fix(bun): switch to matchDepNames for runtime version bundle (#122)

In logs, we see that the actual package name for the docker Dependency is our cache. This PR tries to match by depName instead of packageName.

```plain
{
             "deps": [
               {
                 "depName": "Bun",
                 "packageName": "bun",
                 "currentValue": "1.3.6",
                 "datasource": "npm",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "1.3.14",
                     "newValue": "1.3.14",
                     "hasAttestation": false,
                     "releaseTimestamp": "2026-05-13T04:02:43.309Z",
                     "newVersionAgeInDays": 85,
                     "newMajor": 1,
                     "newMinor": 3,
                     "newPatch": 14,
                     "updateType": "patch",
                     "isBreaking": false,
                     "libYears": 0.3289416609271943,
                     "branchName": "renovate/bun-version"
                   }
                 ],
                 "versioning": "npm",
                 "warnings": [],
                 "sourceUrl": "https://github.com/oven-sh/bun",
                 "registryUrl": "https://registry.npmjs.org",
                 "homepage": "https://bun.com",
                 "mostRecentTimestamp": "2026-05-13T04:02:43.309Z",
                 "isAbandoned": false,
                 "currentVersion": "1.3.6",
                 "currentVersionTimestamp": "2026-01-13T02:30:59.090Z",
                 "currentVersionAgeInDays": 205,
                 "isSingleVersion": true,
                 "fixedVersion": "1.3.6"
               }
             ],
             "packageFile": ".bun-version"
           }
         ],
         "dockerfile": [
           {
             "deps": [
               {
                 "depName": "docker.io/oven/bun",
                 "packageName": "docker-cache.gitea.t00n.de/oven/bun",
                 "currentValue": "1.3.6",
                 "currentDigest": "sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a",
                 "datasource": "docker",
                 "replaceString": "docker.io/oven/bun:1.3.6@sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a",
                 "autoReplaceStringTemplate": "docker.io/oven/bun:{{#if newValue}}{{newValue}}{{/if}}@{{#if newDigest}}{{newDigest}}{{/if}}",
                 "depType": "final",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "1.3.14",
                     "newValue": "1.3.14",
                     "newMajor": 1,
                     "newMinor": 3,
                     "newPatch": 14,
                     "updateType": "patch",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "newDigest": "sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4",
                     "branchName": "renovate/docker.io-oven-bun-1.x"
                   }
                 ],
                 "versioning": "docker",
                 "warnings": [],
                 "sourceUrl": "https://github.com/oven-sh/bun",
                 "registryUrl": "https://docker-cache.gitea.t00n.de",
                 "lookupName": "oven/bun",
                 "currentVersion": "1.3.6",
                 "isSingleVersion": true,
                 "fixedVersion": "1.3.6"
               }
             ],
             "packageFile": "Dockerfile"
           }
         ],
```

Reviewed-on: #122
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

.bun-version

@@ -0,0 +1 @@
+1.3.14

.editorconfig

@@ -5,3 +5,4 @@ end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
+max_line_length = 80

.gitea/workflows/add-autobump.yaml

@@ -0,0 +1,156 @@
+name: Add autobump
+
+on:
+  workflow_dispatch:
+    inputs:
+      description:
+        description: Description for the package rule
+        required: true
+        type: string
+      ecosystem:
+        description: Ecosystem
+        required: true
+        type: choice
+        options:
+          - action
+          - golang
+          - bun-npm
+      matchUpdateType:
+        description: Update type to allow
+        required: true
+        type: choice
+        default: major
+        options:
+          - major
+          - minor
+          - patch
+      matchPackageName:
+        description: Package name to allow autobump for
+        required: true
+        type: string
+      matchNewValue:
+        description: New value pattern (e.g. v7.* or v7.0.0)
+        required: true
+        type: string
+
+jobs:
+  allow-autobump:
+    name: Allow autobump
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: ".bun-version"
+      - run: bun install --frozen-lockfile
+      - name: Add package rule
+        id: rule
+        env:
+          DESCRIPTION: ${{ inputs.description }}
+          ECOSYSTEM: ${{ inputs.ecosystem }}
+          MATCH_UPDATE_TYPE: ${{ inputs.matchUpdateType }}
+          MATCH_PACKAGE_NAME: ${{ inputs.matchPackageName }}
+          MATCH_NEW_VALUE: ${{ inputs.matchNewValue }}
+        run: |
+          set -euo pipefail
+
+          FILE="${ECOSYSTEM}.json"
+          if [[ ! -f "${FILE}" ]]; then
+            echo "::error::Config file ${FILE} does not exist"
+            exit 1
+          fi
+
+          MATCH_MANAGERS="$(jq -nc --arg e "${ECOSYSTEM}" '{
+            "action": ["github-actions"],
+            "golang": ["gomod"],
+            "helm": ["helm-values"],
+            "k8s": ["kubernetes"],
+            "bun-npm": ["npm", "bun"],
+            "docker-compose": ["docker-compose"]
+          }[$e]')"
+
+          if [[ "${MATCH_MANAGERS}" == "null" || -z "${MATCH_MANAGERS}" ]]; then
+            echo "::error::Unknown ecosystem: ${ECOSYSTEM}"
+            exit 1
+          fi
+
+          if [[ -z "${DESCRIPTION}" ]]; then
+            DESCRIPTION="Automerge ${MATCH_UPDATE_TYPE} updates for ${MATCH_PACKAGE_NAME} to ${MATCH_NEW_VALUE}"
+          fi
+
+          jq \
+            --arg desc "${DESCRIPTION}" \
+            --argjson managers "${MATCH_MANAGERS}" \
+            --arg updateType "${MATCH_UPDATE_TYPE}" \
+            --arg packageName "${MATCH_PACKAGE_NAME}" \
+            --arg newValue "${MATCH_NEW_VALUE}" \
+            '
+            .packageRules = ((.packageRules // []) + [{
+              description: $desc,
+              matchManagers: $managers,
+              matchUpdateTypes: [$updateType],
+              matchPackageNames: [$packageName],
+              matchNewValue: $newValue,
+              automerge: true,
+              platformAutomerge: true,
+              automergeType: "pr",
+              addLabels: ["automerge"]
+            }])
+            ' "${FILE}" > "${FILE}.tmp"
+          mv "${FILE}.tmp" "${FILE}"
+
+          SAFE_PKG="$(printf '%s' "${MATCH_PACKAGE_NAME}" | tr '/:' '--' | tr -cd '[:alnum:]._-')"
+          SAFE_VAL="$(printf '%s' "${MATCH_NEW_VALUE}" | tr '/:*' '---' | tr -cd '[:alnum:]._-')"
+          BRANCH="chore/allow-autobump-${ECOSYSTEM}-${SAFE_PKG}-${SAFE_VAL}"
+          TITLE="feat(${ECOSYSTEM}): allow automerge of ${MATCH_PACKAGE_NAME} ${MATCH_NEW_VALUE}"
+
+          {
+            echo "file=${FILE}"
+            echo "branch=${BRANCH}"
+            echo "title=${TITLE}"
+            echo "description=${DESCRIPTION}"
+          } >> "${GITHUB_OUTPUT}"
+      - run: bun run fmt
+      - name: Create pull request
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          FILE: ${{ steps.rule.outputs.file }}
+          BRANCH: ${{ steps.rule.outputs.branch }}
+          TITLE: ${{ steps.rule.outputs.title }}
+          DESCRIPTION: ${{ steps.rule.outputs.description }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+
+          git config user.name "gitea-actions"
+          git config user.email "gitea-actions@noreply.local"
+
+          git checkout -b "${BRANCH}"
+          git add "${FILE}"
+          git commit -m "${TITLE}"
+          git push -u origin "HEAD:${BRANCH}"
+
+          BODY="$(printf 'Allow Renovate to automerge updates matching:\n\n- **Ecosystem:** `%s`\n- **Package:** `%s`\n- **Update type:** `%s`\n- **New value:** `%s`\n\n%s\n' \
+            "${{ inputs.ecosystem }}" \
+            "${{ inputs.matchPackageName }}" \
+            "${{ inputs.matchUpdateType }}" \
+            "${{ inputs.matchNewValue }}" \
+            "${DESCRIPTION}")"
+
+          RESPONSE="$(curl -sfS -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${SERVER_URL}/api/v1/repos/${REPOSITORY}/pulls" \
+            -d "$(jq -n \
+              --arg title "${TITLE}" \
+              --arg head "${BRANCH}" \
+              --arg base "${DEFAULT_BRANCH}" \
+              --arg body "${BODY}" \
+              '{title: $title, head: $head, base: $base, body: $body}')")"
+
+          PR_URL="$(printf '%s' "${RESPONSE}" | jq -r '.html_url')"
+          echo "Created pull request: ${PR_URL}"

