Skip to content

renovate: *-module-version inputs are unwatched, and dagger-module-version matches blueprints pins #201

Closed

Description

@patrick-hermann-sva

Problem

Renovate's stuttgart-things/dagger custom manager (renovate.json) only matches dagger-module-version, sops-module-version and the inline github.com/stuttgart-things/dagger/<mod>@vX.Y.Z form. Every other *-module-version input is unwatched, so #193 (→ v0.136.3) left these behind:

Workflow Input Module Default
call-kcl-validate.yaml kcl-module-version dagger/kcl v0.134.0
call-crossplane-verify.yaml crossplane-module-version dagger/crossplane v0.122.0
call-pre-commit.yaml linting-module-version dagger/linting v0.115.0
call-validate-json-schema.yaml linting-module-version dagger/linting v0.100.0
call-argocd-verify-catalog.yaml argocd-module-version dagger/argocd v0.104.0
call-helm-verify.yaml helm-module-version dagger/helm v0.99.0
call-stage-image.yaml crane-module-version dagger/crane v0.91.0

Functionally, call-kcl-validate isn't affected yet: dagger/kcl is identical between v0.134.0 and v0.136.3 (it already includes the kcl-lang mirror). But it's no longer pinned to the same version as call-go-release / call-push-kustomize, and the next kcl change would be missed.

Second issue: the existing regex can also pick up the wrong repo

dagger-module-version: is not specific to the dagger repo. These inputs point at stuttgart-things/blueprints, but the regex maps them to depName: stuttgart-things/dagger:

  • call-repository-linting.yaml: dagger-module-version v1.15.0 → blueprints/repository-linting
  • this-lint-repo.yaml: dagger-module-version: v1.17.0 → blueprints/repository-linting

They only escape today because v1.x > v0.136.x, so Renovate sees no update. The argocd-module-version inputs at v2.4.0 / v2.7.0 (call-argocd-bootstrap, call-create-vault-issuer, call-create-vault-k8s-auth) are also blueprints/argocd, not dagger/argocd. That's why a blanket *-module-version regex would be wrong too.

Proposal

  • Add a stuttgart-things/dagger matcher for (kcl|crossplane|linting|helm|crane)-module-version and the dagger/argocd input in call-argocd-verify-catalog. Either list the input names explicitly, or anchor on the module: github.com/stuttgart-things/dagger/...@${{ inputs.<name> }} usage.
  • Add a separate stuttgart-things/blueprints manager for the blueprints pins, and exclude them from the dagger one.
  • crossplane-module-version: check before bumping that v0.136.3 still passes call-crossplane-verify here (the input carries a long changelog comment about render behaviour); the other bumps from chore(deps): update dependency stuttgart-things/dagger to v0.136.3 #193 were tested.

Found while reviewing #193 / #197.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions