Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
53 lines
2.1 KiB
JSON
53 lines
2.1 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended"],
|
|
"skipInstalls": true,
|
|
"ignoreScripts": true,
|
|
"ignorePaths": ["**/.github/**", "**/.gitea/**"],
|
|
"osvVulnerabilityAlerts": true,
|
|
"reviewers": ["f.weber"],
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "aptly itself — bump ARG APTLY_VERSION in the server image",
|
|
"managerFilePatterns": ["/^images/aptly-server/Dockerfile$/"],
|
|
"matchStrings": ["ARG APTLY_VERSION=(?<currentValue>\\S+)"],
|
|
"datasourceTemplate": "github-releases",
|
|
"depNameTemplate": "aptly-dev/aptly",
|
|
"extractVersionTemplate": "^v(?<version>.*)$"
|
|
},
|
|
{
|
|
"customType": "regex",
|
|
"description": "yq (config rendering helper baked into the aptly-server image)",
|
|
"managerFilePatterns": ["/^images/aptly-server/Dockerfile$/"],
|
|
"matchStrings": ["ARG YQ_VERSION=(?<currentValue>\\S+)"],
|
|
"datasourceTemplate": "github-releases",
|
|
"depNameTemplate": "mikefarah/yq"
|
|
},
|
|
{
|
|
"customType": "regex",
|
|
"description": "nfpm (deb-builder image)",
|
|
"managerFilePatterns": ["/^images/aptly-deb-builder/Dockerfile$/"],
|
|
"matchStrings": ["ARG NFPM_VERSION=(?<currentValue>\\S+)"],
|
|
"datasourceTemplate": "github-releases",
|
|
"depNameTemplate": "goreleaser/nfpm"
|
|
},
|
|
{
|
|
"customType": "regex",
|
|
"description": "pinned Helm CLI version used across Gitea workflows",
|
|
"managerFilePatterns": ["/^\\.gitea/workflows/.*\\.yaml$/"],
|
|
"matchStrings": ["HELM_VERSION \\|\\| '(?<currentValue>[^']+)'"],
|
|
"datasourceTemplate": "github-releases",
|
|
"depNameTemplate": "helm/helm",
|
|
"extractVersionTemplate": "^v(?<version>.*)$"
|
|
}
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"description": "the yq/nfpm sha256 pins in the Dockerfiles are updated by hand alongside the version bump (see the ARG lines directly above each), not by Renovate — flag PRs so a human re-pins them",
|
|
"matchDepNames": ["mikefarah/yq", "goreleaser/nfpm"],
|
|
"commitMessageSuffix": "(re-pin the matching SHA256_AMD64/ARM64 ARG lines by hand — see images/*/Dockerfile)"
|
|
}
|
|
]
|
|
}
|