Configure Renovate

[renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

• contrib/tilt/runtime.Dockerfile (dockerfile)
• operators/account-operator/Dockerfile (dockerfile)
• operators/backup-operator/Dockerfile (dockerfile)
• operators/extension-manager-operator/Dockerfile (dockerfile)
• operators/kcp-migration-operator/Dockerfile (dockerfile)
• operators/kro-composition-operator/Dockerfile (dockerfile)
• operators/platform-mesh-deployer/Dockerfile (dockerfile)
• operators/platform-mesh-operator/Dockerfile (dockerfile)
• operators/resource-broker/Dockerfile (dockerfile)
• operators/search-operator/Dockerfile (dockerfile)
• operators/security-operator/Dockerfile (dockerfile)
• operators/tenancy-operator/Dockerfile (dockerfile)
• operators/terminal-controller-manager/Dockerfile (dockerfile)
• operators/terminal-controller-manager/images/terminal/Dockerfile (dockerfile)
• services/iam-service/Dockerfile (dockerfile)
• services/kubernetes-graphql-gateway/Dockerfile (dockerfile)
• services/rebac-authz-webhook/Dockerfile (dockerfile)
• services/search-service/Dockerfile (dockerfile)
• services/virtual-workspaces/Dockerfile (dockerfile)
• .github/workflows/account-operator.yml (github-actions)
• .github/workflows/apis.yml (github-actions)
• .github/workflows/backup-operator.yml (github-actions)
• .github/workflows/extension-manager-operator.yml (github-actions)
• .github/workflows/golang-commons.yml (github-actions)
• .github/workflows/iam-service.yml (github-actions)
• .github/workflows/job-trivy-image.yml (github-actions)
• .github/workflows/job-trivy-sbom.yml (github-actions)
• .github/workflows/kcp-migration-operator.yml (github-actions)
• .github/workflows/kro-composition-operator.yml (github-actions)
• .github/workflows/kubernetes-graphql-gateway.yml (github-actions)
• .github/workflows/ossf-scorecard.yml (github-actions)
• .github/workflows/pr-gate.yml (github-actions)
• .github/workflows/rebac-authz-webhook.yml (github-actions)
• .github/workflows/resource-broker.yml (github-actions)
• .github/workflows/search-operator.yml (github-actions)
• .github/workflows/search-service.yml (github-actions)
• .github/workflows/security-operator.yml (github-actions)
• .github/workflows/subroutines.yml (github-actions)
• .github/workflows/tenancy-operator.yml (github-actions)
• .github/workflows/terminal-controller-manager.yml (github-actions)
• .github/workflows/verify-all.yml (github-actions)
• .github/workflows/verify-go-version.yml (github-actions)
• .github/workflows/virtual-workspaces.yml (github-actions)
• .github/workflows/zizmor.yml (github-actions)
• apis/go.mod (gomod)
• cmd/jl/go.mod (gomod)
• cmd/qbrtool/go.mod (gomod)
• cmd/release/go.mod (gomod)
• golang-commons/go.mod (gomod)
• operators/account-operator/go.mod (gomod)
• operators/backup-operator/go.mod (gomod)
• operators/extension-manager-operator/go.mod (gomod)
• operators/kcp-migration-operator/go.mod (gomod)
• operators/kro-composition-operator/go.mod (gomod)
• operators/platform-mesh-deployer/go.mod (gomod)
• operators/resource-broker/go.mod (gomod)
• operators/search-operator/go.mod (gomod)
• operators/security-operator/go.mod (gomod)
• operators/tenancy-operator/go.mod (gomod)
• operators/terminal-controller-manager/go.mod (gomod)
• services/iam-service/go.mod (gomod)
• services/kubernetes-graphql-gateway/go.mod (gomod)
• services/rebac-authz-webhook/go.mod (gomod)
• services/search-service/go.mod (gomod)
• services/virtual-workspaces/go.mod (gomod)
• subroutines/go.mod (gomod)
• operators/tenancy-operator/deploy/helm/tenancy-operator/values.yaml (helm-values)
• operators/platform-mesh-deployer/config/bases/kcp-operator/config/kustomization.yaml (kustomize)
• operators/platform-mesh-deployer/config/bases/kcp-operator/crds/kustomization.yaml (kustomize)
• operators/platform-mesh-deployer/config/bases/kcp-operator/default/kustomization.yaml (kustomize)
• operators/platform-mesh-deployer/config/bases/kcp-operator/workload/kustomization.yaml (kustomize)
• operators/platform-mesh-deployer/config/default/kustomization.yaml (kustomize)
• operators/resource-broker/config/broker/default/kustomization.yaml (kustomize)
• renovate.json (renovate-config)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs
• Pin github-action digests.
• Pin Docker digests.
• Append Signed-off-by: to signoff Git commits.
• Only update branches when scheduled.
• Run Renovate on following schedule: * * * * 0

