{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "registryAliases": {
        "harbor.okwilkins.dev/docker-hub-cache": "index.docker.io",
        "harbor.okwilkins.dev/ghcr-cache": "ghcr.io"
    },
    "dependencyDashboard": true,
    "automerge": false,
    "prHourlyLimit": 0,
    "prConcurrentLimit": 0,
    "argocd": {
        "managerFilePatterns": [
            "/ci-cd/argocd/.*/.*\\.ya?ml$/"
        ]
    },
    "kubernetes": {
        "managerFilePatterns": [
            "/.*\\.yaml$/",
            "/.*\\.yml$/"
        ],
        "ignorePaths": [
            "infrastructure/",
            "**/docker-compose*.yaml"
        ]
    },
    "terraform": {},
    "nix": {
        "enabled": true
    },
    "lockFileMaintenance": {
        "enabled": true
    },
    "customManagers": [
        {
            "customType": "regex",
            "description": "Update Kustomize remote resource URLs",
            "managerFilePatterns": [
                "/.*/kustomization\\.yaml$/"
            ],
            "matchStrings": [
                "-\\s+https://raw\\.githubusercontent\\.com/(?<depName>[^/]+/[^/]+)/(?:refs/tags/)?(?<currentValue>v?\\d[^/]*)/.*"
            ],
            "datasourceTemplate": "github-tags",
            "versioningTemplate": "semver"
        },
        {
            "customType": "regex",
            "description": "Update CloudNativePG PostgreSQL and pgvector images",
            "managerFilePatterns": [
                "/storage/cloudnative-pg/.*\\.yaml$/"
            ],
            "matchStrings": [
                "imageName:\\s+(?<depName>[^\\s:]+):(?<currentValue>[^\\s@]+)(?:@(?<currentDigest>sha256:[a-f0-9]{64}))?",
                "reference:\\s+(?<depName>ghcr\\.io/cloudnative-pg/pgvector):(?<currentValue>\\d+\\.\\d+\\.\\d+-18-trixie)(?:@(?<currentDigest>sha256:[a-f0-9]{64}))?"
            ],
            "depTypeTemplate": "image",
            "datasourceTemplate": "docker",
            "versioningTemplate": "docker"
        },
        {
            "customType": "regex",
            "description": "Update CloudNativePG pgvector extension versions",
            "managerFilePatterns": [
                "/^storage/cloudnative-pg/.*/database\\.yaml$/"
            ],
            "matchStrings": [
                "# renovate: pgvector=18-trixie\\r?\\n(?<indentation>[ \\t]*)version: \\\"(?<extensionVersion>\\d+\\.\\d+\\.\\d+)\\\""
            ],
            "depNameTemplate": "ghcr.io/cloudnative-pg/pgvector",
            "depTypeTemplate": "extension",
            "datasourceTemplate": "docker",
            "versioningTemplate": "docker",
            "currentValueTemplate": "{{{extensionVersion}}}-18-trixie",
            "autoReplaceStringTemplate": "# renovate: pgvector=18-trixie\n{{{indentation}}}version: \"{{{lookup (split newValue '-') 0}}}\""
        },
        {
            "customType": "regex",
            "description": "Update the Talos-managed CoreDNS image",
            "managerFilePatterns": [
                "/^infrastructure/03-talos-configure/main\\.tf$/"
            ],
            "matchStrings": [
                "image\\s*=\\s*\"(?<depName>docker\\.io/coredns/coredns):(?<currentValue>[^\\s\"@]+)(?:@(?<currentDigest>sha256:[a-f0-9]{64}))?\""
            ],
            "datasourceTemplate": "docker",
            "versioningTemplate": "docker"
        },
        {
            "customType": "regex",
            "description": "Update stable nixpkgs channels in the Buildah image",
            "managerFilePatterns": [
                "/^images/image-buildah/flake\\.nix$/"
            ],
            "matchStrings": [
                "nixpkgs\\.url\\s*=\\s*\"github:NixOS/nixpkgs/(?<currentValue>nixos-\\d{2}\\.\\d{2})\""
            ],
            "depNameTemplate": "nixpkgs",
            "packageNameTemplate": "https://github.com/NixOS/nixpkgs",
            "datasourceTemplate": "git-refs",
            "versioningTemplate": "nixpkgs"
        },
        {
            "customType": "regex",
            "description": "Update the Grafana operand version",
            "managerFilePatterns": [
                "/^observability/grafana/environments/prod/grafana\\.yaml$/"
            ],
            "matchStrings": [
                "(?:^|\\r?\\n)  version:\\s*[\"']?(?<currentValue>[^\\s\"']+)"
            ],
            "depNameTemplate": "docker.io/grafana/grafana",
            "datasourceTemplate": "docker",
            "versioningTemplate": "docker"
        },
        {
            "customType": "regex",
            "description": "Update the VictoriaLogs Grafana plugin",
            "managerFilePatterns": [
                "/^observability/grafana/environments/prod/datasources/victorialogs-default\\.yaml$/"
            ],
            "matchStrings": [
                "- name:\\s+victoriametrics-logs-datasource\\s+version:\\s*[\"']?(?<currentValue>[^\\s\"']+)"
