Skip to content

Make Renovate suggest base image updates#8096

Merged
cert-manager-prow[bot] merged 1 commit intomasterfrom
renovate/reconfigure
Sep 19, 2025
Merged

Make Renovate suggest base image updates#8096
cert-manager-prow[bot] merged 1 commit intomasterfrom
renovate/reconfigure

Conversation

@erikgb
Copy link
Copy Markdown
Member

@erikgb erikgb commented Sep 19, 2025

Pull Request Motivation

We all love more automation, and this PR should ensure Renovate suggests upgrades to our base images. Relates to #4033.

Kind

/kind cleanup

Release Note

NONE

@cert-manager-prow cert-manager-prow bot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. release-note-none Denotes a PR that doesn't merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Sep 19, 2025
@erikgb erikgb force-pushed the renovate/reconfigure branch from f62a5b8 to f000fd6 Compare September 19, 2025 18:16
@cert-manager cert-manager deleted a comment from octo-sts bot Sep 19, 2025
@erikgb erikgb force-pushed the renovate/reconfigure branch from f000fd6 to cb5cb3f Compare September 19, 2025 18:26
@cert-manager cert-manager deleted a comment from octo-sts bot Sep 19, 2025
@erikgb erikgb force-pushed the renovate/reconfigure branch from cb5cb3f to 236d97d Compare September 19, 2025 18:33
@cert-manager cert-manager deleted a comment from octo-sts bot Sep 19, 2025
@erikgb erikgb force-pushed the renovate/reconfigure branch from 236d97d to 81c46c1 Compare September 19, 2025 18:50
@cert-manager cert-manager deleted a comment from octo-sts bot Sep 19, 2025
@erikgb erikgb force-pushed the renovate/reconfigure branch from 81c46c1 to 5f28ef2 Compare September 19, 2025 18:56
@cert-manager cert-manager deleted a comment from octo-sts bot Sep 19, 2025
@erikgb erikgb changed the title WIP: Make Renovate suggest base image updates Make Renovate suggest base image updates Sep 19, 2025
@cert-manager-prow cert-manager-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 19, 2025
@erikgb erikgb requested a review from Copilot September 19, 2025 18:57
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR configures Renovate to automatically suggest updates for base container images used in the project. The changes enable Renovate to detect and update Docker image digests in the base images makefile.

Key changes:

  • Removed autogeneration comment from base images makefile to allow Renovate management
  • Added custom regex manager to detect Docker image references with SHA256 digests
  • Configured package rules to group base image updates together

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
make/base_images.mk Removed autogeneration comment to allow Renovate to manage the file
.github/renovate.json5 Added custom manager and package rules for base image updates

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Signed-off-by: Erik Godding Boye <egboye@gmail.com>
@erikgb erikgb force-pushed the renovate/reconfigure branch from ba112e4 to a4f2026 Compare September 19, 2025 19:00
@erikgb erikgb requested a review from Copilot September 19, 2025 19:00
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@cert-manager cert-manager deleted a comment from octo-sts bot Sep 19, 2025
@octo-sts
Copy link
Copy Markdown
Contributor

octo-sts bot commented Sep 19, 2025

Reconfigure PR Results

This is an reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:


Detected Package Files

  • hack/containers/Containerfile.acmesolver (dockerfile)
  • hack/containers/Containerfile.cainjector (dockerfile)
  • hack/containers/Containerfile.controller (dockerfile)
  • hack/containers/Containerfile.startupapicheck (dockerfile)
  • hack/containers/Containerfile.webhook (dockerfile)
  • make/config/pebble/Containerfile.pebble (dockerfile)
  • make/config/samplewebhook/Containerfile.samplewebhook (dockerfile)
  • .github/workflows/scorecards.yml (github-actions)
  • cmd/acmesolver/go.mod (gomod)
  • cmd/cainjector/go.mod (gomod)
  • cmd/controller/go.mod (gomod)
  • cmd/startupapicheck/go.mod (gomod)
  • cmd/webhook/go.mod (gomod)
  • go.mod (gomod)
  • test/e2e/go.mod (gomod)
  • test/integration/go.mod (gomod)
  • make/config/pebble/chart/values.yaml (helm-values)
  • make/config/samplewebhook/chart/values.yaml (helm-values)
  • .github/renovate.json5 (renovate-config-presets)
  • make/base_images.mk (regex)