---

What to Expect

With your current configuration, Renovate will create 9 Pull Requests:

Update module github.com/klauspost/compress to v1.18.7 [SECURITY]

• Branch name: renovate/go-github.com-klauspost-compress-vulnerability
• Merge into: main
• Upgrade github.com/klauspost/compress to v1.18.7

Update module google.golang.org/grpc to v1.82.1 [SECURITY]

• Branch name: renovate/go-google.golang.org-grpc-vulnerability
• Merge into: main
• Upgrade google.golang.org/grpc to v1.82.1

Pin dependencies

• Schedule: ["* * * * 0"]
• Branch name: renovate/pin-dependencies
• Merge into: main
• Upgrade alpine to sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
• Upgrade alpine to sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
• Upgrade ghcr.io/ntnn/kcp-operator to sha256:c4b4f72814839de7dfd7530b2ff026c8a30afa5a7f8a678f8b1aa0b2c111b9cb
• Upgrade ghcr.io/platform-mesh/resource-broker to sha256:7582992a48f2170075d7ede575d8765e2de5d14b40350220ac2cc329c62d8c38
• Upgrade golang to sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191

Update all non-major dependencies

• Schedule: ["* * * * 0"]
• Branch name: renovate/all-minor-patch
• Merge into: main
• Upgrade actions/checkout to 3d3c42e5aac5ba805825da76410c181273ba90b1
• Upgrade alpine to sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
• Upgrade docker/build-push-action to 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
• Upgrade docker/login-action to dbcb813823bdd20940b903addbd779551569679f
• Upgrade docker/setup-buildx-action to bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
• Upgrade docker/setup-qemu-action to c7c53464625b32c7a7e944ae62b3e17d2b600130
• Upgrade github.com/99designs/gqlgen to v0.17.94
• Upgrade github.com/fluxcd/helm-controller/api to v1.6.3
• Upgrade github.com/fluxcd/source-controller/api to v1.9.3
• Upgrade github.com/getsentry/sentry-go to v0.48.0
• Upgrade github.com/go-chi/chi/v5 to v5.3.1
• Upgrade github.com/go-openapi/testify/v2 to v2.6.0
• Upgrade github.com/jarcoal/httpmock to v1.4.2
• Upgrade github.com/jellydator/ttlcache/v3 to v3.4.1
• Upgrade github.com/kcp-dev/kubernetes to 4e89f2e6670b1662021a86ac42b99c5c50c37d05
• Upgrade github.com/kubernetes-sigs/kro to v0.9.3
• Upgrade github.com/oapi-codegen/runtime to v1.6.0
• Upgrade github.com/onsi/ginkgo/v2 to v2.32.0
• Upgrade github.com/onsi/gomega to v1.42.1
• Upgrade github.com/openfga/api/proto to 6981fff8d33b
• Upgrade github.com/openfga/language/pkg/go to v0.3.1
• Upgrade github.com/openfga/openfga to v1.18.1
• Upgrade github.com/opensearch-project/opensearch-go/v4 to v4.7.3
• Upgrade github.com/prometheus/client_golang to v1.24.1
• Upgrade github.com/vektah/gqlparser/v2 to v2.5.36
• Upgrade github/codeql-action to f205ea1c3313d32999d8d6a48b4f6530d4437b38
• Upgrade go.opentelemetry.io/proto/otlp to v1.11.0
• Upgrade golang to sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• Upgrade k8s.io/kube-openapi to d427ff9ee9ad
• Upgrade platform-mesh/.github to b2ef3a19ca62f72a7842058ad4b356099d1a0cd1

Update actions/setup-go action to v7

• Schedule: ["* * * * 0"]
• Branch name: renovate/actions-setup-go-7.x
• Merge into: main
• Upgrade actions/setup-go to b7ad1dad31e06c5925ef5d2fc7ad053ef454303e

Update arduino/setup-task action to v3

• Schedule: ["* * * * 0"]
• Branch name: renovate/arduino-setup-task-3.x
• Merge into: main
• Upgrade arduino/setup-task to c0bc642852239c2689f73f4ea6459c29405f3c52

Update docker/build-push-action action to v7

• Schedule: ["* * * * 0"]
• Branch name: renovate/docker-build-push-action-7.x
• Merge into: main
• Upgrade docker/build-push-action to 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a

Update docker/setup-qemu-action action to v4

• Schedule: ["* * * * 0"]
• Branch name: renovate/docker-setup-qemu-action-4.x
• Merge into: main
• Upgrade docker/setup-qemu-action to 96fe6ef7f33517b61c61be40b68a1882f3264fb8

Update module github.com/kcp-dev/kubernetes to v1

• Schedule: ["* * * * 0"]
• Branch name: renovate/github.com-kcp-dev-kubernetes-1.x
• Merge into: main
• Upgrade github.com/kcp-dev/kubernetes to ecf6decece6a6de25a57aad9ba90b6ce580f6f78

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.