            ],
            "depNameTemplate": "victoriametrics-logs-datasource",
            "packageNameTemplate": "VictoriaMetrics/victorialogs-datasource",
            "datasourceTemplate": "github-releases",
            "extractVersionTemplate": "^v(?<version>.*)$",
            "versioningTemplate": "semver"
        }
    ],
    "packageRules": [
        {
            "description": "Update the pgvector image and SQL extension together, retaining PostgreSQL 18 and Trixie compatibility",
            "matchPackageNames": [
                "ghcr.io/cloudnative-pg/pgvector"
            ],
            "allowedVersions": "/^[0-9]+\\.[0-9]+\\.[0-9]+-18-trixie$/",
            "groupName": "CloudNativePG pgvector",
            "groupSlug": "cloudnativepg-pgvector"
        },
        {
            "description": "Retain digest pins on the pgvector image, not the SQL extension version",
            "matchPackageNames": [
                "ghcr.io/cloudnative-pg/pgvector"
            ],
            "matchDepTypes": [
                "image"
            ],
            "pinDigests": true
        },
        {
            "description": "Label major updates for manual review",
            "matchUpdateTypes": [
                "major"
            ],
            "labels": [
                "dependencies",
                "major-update"
            ]
        },
        {
            "description": "Keep PostgreSQL images minimal with digest pins; review Debian migrations separately",
            "matchDatasources": [
                "docker"
            ],
            "matchPackageNames": [
                "ghcr.io/cloudnative-pg/postgresql"
            ],
            "allowedVersions": "/^[0-9]+\\.[0-9]+-minimal-[a-z]+$/",
            "pinDigests": true
        },
        {
            "description": "Retain digest pins for the Talos-managed CoreDNS image",
            "matchDatasources": [
                "docker"
            ],
            "matchPackageNames": [
                "docker.io/coredns/coredns"
            ],
            "pinDigests": true
        },
        {
            "description": "Require approval before proposing PostgreSQL major upgrades",
            "matchDatasources": [
                "docker"
            ],
            "matchPackageNames": [
                "ghcr.io/cloudnative-pg/postgresql"
            ],
            "matchUpdateTypes": [
                "major"
            ],
            "dependencyDashboardApproval": true
        },
        {
            "description": "Use regex channel updates while retaining native Nix lock maintenance",
            "matchManagers": [
                "nix"
            ],
            "matchFileNames": [
                "images/image-buildah/flake.nix"
            ],
            "matchPackageNames": [
                "https://github.com/NixOS/nixpkgs"
            ],
            "matchUpdateTypes": [
                "major",
                "minor",
                "patch"
            ],
            "enabled": false
        },
        {
            "description": "Refresh the Buildah flake lock after a stable channel update",
            "matchManagers": [
                "custom.regex"
            ],
            "matchFileNames": [
                "images/image-buildah/flake.nix"
            ],
            "matchPackageNames": [
                "https://github.com/NixOS/nixpkgs"
            ],
            "postUpgradeTasks": {
                "commands": [
                    "nix --extra-experimental-features 'nix-command flakes' flake update nixpkgs"
                ],
                "workingDirTemplate": "{{{packageFileDir}}}",
                "fileFilters": [
                    "images/image-buildah/flake.lock"
                ],
                "executionMode": "update",
                "installTools": {
                    "nix": {}
                }
            }
        },
        {
            "description": "Compare SearxNG release dates while ignoring the commit hash",
            "matchDatasources": [
                "docker"
            ],
            "matchPackageNames": [
                "index.docker.io/searxng/searxng"
            ],
            "versioning": "regex:^(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})-[a-f0-9]+$",
            "minimumReleaseAge": "7 days"
        },
        {
            "description": "Group native updates to the shared bootstrap providers and lock file",
            "matchManagers": [
                "terraform"
            ],
            "matchDatasources": [
                "terraform-provider"
            ],
            "matchFileNames": [
                "infrastructure/shared/providers.tf"
            ],
            "groupName": "bootstrap Terraform providers",
            "groupSlug": "bootstrap-terraform-providers",
            "separateMajorMinor": false
        }
    ]
}