Configuration Summary

Based on the default config's presets, Renovate will:

  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Pin Docker digests.
  • Pin github-action digests.
  • Enable Renovate configuration migration PRs when needed.
  • Pin dependency versions for development dependencies.
  • Update _VERSION environment variables in GitHub Action files.
  • Append Signed-off-by: to signoff Git commits.
  • Use semantic prefixes for commit messages and PR titles.
  • Disable vulnerability alerts completely.
  • Remove hourly and concurrent rate limits.
  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Pin Docker digests.
  • Pin github-action digests.
  • Enable Renovate configuration migration PRs when needed.
  • Pin dependency versions for development dependencies.
  • Update _VERSION environment variables in GitHub Action files.
  • Append Signed-off-by: to signoff Git commits.
  • Use semantic prefixes for commit messages and PR titles.
  • Disable vulnerability alerts completely.
  • Remove hourly and concurrent rate limits.

What to Expect

With your current configuration, Renovate will create 5 Pull Requests:

chore(deps): update base images
  • Schedule: ["at any time"]
  • Branch name: renovate/base-images
  • Merge into: master
  • Upgrade gcr.io/distroless/base-debian12 to sha256:d82d37df3bae85c6488d56f54ad5fc334ea15ff1e3f701af2866f7ab75d01e09
  • Upgrade gcr.io/distroless/base-debian12 to sha256:dad1d3c6695a0cdd3274d58f73f82cf36ae8bad0bdb0497262f2e1039df5fcb8
  • Upgrade gcr.io/distroless/base-debian12 to sha256:fa81a9ab9966083922a8465506accd01cad4ebb787f7e11309d464e19b94d097
  • Upgrade gcr.io/distroless/base-debian12 to sha256:4b66c135f2d73c969783fcb918e3b224ea66dac43ce8d2bdd166f362d5dd248c
  • Upgrade gcr.io/distroless/base-debian12 to sha256:b14f0d621bdfd1c967bca28f28ae7c1191e216ce0f34977c9f1e1f5081aae047
  • Upgrade gcr.io/distroless/static-debian12 to sha256:17274770d835d14eddc4070a12bdbcf746991125b70acffbd65935d9d88ab2ac
  • Upgrade gcr.io/distroless/static-debian12 to sha256:9b9ebe0472d908cc5f8ca03e437dd82f0984cc254eee59effd52aa539fe8a3d8
  • Upgrade gcr.io/distroless/static-debian12 to sha256:0f30716c69ea9a9f62484fe3b284300ae67d136135312ee6d0f794c470b4fa27
  • Upgrade gcr.io/distroless/static-debian12 to sha256:ed92139a33080a51ac2e0607c781a67fb3facf2e6b3b04a2238703d8bcf39c40
  • Upgrade gcr.io/distroless/static-debian12 to sha256:6ceafbc2a9c566d66448fb1d5381dede2b29200d1916e03f5238a1c437e7d9ea
fix(deps): update k8s.io/kube-openapi digest to 589584f
  • Schedule: ["at any time"]
  • Branch name: renovate/k8s.io-kube-openapi-digest
  • Merge into: master
  • Upgrade k8s.io/kube-openapi to 589584f1c912
fix(deps): update cloud go deps
fix(deps): update module github.com/akamai/akamaiopen-edgegrid-golang/v11 to v12
fix(deps): update module github.com/cloudflare/cloudflare-go/v5 to v6

@erikgb
Copy link
Copy Markdown
Member Author

erikgb commented Sep 19, 2025

/cc @maelvls @ThatsMrTalbot

@hjoshi123
Copy link
Copy Markdown
Collaborator

🚀
/lgtm

@cert-manager-prow cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Sep 19, 2025
@erikgb
Copy link
Copy Markdown
Member Author

erikgb commented Sep 19, 2025

/approve

@cert-manager-prow
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 19, 2025
@cert-manager-prow cert-manager-prow bot merged commit 1cf326e into master Sep 19, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants