mirror of
https://github.com/livekit/livekit.git
synced 2026-09-14 04:35:35 +00:00
Benjamin Pracht
2cad1cc936
- Renovate config:recommended (config:base is deprecated) and matchPackageNames globs instead of the deprecated matchPackagePrefixes. Vulnerability alerts get a fast path: 2-day quarantine, no concurrency/hourly/schedule limits. Go modules are no longer grouped into one "go deps" PR — each gets its own, so a bad bump can be reverted alone. The pion modules stay grouped as a documented exception: they're co-released and interdependent, so individual PRs wouldn't build. First-party github.com/livekit/** skips the 2-week quarantine. go.mod's go directive is no longer an update target — the build toolchain is pinned in the Dockerfile instead. Dockerfile deps get pinDigests; the golang image is ungrouped with separateMinorPatch so a patch and a minor bump are each separately approvable. Custom manager to bump the builder image's -alpineA.B suffix together with its digest, which the stock docker manager holds fixed. - Pinning Both Dockerfiles pin golang and alpine by digest alongside the readable tag. GOTOOLCHAIN=local so a go.mod bump fails loudly instead of silently downloading a different toolchain. apk upgrade in the runtime stage — a digest pin plus the 2-week quarantine would otherwise ship base-package CVEs Alpine has already fixed. This relies on a cold layer cache, which holds today because the release workflow configures no buildx cache; there's a comment saying so. Workflows resolve the Go version from the Dockerfile via .github/scripts/go-version.sh, so tests, releases and images share one toolchain. - Tools All four code generators now come from the module graph, and tools/tools.go (the pre-Go-1.24 blank-import idiom) is replaced by go.mod tool directives: tool how why goimports go tool lives in x/tools — its own module is the one being selected gotestfmt go tool zero dependencies, nothing to skew wire go run pins x/tools v0.24.1; building it in our graph changes its output counterfeiter go run unchanged, matches its //go:generate directives The wire distinction is load-bearing. Building wire inside our module raises it from the x/tools v0.24.1 it pins to our v0.48.0, and that module version difference changes what it generates: it falls back to v/v2/v3 instead of deriving real identifiers from the type. wire_gen.go is regenerated here to match the in-module build — a cosmetic rename of 9 lines, with no other change to the generated code. golangci-lint deliberately keeps its action rather than becoming a tool: it pins its own x/tools (v0.44.0 vs our v0.48.0) for the analyzers it bundles, adding it to go.mod would double our go.mod/go.sum (158→338 / 441→889 lines), and the action supplies caching, only-new-issues and PR annotations that invoking a binary can't. Its version stays manual by request.
80 lines
3.1 KiB
JSON
80 lines
3.1 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
"helpers:pinGitHubActionDigests"
|
|
],
|
|
"minimumReleaseAge": "2 weeks",
|
|
"commitBody": "Generated by renovateBot",
|
|
"prConcurrentLimit": 5,
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"minimumReleaseAge": "2 days",
|
|
"prConcurrentLimit": 0,
|
|
"prHourlyLimit": 0,
|
|
"schedule": []
|
|
},
|
|
"packageRules": [
|
|
{
|
|
"matchManagers": ["github-actions"],
|
|
"groupName": "github workflows"
|
|
},
|
|
{
|
|
"matchManagers": ["dockerfile"],
|
|
"groupName": "docker deps",
|
|
"pinDigests": true
|
|
},
|
|
{
|
|
"description": "Go modules are never grouped: each module gets its own PR so a bad bump can be reverted on its own",
|
|
"matchManagers": ["gomod"],
|
|
"groupName": null
|
|
},
|
|
{
|
|
"description": "Exception to the rule above: the pion modules are co-released and depend on each other, so bumping them one at a time produces PRs that don't build",
|
|
"matchManagers": ["gomod"],
|
|
"matchPackageNames": ["github.com/pion{/,}**"],
|
|
"groupName": "pion deps"
|
|
},
|
|
{
|
|
"description": "First-party deps, no need to quarantine new releases",
|
|
"matchManagers": ["gomod"],
|
|
"matchPackageNames": [
|
|
"github.com/livekit{/,}**"
|
|
],
|
|
"minimumReleaseAge": null
|
|
},
|
|
{
|
|
"description": "The go directive is the module minimum, owned by the go toolchain and dependency requirements; the build toolchain is pinned in the Dockerfile builder image instead",
|
|
"matchManagers": ["gomod"],
|
|
"matchDepTypes": ["golang"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "Build toolchain pin (Dockerfile golang image): a patch bump (stays on the current minor) and a minor bump each get their own approvable PR",
|
|
"matchManagers": ["dockerfile"],
|
|
"matchPackageNames": ["golang"],
|
|
"groupName": null,
|
|
"separateMinorPatch": true
|
|
}
|
|
],
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Bump the builder image's Alpine suffix (golang:X.Y.Z-alpineA.B) along with its pinned digest. The base docker manager only bumps the Go version and holds the Alpine suffix fixed. This looks up the golang image (not alpine) with regex versioning that treats the Alpine minor as the version to bump and the Go version as the fixed compatibility, so Renovate only proposes an Alpine that actually exists as a published golang tag. The digest is captured so a suffix bump rewrites the pin instead of leaving a stale one.",
|
|
"managerFilePatterns": [
|
|
"/(^|/)Dockerfile$/",
|
|
"/(^|/)[^/]*\\.Dockerfile$/"
|
|
],
|
|
"matchStrings": ["FROM golang:(?<currentValue>\\d+\\.\\d+\\.\\d+-alpine\\d+\\.\\d+)@(?<currentDigest>sha256:[0-9a-f]+)"],
|
|
"datasourceTemplate": "docker",
|
|
"depNameTemplate": "golang",
|
|
"versioningTemplate": "regex:^(?<compatibility>\\d+\\.\\d+\\.\\d+)-alpine(?<major>\\d+)\\.(?<minor>\\d+)$"
|
|
}
|
|
],
|
|
"postUpdateOptions": [
|
|
"gomodTidy"
|
|
],
|
|
"schedule": ["before 9am on monday"],
|
|
"updateNotScheduled": false
|
|
}
|