renovate.json5

{
  "extends": [
    "config:base",
    ":semanticCommits",
  ],
  // Renovate Regex Manager Configuration
  //
  // A slight variation on the pattern documented within Renovate's docs:
  //
  //   => https://docs.renovatebot.com/modules/manager/regex/
  //
  // This powers a mechanism that allows Renovate (the package dependency
  // manager that we use within this repository) to bump packages that live
  // outside of typical package manifests (e.g., `package.json`) and instead
  // any number of files.
  //
  // This pattern can be conceivably adapted to any pattern to allow the
  // "Renovation" of nearly anything.  This is largely what Renovate does
  // behind the scenes for various datasources anyhow (e.g., Dockerfiles).
  //
  // You can find a list of data-source specific details on this page:
  //
  //   => https://docs.renovatebot.com/modules/datasource/
  //
  "regexManagers": [
    {
      "fileMatch": [
        "^\\.tool-versions$",
        "(^|/)Dockerfile[^/]*$",
        "^rust-toolchain\\.toml$",
        "^docs/.*?\\.mdx$"
      ],
      "matchStrings": [
        "(#|<!--)\\s*renovate-automation: rustc version\\s*(?:-->)?\\n[^.]*?(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\b"
      ],
      "depNameTemplate": "rust",
      "datasourceTemplate": "docker"
    }
  ],
  "packageRules": [
    // Don't do `rust` image updates on Dockerfiles since they'll we want them
    // managed/grouped into the package rule directly after this one.  This
    // prevents multiple PRs for the same bump, and puts all our Rust version
    // bumps together.
    {
      "matchPackageNames": ["rust"],
      "matchManagers": ["dockerfile"],
      "enabled": false
    },
    {
      // This "rust" name maps to the Docker Hub "rust" image above on account
      // of the `regexManagers[0]` defined above being `datasourceTemplate` = `docker`.
      "matchPackageNames": ["rust"],
      "matchManagers": "regex",
      "groupName": "rustc",
      "branchName": "{{{branchPrefix}}}rustc"
    },
    // Bunch up all non-major npm dependencies into a single PR.  In the common case
    // where the upgrades apply cleanly, this causes less noise and is resolved faster
    // than starting a bunch of upgrades in parallel for what may turn out to be
    // a suite of related packages all released at once.
    //
    // Since too much in the Rust ecosystem is pre-1.0, we make an exception here.
    {
      "matchCurrentVersion": "< 1.0.0",
      "separateMinorPatch": true,
      "matchManagers": [ "cargo" ],
      "minor": {
        "groupName": "cargo pre-1.0 packages",
        "groupSlug": "cargo-all-pre-1.0",
      },
      "patch": {
        "groupName": "cargo pre-1.0 packages",
        "groupSlug": "cargo-all-pre-1.0",
        "automerge": true,
      }
    },
    {
      "matchCurrentVersion": ">= 1.0.0",
      "matchManagers": [ "cargo", "npm" ],
      // TODO: https://github.com/apollographql/router/pull/3194/commits/4e522a245e715e67d44c8dfc0a458bca1d054078
      // Remove this after `flate2` is resolved.
      "excludePackageNames": ["flate2"],
      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
      "groupName": "all non-major packages >= 1.0",
      "groupSlug": "all-non-major-gte-1.0",
      "automerge": true,
    },
    // We're currently constrained in our ability to update the `tracing`
    // packages to the latest versions because of our usage.  As an extension
    // of the same concern, we cannot update our `opentelemetry` packages since
    // those are tightly intertwined.  This exception puts those packages into
    // their own group and away from other dep updates until the time that
    // those problems are no longer.  For more details, see the explainations
    // in the `/apollo-router/Cargo.toml` file around the declarations for
    // `^opentelemetry` and `^tracing` packages.
    {
      "matchManagers": [
        "cargo"
      ],
      "matchPackagePatterns": [
        "^tracing",
        "^opentelemetry",
      ],
      "groupName": "cargo tracing packages",
      "groupSlug": "cargo-tracing-packages",
      "dependencyDashboardApproval": true
    },
    // We'll review these in a PR of their own since it has the most direct runtime
    // implications on users that we'd like to be very intentional about.
    {
      "matchPackageNames": ["router-bridge"],
      "groupName": "router-bridge updates (including federation)",
      "groupSlug": "rust-router-bridge-updates",
      "matchManagers": ["cargo"],
      "automerge": false
    }
  ]
}