.gitea/workflows/cd.yaml

@@ -4,6 +4,14 @@ on:
   push:
     branches:
       - main
+    paths:
+      - "action.json"
+      - "bun-npm.json"
+      - "common.json"
+      - "docker-compose.json"
+      - "golang.json"
+      - "helm.json"
+      - "k8s.json"
   workflow_dispatch:
 
 jobs:
@@ -11,15 +19,15 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@b8806ee0141a44be30e8734dff15001361be100c # 0.1.35
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@a4f52386bae401ac7a1b20d5706b861a66b833ca # 0.1.44
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: ${{ github.event_name == 'workflow_dispatch' }}
-      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
+      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@6cf63eee9ef1b152172e0b296c059729ff8f4bda # 0.2.14
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -1,7 +1,9 @@
 name: CI
 
 on:
-  pull_request:
+  push:
+    branches-ignore:
+      - main
 
 jobs:
   test:
@@ -16,9 +18,22 @@ jobs:
           - "common.json"
           - "docker-compose.json"
           - "bun-npm.json"
+          - "golang.json"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Validate "${{ matrix.json-file }}"
-        uses: https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action@6bf2c1355ac4430a6fb77befd36fb95243fcaa3a # 0.1.12
+        uses: https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action@a366444ba0a3ee3bcaf5254238fd7d76dba75e57 # 0.1.14
         with:
           json-file: "./${{ matrix.json-file }}"
+
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: ".bun-version"
+      - run: bun install --frozen-lockfile
+      - name: Check formatting
+        run: bun run fmt:check

.gitignore

@@ -0,0 +1,2 @@
+# dependencies (bun install)
+node_modules

.oxfmtrc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "ignorePatterns": []
+}

action.json

@@ -1,44 +1,112 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["local>t.behrendt/renovate-configs:common", "helpers:pinGitHubActionDigests"],
+  "extends": [
+    "local>t.behrendt/renovate-configs:common",
+    "helpers:pinGitHubActionDigests"
+  ],
   "packageRules": [
     {
       "matchManagers": ["github-actions"],
       "addLabels": ["deps", "action"]
     },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "actions"
+    },
     {
       "matchManagers": ["github-actions"],
       "matchUpdateTypes": ["minor", "patch"],
       "matchPackageNames": [
-        "https://gitea.t000-n.de/t.behrendt/actions/*",
-        "https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment",
-        "https://gitea.t000-n.de/t.behrendt/k_deploy_workflows",
-        "https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action",
-        
         "actions/checkout",
         "actions/cache",
         "actions/cache/*",
         "actions/setup-go",
-
         "azure/setup-kubectl",
         "azure/setup-helm",
         "azure/k8s-set-context",
         "azure/k8s-create-secret",
         "azure/k8s-deploy",
         "azure/k8s-lint",
-        
         "helmfile/helmfile-action",
-
         "docker/setup-buildx-action",
         "docker/login-action",
         "docker/build-push-action",
-
         "oven-sh/setup-bun"
       ],
       "automerge": true,
       "platformAutomerge": true,
       "automergeType": "pr",
       "addLabels": ["automerge"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchPackageNames": [
+        "t.behrendt/actions",
+        "t.behrendt/actions/*",
+        "t.behrendt/conventional-semantic-git-tag-increment",
+        "t.behrendt/k_deploy_workflows",
+        "t.behrendt/validate-json-by-json-schema-action"
+      ],
+      "matchRegistryUrls": ["https://gitea.t000-n.de/**"],
+      "automerge": true,
+      "platformAutomerge": true,
+      "automergeType": "pr",
+      "addLabels": ["automerge"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "matchPackageNames": ["actions/checkout"],
+      "matchNewValue": "v7.0.0",
+      "automerge": true,
+      "platformAutomerge": true,
+      "automergeType": "pr",
+      "addLabels": ["automerge"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "matchPackageNames": ["actions/cache"],
+      "matchNewValue": "v6.0.0",
+      "automerge": true,
+      "platformAutomerge": true,
+      "automergeType": "pr",
+      "addLabels": ["automerge"]
+    },
+    {
+      "description": "Automerge major updates for actions/setup-node to v7.0.0",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "matchPackageNames": ["actions/setup-node"],
+      "matchNewValue": "v7.*",
+      "automerge": true,
+      "platformAutomerge": true,
+      "automergeType": "pr",
+      "addLabels": ["automerge"]
+    },
+    {
+      "description": "Automerge major updates for actions/setup-go to v7",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "matchPackageNames": ["actions/setup-go"],
+      "matchNewValue": "v7.*",
+      "automerge": true,
+      "platformAutomerge": true,
+      "automergeType": "pr",
+      "addLabels": ["automerge"]
+    },
+    {
+      "description": "Automerge major updates for azure/k8s-deploy to v7",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "matchPackageNames": ["azure/k8s-deploy"],
+      "matchNewValue": "v7.*",
+      "automerge": true,
+      "platformAutomerge": true,
+      "automergeType": "pr",
+      "addLabels": ["automerge"]
     }
   ]
 }

