From c14c3d738cfec75238b6ac4ac0c1525816f218d9 Mon Sep 17 00:00:00 2001 From: Neil Galvin Date: Tue, 8 Sep 2026 18:47:02 +0100 Subject: [PATCH] fix(renovate): match annotations separated from default by a type line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The customManager regex anchored `default:` to the line immediately after the `# renovate:` comment. Three inputs carry a `type:` line in between — actionlint-version, betterleaks-version and taplo-version — so their annotations never matched and those pins would never be offered an update. A dashboard with nothing on it looks identical to one where everything is current, so this failed silently. Fixed at both ends. The three annotations move to sit directly above their `default:`, matching the convention the other five already followed. The regex now also tolerates intervening `type:`/`required:` lines so the next input added does not reintroduce the problem, and the surrounding `\s*` is tightened to `[ \t]*` to make the line structure explicit rather than incidental. The skip list stops at `type` and `required` deliberately: both are always single-line scalars, whereas `description:` is often a `|` block, and skipping it would let an annotation bind across arbitrary text to an unrelated `default:` further down the file. Verified 8/8 annotations match, up from 5/8, and confirmed against four shape variants plus two negative cases (description block between; input with no default of its own). The regex uses no lookahead or backreferences, so it stays RE2-compatible. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_016vhsMyme4mZsF49j38WXQB --- .github/workflows/lint-workflows.yml | 2 +- .github/workflows/secret-scan.yml | 2 +- .github/workflows/toml-lint.yml | 2 +- CHANGELOG.md | 19 +++++++++++++++++++ renovate.json | 2 +- 5 files changed, 23 insertions(+), 4 deletions(-) diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml index 9226e11..5a69990 100644 --- a/.github/workflows/lint-workflows.yml +++ b/.github/workflows/lint-workflows.yml @@ -11,8 +11,8 @@ on: type: string default: '["ubuntu-latest"]' actionlint-version: - # renovate: datasource=github-releases depName=rhysd/actionlint type: string + # renovate: datasource=github-releases depName=rhysd/actionlint default: "1.7.12" actionlint-ignore: description: "Newline-separated -ignore patterns. Each becomes one `-ignore PATTERN` arg." diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 5442ae1..e22e5ff 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -17,8 +17,8 @@ on: type: string default: '["ubuntu-latest"]' betterleaks-version: - # renovate: datasource=github-releases depName=betterleaks/betterleaks type: string + # renovate: datasource=github-releases depName=betterleaks/betterleaks default: "1.8.1" config-path: description: "Path to .betterleaks.toml (or a legacy .gitleaks.toml). Empty = betterleaks auto-discovers one in the repo root, else uses defaults." diff --git a/.github/workflows/toml-lint.yml b/.github/workflows/toml-lint.yml index 3902c17..62dcc93 100644 --- a/.github/workflows/toml-lint.yml +++ b/.github/workflows/toml-lint.yml @@ -13,8 +13,8 @@ on: type: string default: '["ubuntu-latest"]' taplo-version: - # renovate: datasource=github-releases depName=tamasfe/taplo type: string + # renovate: datasource=github-releases depName=tamasfe/taplo default: "0.10.0" run-fmt-check: type: boolean diff --git a/CHANGELOG.md b/CHANGELOG.md index e6438bd..99de1df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,25 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags. ## [Unreleased] +### Fixed + +- Renovate's `customManager` now matches every `# renovate:` annotation in + the repo (8 of 8, previously 5). The regex anchored `default:` to the line + *immediately* after the comment, so three inputs that carried a `type:` + line in between — `actionlint-version`, `betterleaks-version` and + `taplo-version` — were silently skipped. Those pins would never have been + offered an update, and a dashboard with nothing on it looks identical to + one where everything is current. + + Two changes, belt and braces: the three annotations moved to sit directly + above their `default:`, matching the convention the other five already + followed; and the regex now tolerates intervening `type:`/`required:` + lines so the next input added does not reintroduce the problem. The skip + list stops at those two keys deliberately — both are always single-line + scalars, whereas `description:` is often a `|` block, and skipping it + would let an annotation bind across arbitrary text to an unrelated + `default:` further down the file. + ## [3.2.1] - 2026-09-01 ### Fixed diff --git a/renovate.json b/renovate.json index 0fb1e81..1d55a9a 100644 --- a/renovate.json +++ b/renovate.json @@ -25,7 +25,7 @@ "description": "Update pinned versions referenced as input defaults", "fileMatch": ["^\\.github/(workflows|actions)/.+\\.ya?ml$"], "matchStrings": [ - "#\\s*renovate:\\s*datasource=(?.+?)\\s+depName=(?.+?)(?:\\s+versioning=(?.+?))?\\s*\\n\\s*default:\\s*[\"']?(?[^\"'\\s]+)" + "#\\s*renovate:\\s*datasource=(?.+?)\\s+depName=(?.+?)(?:\\s+versioning=(?.+?))?[ \\t]*\\n(?:[ \\t]*(?:type|required):[^\\n]*\\n)*[ \\t]*default:[ \\t]*[\"']?(?[^\"'\\s]+)" ] } ]