renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":disableDependencyDashboard"],
  "enabledManagers": ["gomod", "github-actions", "dockerfile", "custom.regex"],
  "automerge": false,
  "internalChecksFilter": "strict",
  "customManagers": [
    {
      "customType": "regex",
      "description": "Update Claude Code release assets and their SHA-256 pins",
      "managerFilePatterns": ["/^docker/agent/Dockerfile$/"],
      "matchStrings": [
        "ARG CLAUDE_(?:AMD64|ARM64)_LOCK=(?<currentValue>v\\d+\\.\\d+\\.\\d+)@sha256:(?<currentDigest>[a-f0-9]{64})"
      ],
      "packageNameTemplate": "anthropics/claude-code",
      "depNameTemplate": "anthropics/claude-code",
      "datasourceTemplate": "github-release-attachments",
      "versioningTemplate": "semver-coerced"
    },
    {
      "customType": "regex",
      "description": "Update Codex CLI package assets and their SHA-256 pins",
      "managerFilePatterns": ["/^docker/agent/Dockerfile$/"],
      "matchStrings": [
        "ARG CODEX_(?:AMD64|ARM64)_LOCK=(?<currentValue>rust-v\\d+\\.\\d+\\.\\d+)@sha256:(?<currentDigest>[a-f0-9]{64})"
      ],
      "packageNameTemplate": "openai/codex",
      "depNameTemplate": "openai/codex",
      "datasourceTemplate": "github-release-attachments",
      "versioningTemplate": "regex:^rust-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(?:-(?<prerelease>.+))?$"
    },
    {
      "customType": "regex",
      "description": "Update the harness-proxy version built into the agent image",
      "managerFilePatterns": ["/^docker/agent/Dockerfile$/"],
      "matchStrings": ["ARG HARNESS_VERSION=(?<currentValue>v\\d+\\.\\d+\\.\\d+)"],
      "packageNameTemplate": "github.com/alpha-omega-security/harness",
      "depNameTemplate": "github.com/alpha-omega-security/harness",
      "datasourceTemplate": "go",
      "versioningTemplate": "semver"
    }
  ],
  "packageRules": [
    {
      "matchManagers": ["gomod"],
      "groupName": "Go modules",
      "minimumReleaseAge": "7 days",
      "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"]
    },
    {
      "description": "Raising the go directive raises the minimum Go version for every user of the action",
      "matchManagers": ["gomod"],
      "matchPackageNames": ["go"],
      "groupName": "Go language version"
    },
    {
      "description": "An indirect dependency's major version is decided by whatever requires it",
      "matchManagers": ["gomod"],
      "matchDepTypes": ["indirect"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    },
    {
      "matchManagers": ["github-actions"],
      "groupName": "GitHub Actions",
      "minimumReleaseAge": "7 days"
    },
    {
      "matchManagers": ["dockerfile"],
      "groupName": "Docker images",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "The agent CLIs read hostile reports: wait a week so a pulled release is not picked up",
      "matchManagers": ["custom.regex"],
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Keep both Claude Code assets on one release",
      "matchPackageNames": ["anthropics/claude-code"],
      "groupName": "Claude Code",
      "minimumGroupSize": 2
    },
    {
      "description": "Keep both Codex assets on one release",
      "matchPackageNames": ["openai/codex"],
      "groupName": "Codex CLI",
      "minimumGroupSize": 2
    },
    {
      "description": "harness-proxy in the agent image must match the harness module tamis is built with",
      "matchPackageNames": ["github.com/alpha-omega-security/harness"],
      "groupName": "harness",
      "minimumGroupSize": 2
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "automerge": false
  }
}