bun-npm.json

@@ -3,18 +3,31 @@
   "extends": ["local>t.behrendt/renovate-configs:common"],
   "packageRules": [
     {
-      "description": "Group all minor and patch updates together",
+      "matchManagers": ["npm", "bun"],
-      "groupName": "all non-major dependencies",
+      "addLabels": ["deps", "npm"]
-      "groupSlug": "all-minor-patch",
+    },
+    {
+      "description": "Group all minor and patch runtime dependency updates together",
+      "groupName": "dependencies(non-major)",
+      "groupSlug": "dependencies",
+      "matchDepTypes": ["dependencies"],
       "matchUpdateTypes": ["minor", "patch"],
       "matchManagers": ["npm", "bun"]
     },
     {
-      "description": "Group Bun releases",
+      "description": "Group all minor and patch development dependency updates together",
+      "groupName": "devDependencies (non-major)",
+      "groupSlug": "dev-dependencies",
+      "matchDepTypes": ["devDependencies"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": ["npm", "bun"]
+    },
+    {
+      "description": "Group Bun runtime version",
       "groupName": "bun version",
       "groupSlug": "bun-version",
-      "matchDatasources": ["github-tags", "docker"],
+      "matchManagers": ["bun-version", "dockerfile"],
-      "matchPackageNames": ["docker.io/oven/bun", "oven-sh/bun", "Bun"]
+      "matchDepNames": ["Bun", "docker.io/oven/bun"]
     }
   ]
 }

bun.lock

@@ -0,0 +1,55 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "renovate-configs",
+      "devDependencies": {
+        "oxfmt": "0.61.0",
+      },
+    },
+  },
+  "packages": {
+    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.61.0", "", { "os": "android", "cpu": "arm" }, "sha512-BaS+1OVvg9sr+Xav0+KdWedQRcAzrdoEcwMZeqoc2F6ieC1s/t5eM35YQoRPQ7vAqkZ+p3tbQb1r9I9mrV5oGA=="],
+
+    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.61.0", "", { "os": "android", "cpu": "arm64" }, "sha512-of8atAV0M1egGcVOMbgZCvc10sFOP3ayQBNQV5h5G3fNq8gACdEswfFk9bzGrdbM23rtg0Coxi7np7oPLcueNw=="],
+
+    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.61.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-7l8+5ov4BGwtAcmpzvEik/TG3bciwyw/S3e6j5GKH7pcQqcgCVxD3AuJeP6upto+SOTBKQ4wrrdbMt0gq8fHSQ=="],
+
+    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.61.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Fnz4dDDXBb7udk+DmwelNjxbD6yptyxwCqwCH2ebo4RVLxVsRfFsn/AHJC49KIltPrVokamGv4SSOsiV50DTxQ=="],
+
+    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.61.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-mddOebKNCP+AucmzfNsk3jgbr681qAUvgMqi865GW5gWLJ/AnzXbvjQRrny0e++NAN8aphav/aRSrfFxNsNjpA=="],
+
+    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.61.0", "", { "os": "linux", "cpu": "arm" }, "sha512-svx59iYL+DbaZGZUIoice4W0CjRXGExnbz7Re+awIb60rVxBS2KrU7Hnlx+nZYanLGLpjneUEgo/VFEKkSZAyQ=="],
+
+    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.61.0", "", { "os": "linux", "cpu": "arm" }, "sha512-BYK9MPJPCf6d+fLKMTruThmEyCtHzQ1zLcsrTlUVkmnoXIaHAbfpeLYQwX1tkjs7W11dyzoi6HFvKcdnvX1zNg=="],
+
+    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.61.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-QUaCNLq2/EC6G5ljOuFanl9Lgw6ZWp4co7rs4+KOMUzbGfA4Lq58FHRjjF9sVIG+93XSbo343MxFATrOU1qctA=="],
+
+    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.61.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-S6uvJ6MXnRXl+zTs0CARNDvkE+cymj0EVWEKKsyKnlLlqTyQJBjw5s4D2pSIOZc+S46cy4STefzcr/sm0VzVPA=="],
+
+    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.61.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-6VDlRcytvZG6UlSIdAFKDLbppo9tvPxrWzle6vHldYFMeuDPQEfMKrkwezp7FaBq1wik9ra554ZZeRPsyIkFpg=="],
+
+    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.61.0", "", { "os": "linux", "cpu": "none" }, "sha512-KkBTYbzExpbmn15XjKPLu2fRV2PVlq+KWt+brad5rwIa03vdYoaDRWiS7raHII/dCTR6Ro4UpYUCH4t6lif4WQ=="],
+
+    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.61.0", "", { "os": "linux", "cpu": "none" }, "sha512-69tzIq7sJLVB9dxYYtvMzcSSsnZHSO+U2U19O2RqDqgj6+Q4O7HjSXdaszbcgqzhsUwzSH7z5kWvk8nmf6BHTg=="],
+
+    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.61.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-Oqi/N0OvtOVXsPKAOOhKgGH3msRYF8BLJaNBbWiupRiKoKVyc8JRKPCfarkQJC+RgP9U8raUKLe+bNwd0HUMiA=="],
+
+    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.61.0", "", { "os": "linux", "cpu": "x64" }, "sha512-3TKwv/ed4uwJSemAA8P9XcoqETpjQI4waquF9UilhA9Mn/dhr1PdUEXWlL74mtc6ZNfmKPA9+NEJm01nRF8CVA=="],
+
+    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.61.0", "", { "os": "linux", "cpu": "x64" }, "sha512-uFso4u4nLkVSlMCpgjyvWV60Gt7GvDQHnk1mmRxHIkZTMB0ljpUKwCD9FYGgN9H97x2wYl0UwEjgRZaPIuhEhw=="],
+
+    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.61.0", "", { "os": "none", "cpu": "arm64" }, "sha512-keGLkzeOvkMpNmPp4hffXWpfoSsY6e1K8++KXD4mSSfxdvM8q9QUDsYY689TB1k6Co832DZn1MnaaVx6cIBMWQ=="],
+
+    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.61.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-VzsAISkFxmNhJ5LBDEL9VuH6tJsVJMtqYit2LyIUf/HLnsCe4Pg9SMOjjVQzGWt0bnpyfJ94CrqTqcpNZzK+ug=="],
+
+    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.61.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-xv4t7yzwJoYaLB6Zv28B3W+j7brEjsyv50rLTAQgmxJzddce9fAMCxed8dSAkbWES0zz2J29nYK5FaTuD2YBHg=="],
+
+    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.61.0", "", { "os": "win32", "cpu": "x64" }, "sha512-6EZXFkqOwxdDYjIn3TSNnPk3ST5E5GiYd4FiM6UF/mCL/LZSfr6D6UygTfW3R1PCQP2quCKpCEGRlij8E3VYbg=="],
+
+    "oxfmt": ["oxfmt@0.61.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.61.0", "@oxfmt/binding-android-arm64": "0.61.0", "@oxfmt/binding-darwin-arm64": "0.61.0", "@oxfmt/binding-darwin-x64": "0.61.0", "@oxfmt/binding-freebsd-x64": "0.61.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.61.0", "@oxfmt/binding-linux-arm-musleabihf": "0.61.0", "@oxfmt/binding-linux-arm64-gnu": "0.61.0", "@oxfmt/binding-linux-arm64-musl": "0.61.0", "@oxfmt/binding-linux-ppc64-gnu": "0.61.0", "@oxfmt/binding-linux-riscv64-gnu": "0.61.0", "@oxfmt/binding-linux-riscv64-musl": "0.61.0", "@oxfmt/binding-linux-s390x-gnu": "0.61.0", "@oxfmt/binding-linux-x64-gnu": "0.61.0", "@oxfmt/binding-linux-x64-musl": "0.61.0", "@oxfmt/binding-openharmony-arm64": "0.61.0", "@oxfmt/binding-win32-arm64-msvc": "0.61.0", "@oxfmt/binding-win32-ia32-msvc": "0.61.0", "@oxfmt/binding-win32-x64-msvc": "0.61.0" }, "peerDependencies": { "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-DxdHBEMYpcEnHoUHjjOigUqV2TYKsvxLwUPXnVYBjgFdqrcQ/91OtwubtZ2PUodCs3sStI8R5Qw3fKNGK4e8wQ=="],
+
+    "tinypool": ["tinypool@2.1.0", "", {}, "sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw=="],
+  }
+}

