renovate.json5

// Dependency Update Configuration
//
// See https://github.com/GoogleCloudPlatform/emblem/tree/main/docs/decisions/2023-03-dependency-updates.md
// See https://docs.renovatebot.com/configuration-options/
// See https://json5.org/ for JSON5 syntax.
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base",
    "docker:enableMajor",
  ],
  "ignorePaths": [
    // Do not run on experiments.
    "experimental/**",
  ],

  // Schedule updates to generate a batch of work per sprint.
  // The schedule is designed to complete most updates on Saturday, when our
  // global extended team is not working. Timing is meant to avoid disrupting
  // a Saturday morning for anyone that forgot to disable work notifications.
  "schedule": "after 11am every 2 weeks on Saturday",
  "timezone": "America/Los_Angeles",

  // Control pace and priority of scheduled updates.
  "stabilityDays": 3, // in case package maintainers need to fix a mistake
  "prConcurrentLimit": 0, // unlimited concurrently open PRs
  "prHourlyLimit": 4, // 60/4 = 15 minute test window for synchronous testing

  // Pin versions for increased stability in apps.
  "rangeStrategy": "pin",
 
  // packageRules all process. Grouping is overwritten by last.
  "packageRules": [
    {
      // Client library may have wider range of dependents.
      // Avoid creating conflicts with app dependencies.
      "matchPaths": ["client-libs/**"],
      "rangeStrategy": "replace",
    },

    // Report impact of a dependency update via PR label.
    {
      "matchUpdateTypes": ["patch"],
       "labels": ["semver: patch"],
    },
    {
      "matchUpdateTypes": ["minor"],
       "labels": ["semver: minor"],
    },
    {
      "matchUpdateTypes": ["major"],
       "labels": ["semver: major"],
    },

    // Grouping dependency updates
    {
      // Group runtime updates.
      // This should apply to all Dockerfiles, cloudbuild.yaml.
      "groupName": "Language & Runtimes",
      "matchDatasources": ["docker"],
    },
    {
      // Group terraform updates together.
      "groupName": "Terraform",
      "matchManagers": ["terraform"],
    },
    {
       // Group GitHub Actions and pin digests for immutable use.
       "groupName": "GitHub Actions",
       "matchManagers": ["github-actions"],
       "pinDigests": true,
    },
    {
      // Bundle non-major dependencies for Website Python code.
      // Exclude frameworks and libraries where our usage lacks test coverage.
      "groupName": "Website (Python)",
      "matchPaths": ["website/**", "client-libs/**", "client-app/**"],
      "matchLanguages": ["python"],
      "matchUpdateTypes": ["minor", "patch"],
      // Excluding flask from Website and Content API is by design:
      // framework changes are significant and we group them across components.
      "excludePackageNames": ["flask"],
    },
    {
      // Bundle non-major dependencies for Content API Python code.
      // Exclude frameworks and libraries where our usage lacks test coverage.
      //
      // Currently the only API package under test is google-cloud-firestore.
      "groupName": "Content API",
      "matchPaths": ["content-api/**"],
      "matchLanguages": ["python"],
      "matchUpdateTypes": ["minor", "patch"],
      "matchPackageNames": ["google-cloud-firestore"],
    },
    {
      // Bundle non-major dependencies for Website JS code.
      // Exclude frameworks and libraries where our usage lacks test coverage.
      "groupName": "Website (JS Runtime)",
      "matchPaths": ["website/**", "client-libs/**", "client-app/**"],
      "matchLanguages": ["js", "node"],
      "matchUpdateTypes": ["minor", "patch"],
      // Scope the code to what we use in production operation.
      "matchDepTypes": ["dependencies"],
      "excludePackageNames": ["lit"],
    },
    {
      // Bundle dependencies for Website JS build code.
      "groupName": "Website (JS Build)",
      "matchPaths": ["website/**", "client-libs/**", "client-app/**"],
      "matchLanguages": ["js", "node"],
      // Scope the code to what we use during development and build processes.
      "matchDepTypes": ["devDependencies"],
    },
    {
      // Playwright dependencies require tight alignment.
      "groupName": "Playwright",
      "matchPackageNames": ["playwright", "@playwright/test", "mcr.microsoft.com/playwright"],
      // Run daily as a low-impact check for group updates.
      "schedule": "before 6am every day",
      "prBodyNotes": [
        ":warning: Playwright dependencies may roll out on a staggered schedule.",
        "If tests are not passing due to version conflict, wait for other packages",
        "and re-run renovate on this PR to retry the update.",
      ],
    },
    {
      // OpenTelemetry dependencies require tight alignment.
      "groupName": "OpenTelemetry",
      "matchPackagePrefixes": ["opentelemetry-"],
      // Run daily as a low-impact check for group updates.
      "schedule": "before 6am every day",
      "prBodyNotes": [
        ":warning: OpenTelemetry dependencies may roll out on a staggered schedule.",
        "If tests are not passing due to version conflict, wait for other packages",
        "and re-run renovate on this PR to retry the update.",
      ],
    },
  ],
}