CI updates

This is done by the automated script named upgrade-ci-2025

.github/renovate.json5

@@ -1,67 +1,32 @@
 {
-  'extends': ['config:base'],
-  semanticCommits: 'disabled',
-  timezone: 'Europe/Zurich',
-  schedule: 'after 5pm on the first day of the month',
-  labels: ['dependencies'],
-  separateMajorMinor: true,
-  separateMinorPatch: true,
+  'extends': [
+    'github>camptocamp/gs-renovate-config-preset:base.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:group.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:stabilization-branches.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:ci.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:preset.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:pre-commit.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:own.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:json-schema.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:shellcheck.json5#0.8.1',
+  ],
   separateMultipleMajor: true,
-  prHourlyLimit: 0,
-  prConcurrentLimit: 0,
-  lockFileMaintenance: {enabled: true, automerge: true, schedule: 'after 5pm on the first day of the month'},
   baseBranches: ['master', '2.7', '2.8'],
-  'pre-commit': {enabled: true},
-  regexManagers: [
-    /** Do updates on pre-commit additional dependencies */
-    {
-      fileMatch: ['^\\.pre\\-commit\\-config\\.yaml$'],
-      matchStrings: [" +- '?(?<depName>[^' @=]+)(@|==)(?<currentValue>[^' @=]+)'? # (?<datasource>.+)"],
-    },
+  customManagers: [
     {
       fileMatch: ['^ci/applications\\-versions\\.yaml$'],
       matchStrings: ['(?<depName>[^\\s]+): (?<currentValue>[^\\s]+) # (?<datasource>[^\\s]+)'],
+      customType: 'regex',
     },
     {
       fileMatch: ['^.github/workflows/main\\.yaml$'],
       matchStrings: ["node-version: '(?<currentValue>[^\\s]+).x'"],
       depNameTemplate: 'node',
       datasourceTemplate: 'node',
-    },
-    /** Do update on the schema present in the ci/config.yaml */
-    {
-      fileMatch: ['^ci/config\\.yaml$'],
-      matchStrings: [
-        '.*https://raw\\.githubusercontent\\.com/(?<depName>[^\\s]+)/(?<currentValue>[0-9\\.]+)/.*',
-      ],
-      datasourceTemplate: 'github-tags',
-    },
-    /** Python version in actions/setup-python action */
-    {
-      fileMatch: ['^\\.github/workflows/.*\\.yaml$'],
-      matchStrings: [' python-version: [\'"](?<currentValue>[0-9\\.]+)[\'"]'],
-      datasourceTemplate: 'python-version',
-      depNameTemplate: 'python',
+      customType: 'regex',
     },
   ],
   packageRules: [
-    /** Auto merge the dev dependency update */
-    {
-      matchDepTypes: ['devDependencies'],
-      automerge: true,
-    },
-    /** Group and auto merge the patch updates */
-    {
-      matchUpdateTypes: ['patch'],
-      groupName: 'all patch versions',
-      automerge: true,
-    },
-    /** Group and auto merge the minor updates */
-    {
-      matchUpdateTypes: ['minor'],
-      groupName: 'all minor versions',
-      automerge: true,
-    },
     /** Requires dashboard approval for major updates */
     {
       matchUpdateTypes: ['major'],
@@ -73,11 +38,6 @@
       matchUpdateTypes: ['major', 'minor', 'pin', 'digest', 'lockFileMaintenance', 'rollback', 'bump'],
       enabled: false,
     },
-    /** Support the 4 parts of shellcheck-py version with a v prefix */
-    {
-      versioning: 'regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$',
-      matchDepNames: ['shellcheck-py/shellcheck-py'],
-    },
     /** Group Webpack dependencies */
     {
       matchPackageNames: [
@@ -92,12 +52,6 @@
       automerge: true,
       separateMultipleMajor: false,
     },
-    /** Group and auto merge the CI dependencies */
-    {
-      matchFileNames: ['.github/**', '.pre-commit-config.yaml', 'ci/**'],
-      groupName: 'CI dependencies',
-      automerge: true,
-    },
     /** Packages published very recently are not pushed to stabilization branches for security reasons */
     {
       matchBaseBranches: ['/^[0-9]+\\.[0-9]+$/'],
@@ -109,10 +63,10 @@
       matchDepNames: ['cheerio'],
       enabled: false,
     },
-    /** Ungroup Python dependencies */
+    /** In file `.python-version`, use the `<major>.<minor>` version */
     {
-      matchDepNames: ['python'],
-      groupName: 'Python',
+      matchFileNames: ['.python-version'],
+      versioning: 'regex:^(?<major>\\d+)\\.(?<minor>\\d+)$',
     },
   ],
 }

.github/workflows/main.yaml

@@ -11,6 +11,9 @@ on:
   pull_request_target:
     types: [labeled]
 
+permissions:
+  contents: write
+
 env:
   HAS_SECRETS: ${{ secrets.HAS_SECRETS }}
   MAIN_BRANCH: master
@@ -79,8 +82,8 @@ jobs:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
           restore-keys: "pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}\npre-commit-"
-      - run: pre-commit run --all-files
-      - run: git diff --exit-code --patch > /tmp/pre-commit.patch || true
+      - run: pre-commit run --all-files --color=always
+      - run: git diff --exit-code --patch > /tmp/pre-commit.patch; git diff --color; git reset --hard || true
         if: failure()
       - uses: actions/upload-artifact@v4
         with:

.pre-commit-config.yaml

@@ -73,9 +73,6 @@ repos:
     rev: 0.31.1
     hooks:
       - id: check-github-workflows
-      - id: check-renovate
-        additional_dependencies:
-          - pyjson5==1.6.8 # pypi
       - id: check-github-actions
       - id: check-jsonschema
         name: Check GitHub Workflows set timeout-minutes
@@ -134,7 +131,11 @@ repos:
     rev: 0.3.2
     hooks:
       - id: jsonschema-validator
-        files: ^ci/config\.yaml$
+        files: |-
+          (?x)^(
+            \.github/ghci\.yaml
+            |ci/applications\.yaml
+          )$
   - repo: https://github.com/renovatebot/pre-commit-hooks
     rev: 38.142.7
     hooks: