{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "skipInstalls": true,
  "ignoreScripts": true,
  "ignorePaths": ["**/.github/**", "**/.gitea/**"],
  "osvVulnerabilityAlerts": true,
  "reviewers": ["f.weber"],
  "customManagers": [
    {
      "customType": "regex",
      "description": "aptly itself — bump ARG APTLY_VERSION in the server image",
      "managerFilePatterns": ["/^images/aptly-server/Dockerfile$/"],
      "matchStrings": ["ARG APTLY_VERSION=(?<currentValue>\\S+)"],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "aptly-dev/aptly",
      "extractVersionTemplate": "^v(?<version>.*)$"
    },
    {
      "customType": "regex",
      "description": "yq (config rendering helper baked into the aptly-server image)",
      "managerFilePatterns": ["/^images/aptly-server/Dockerfile$/"],
      "matchStrings": ["ARG YQ_VERSION=(?<currentValue>\\S+)"],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "mikefarah/yq"
    },
    {
      "customType": "regex",
      "description": "nfpm (deb-builder image)",
      "managerFilePatterns": ["/^images/aptly-deb-builder/Dockerfile$/"],
      "matchStrings": ["ARG NFPM_VERSION=(?<currentValue>\\S+)"],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "goreleaser/nfpm"
    },
    {
      "customType": "regex",
      "description": "pinned Helm CLI version used across Gitea workflows",
      "managerFilePatterns": ["/^\\.gitea/workflows/.*\\.yaml$/"],
      "matchStrings": ["HELM_VERSION \\|\\| '(?<currentValue>[^']+)'"],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "helm/helm",
      "extractVersionTemplate": "^v(?<version>.*)$"
    }
  ],
  "packageRules": [
    {
      "description": "the yq/nfpm sha256 pins in the Dockerfiles are updated by hand alongside the version bump (see the ARG lines directly above each), not by Renovate — flag PRs so a human re-pins them",
      "matchDepNames": ["mikefarah/yq", "goreleaser/nfpm"],
      "commitMessageSuffix": "(re-pin the matching SHA256_AMD64/ARM64 ARG lines by hand — see images/*/Dockerfile)"
    }
  ]
}