common.json

@@ -2,20 +2,33 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "dependencyDashboard": true,
   "semanticCommits": "enabled",
-  "extends": ["config:best-practices", ":semanticCommitTypeAll(chore)"],
+  "extends": [
+    "config:recommended",
+    "docker:pinDigests",
+    "helpers:pinGitHubActionDigests",
+    ":configMigration",
+    ":pinDevDependencies",
+    "abandonments:recommended",
+    ":maintainLockFilesWeekly",
+    ":semanticCommitTypeAll(chore)"
+  ],
   "packageRules": [
     {
-      "description": "Don't update dependencies unless they are at least 7 days old",
+      "description": "Don't update dependencies unless they are at least 7 days old (except for internal deps).",
-      "matchPackageNames": ["*"],
+      "matchPackageNames": ["!t.behrendt/**", "!gitea.t000-n.de/t.behrendt/**"],
       "minimumReleaseAge": "7 days",
       "minimumReleaseAgeBehaviour": "timestamp-required",
       "internalChecksFilter": "strict"
-    },
-    {
-      "description": "Exempt local dependencies from the minimum release age (last rule wins over earlier packageRules for the same options)",
-      "matchPackageNames": ["/^(https:\\/\\/)?gitea\\.t000-n\\.de/"],
-      "minimumReleaseAge": "0 days",
-      "internalChecksFilter": "none"
     }
-  ]
+  ],
+  "osvVulnerabilityAlerts": true,
+  "dependencyDashboardOSVVulnerabilitySummary": "all",
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "automerge": true,
+    "platformAutomerge": true,
+    "automergeType": "pr",
+    "addLabels": ["automerge", "security"],
+    "vulnerabilityFixStrategy": "lowest"
+  }
 }

golang.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>t.behrendt/renovate-configs:common"],
+  "packageRules": [
+    {
+      "matchManagers": ["gomod"],
+      "addLabels": ["deps", "go"],
+      "postUpgradeOptions": ["goModTidy"]
+    },
+    {
+      "matchPackageNames": ["golang", "gomod", "go"],
+      "groupName": "go version",
+      "matchUpdateTypes": ["major", "minor", "patch"]
+    }
+  ]
+}

helm.json

@@ -8,7 +8,8 @@
     {
       "matchManagers": ["helm-values"],
       "versioning": "docker",
-      "separateMinorPatch": true
+      "separateMinorPatch": true,
+      "addLabels": ["deps", "helm"]
     }
   ],
   "helmfile": {

k8s.json

@@ -4,5 +4,17 @@
   "kubernetes": {
     "enabled": true,
     "labels": ["deps", "k8s"]
+  },
+  "packageRules": [
+    {
+      "description": "Replace git-commit image tags with semver tags for backupsidecar",
+      "matchDatasources": ["docker"],
+      "matchManagers": ["kubernetes"],
+      "matchPackageNames": ["gitea.t000-n.de/t.behrendt/backupsidecar"],
+      "matchCurrentValue": "/^[a-f0-9]{40}$/",
+      "replacementVersion": "0.2.17",
+      "versioning": "semver",
+      "pinDigests": true
     }
+  ]
 }

package.json

@@ -0,0 +1,11 @@
+{
+  "name": "renovate-configs",
+  "private": true,
+  "scripts": {
+    "fmt": "oxfmt -c .oxfmtrc.json",
+    "fmt:check": "oxfmt -c .oxfmtrc.json --check"
+  },
+  "devDependencies": {
+    "oxfmt": "0.61.0"
+  }
+}

renovate.json

@@ -1,6 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>t.behrendt/renovate-configs:action"
+    "local>t.behrendt/renovate-configs:action",
+    "local>t.behrendt/renovate-configs:bun-npm"
   ]
 }