTypes": ["golang"], "rangeStrategy": "bump" } ] } - General usage of matchPackageNames in rules (for example, to set versioning or other properties) typically targets the package identifier [5]: { "packageRules": [ { "matchPackageNames": ["example/package"], "versioning": "semver" } ] } Best Practices: - Use matchDepNames when you need to match against the dependency's display name or reference name [2]. - Prefer matchPackageNames only when you are targeting the formal package name, and be aware of potential warnings during the transition period as Renovate shifts toward stricter distinction between packageName and depName [2][3]. - Always test your rules to ensure they are targeting the intended dependencies, especially when using regex patterns in matchers [6][1].
Citations:
🌐 Web query:
Renovate Bot gomod parser fullModulePath depName packageName💡 Result:
In the context of the Renovate Bot gomod (Go Modules) parser, depName and packageName are standard internal configuration properties used to manage dependencies [1][2]. While these terms are general to Renovate's architecture, their application within the gomod manager follows these principles: depName: This serves as the "display name" or the user-facing identifier for the dependency [1][2]. Renovate uses this value in logs, commit messages, Pull Request titles, and the Dependency Dashboard [1][2]. For the gomod manager, the depName is typically the module path (e.g., github.com/user/repo) [3]. packageName: This is the full, exact name used by Renovate to perform the actual lookup against package registries (e.g., the Go proxy) [1][2]. In the case of Go modules, the packageName is generally identical to the module path, making it effectively the same as the depName [1][2]. Regarding "fullModulePath," this is not a distinct, formal configuration option for the gomod parser's primary identification logic. Instead, the gomod manager extracts dependencies directly from go.mod file directives such as require, replace, and tool [4]. The parser identifies the module path (which acts as the unique identifier/name) during this extraction process [3]. If you are working with custom regex managers, these fields (depName and packageName) are used to map captured regex groups to the dependency's display and lookup identifiers [2][5]. In summary, for standard Go modules, both depName and packageName typically correspond to the Go module path [1][2]. When they differ—which is rare for Go modules but common in other ecosystems like Docker or Gradle—depName provides a human-readable identifier while packageName ensures accurate registry resolution [1][2].
Citations:
Match the full Go module path.
The dependency in
go.modisgithub.com/Flagsmith/flagsmith-go-client/v5, and Renovate’s Go module identifier is the full module path. Usegithub.com/Flagsmith/flagsmith-go-client/v5here, ormatchDepNamesfor the current dependency name.Proposed fix
📝 Committable suggestion