c1316d8a7eRemove last runtime installs from .tekton/tasks/: - govulncheck (go install) → baked via GOBIN in tools-builder stage, copied to final - @fission-ai/openspec (npm install -g at runtime) → added to npm/package-lock.json (npm ci integrity), symlinked at /usr/local/bin/openspec Also: add GOVULNCHECK_VERSION ARG (default: latest), update VERSIONS.md, renovate.json (govulncheck + openspec tracking), README bundled tools list, and OCI description label. Tracked via forgejo-mcp-7g9: refactor into smaller images (P4, deferred).
64 lines
2.3 KiB
JSON
64 lines
2.3 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:base"],
|
|
"enabled": true,
|
|
"packageRules": [
|
|
{
|
|
"description": "Hummingbird base image — manual review required; tag is floating (latest-builder). When a specific MAJOR.MINOR-builder tag is published, switch to it and remove this rule.",
|
|
"matchDatasources": ["docker"],
|
|
"matchPackageNames": ["registry.access.redhat.com/hi/go"],
|
|
"automerge": false,
|
|
"reviewers": ["goern"],
|
|
"labels": ["Kind/Enhancement", "release-tools/base-image-bump"]
|
|
},
|
|
{
|
|
"description": "goreleaser — auto-PR for patch/minor, manual for major",
|
|
"matchDatasources": ["go"],
|
|
"matchPackageNames": ["github.com/goreleaser/goreleaser/v2"],
|
|
"automerge": false,
|
|
"labels": ["Kind/Enhancement", "release-tools/tool-bump"]
|
|
},
|
|
{
|
|
"description": "syft — auto-PR for patch/minor, manual for major",
|
|
"matchDatasources": ["github-releases"],
|
|
"matchPackageNames": ["anchore/syft"],
|
|
"automerge": false,
|
|
"labels": ["Kind/Enhancement", "release-tools/tool-bump"]
|
|
},
|
|
{
|
|
"description": "cosign — auto-PR for patch/minor, manual for major",
|
|
"matchDatasources": ["github-releases"],
|
|
"matchPackageNames": ["sigstore/cosign"],
|
|
"automerge": false,
|
|
"labels": ["Kind/Enhancement", "release-tools/tool-bump"]
|
|
},
|
|
{
|
|
"description": "@anthropic-ai/mcpb — auto-PR with lockfile update",
|
|
"matchDatasources": ["npm"],
|
|
"matchPackageNames": ["@anthropic-ai/mcpb"],
|
|
"automerge": false,
|
|
"labels": ["Kind/Enhancement", "release-tools/tool-bump"]
|
|
},
|
|
{
|
|
"description": "@fission-ai/openspec — auto-PR with lockfile update",
|
|
"matchDatasources": ["npm"],
|
|
"matchPackageNames": ["@fission-ai/openspec"],
|
|
"automerge": false,
|
|
"labels": ["Kind/Enhancement", "release-tools/tool-bump"]
|
|
},
|
|
{
|
|
"description": "govulncheck — auto-PR for patch/minor, manual for major",
|
|
"matchDatasources": ["go"],
|
|
"matchPackageNames": ["golang.org/x/vuln"],
|
|
"automerge": false,
|
|
"labels": ["Kind/Enhancement", "release-tools/tool-bump"]
|
|
}
|
|
],
|
|
"ignorePaths": [
|
|
"go.sum",
|
|
"vendor/**",
|
|
"operation/**",
|
|
"pkg/**",
|
|
"cmd/**"
|
|
]
|
|
}
|