Switch to Renovate from Dependabot for remaining dependencies (#9459)

jenkinsci · Aug 7, 2024 · 9b1b1c6 · 9b1b1c6
1 parent a0edba4
commit 9b1b1c6
Show file tree

Hide file tree

Showing 6 changed files with 103 additions and 76 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
diff --git a/.github/renovate.json b/.github/renovate.json
@@ -1,63 +1,154 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
+    "config:recommended",
     ":disableDependencyDashboard",
     ":semanticCommitsDisabled"
   ],
-  "enabledManagers": ["npm", "regex"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 0,
   "postUpdateOptions": ["yarnDedupeHighest"],
+  "baseBranches": ["master", "stable-2.462"],
   "packageRules": [
+    {
+      "matchBaseBranches": ["/stable-.+/"],
+      "matchManagers": ["maven"],
+      "labels": ["dependencies", "into-lts", "needs-justification"]
+    },
+    {
+      "matchBaseBranches": ["/stable-.+/"],
+      "matchManagers": ["custom.regex", "npm", "github-actions"],
+      "enabled": false
+    },
     {
       "matchDatasources": ["npm"],
       "addLabels": ["javascript"],
-      "stabilityDays": 3,
+      "minimumReleaseAge": "3 days",
       "reviewers": ["team:sig-ux"]
     },
     {
       "matchPackageNames": ["node"],
       "allowedVersions": "/20.[0-9]+.[0-9]+(.[0-9]+)?$/"
+    },
+    {
+      "description": "Should be upgraded in lockstep in order to keep their corresponding Jetty versions aligned, could be grouped but releases are likely separated by a bit of time",
+      "matchManagers": ["maven"],
+      "enabled": false,
+      "matchPackageNames": [
+        "org.eclipse.jetty:jetty-maven-plugin", "org.jenkins-ci:winstone"
+      ]
+    },
+    {
+      "description": "Provided by Jetty and should be aligned with the version provided by the version of Jetty we deliver. See: https://github.com/jenkinsci/jenkins/pull/5211",
+      "matchManagers": ["maven"],
+      "enabled": false,
+      "matchPackageNames": ["jakarta.servlet:jakarta.servlet-api"]
+    },
+    {
+      "description": "Contains incompatible API changes and needs compatibility work",
+      "matchManagers": ["maven"],
+      "enabled": false,
+      "matchPackageNames": [
+        "jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api"
+      ]
+    },
+    {
+      "description": "Needs significant testing. See: https://github.com/jenkinsci/jenkins/pull/5112#issuecomment-744429487 and https://github.com/jenkinsci/jenkins/pull/5116#issuecomment-744526638",
+      "matchManagers": ["maven"],
+      "allowedVersions": "<2.5.0",
+      "matchPackageNames": ["org.codehaus.groovy:groovy-all"]
+    },
+    {
+      "description": "Consumed by Groovy and should be updated in lockstep with Groovy. See: https://github.com/jenkinsci/jenkins/pull/5184",
+      "matchManagers": ["maven"],
+      "enabled": false,
+      "matchPackageNames": ["org.fusesource.jansi:jansi"]
+    },
+    {
+      "description": "Contains incompatible API changes and needs compatibility work. See: https://github.com/jenkinsci/jenkins/pull/4224",
+      "matchManagers": ["maven"],
+      "enabled": false,
+      "matchPackageNames": ["org.jfree:jfreechart"]
+    },
+    {
+      "description": "Starting with 6.x, Spring requires Java 17 at a minimum.",
+      "matchManagers": ["maven"],
+      "allowedVersions": "<6.0.0",
+      "matchPackageNames": ["org.springframework:spring-framework-bom", "org.springframework.security:spring-security-bom"]
+    },
+    {
+      "description": "Starting with 7.x, Guice switches from javax.* to jakarta.* bindings. See https://github.com/google/guice/wiki/Guice700",
+      "matchManagers": ["maven"],
+      "allowedVersions": "<7.0.0",
+      "matchPackageNames": ["com.google.inject:guice-bom"]
+    },
+    {
+      "matchFileNames": ["test/pom.xml", "core/pom.xml", "war/pom.xml"],
+      "matchPackageNames": ["org.jenkins-ci.main:remoting"],
+      "description": "Avoid updating the remoting.minimum.supported.version property but still update latest one by not placing this property in the parent pom.xml",
+      "enabled": false
+    },
+    {
+      "matchPackageNames": ["net.jcip:jcip-annotations"],
+      "matchDatasources": ["maven"],
+      "enabled": false,
+      "description": "maven-metadata.xml is missing for this really old package which is required by renovate"
     }
   ],
-  "regexManagers": [
+  "customManagers": [
     {
+      "customType": "regex",
       "fileMatch": ["war/pom.xml"],
       "matchStrings": ["<node.version>(?<currentValue>.*?)</node.version>"],
       "depNameTemplate": "node",
       "datasourceTemplate": "npm"
     },
     {
+      "customType": "regex",
       "fileMatch": ["ath.sh"],
       "matchStrings": ["export ATH_VERSION=(?<currentValue>.*?)\n"],
       "depNameTemplate": "jenkins/ath",
       "datasourceTemplate": "docker",
       "versioningTemplate": "loose"
     },
     {
+      "customType": "regex",
       "fileMatch": [".gitpod/Dockerfile"],
       "matchStrings": ["ARG MAVEN_VERSION=(?<currentValue>.*?)\n"],
       "depNameTemplate": "org.apache.maven:maven-core",
       "datasourceTemplate": "maven"
     },
     {
+      "customType": "regex",
       "fileMatch": ["core/src/site/site.xml"],
       "matchStrings": ["lit@(?<currentValue>.*?)/"],
       "depNameTemplate": "lit",
       "datasourceTemplate": "npm"
     },
     {
+      "customType": "regex",
       "fileMatch": ["core/src/site/site.xml"],
       "matchStrings": ["webcomponentsjs@(?<currentValue>.*?)/"],
       "depNameTemplate": "@webcomponents/webcomponentsjs",
       "datasourceTemplate": "npm"
     },
     {
+      "customType": "regex",
       "fileMatch": ["core/src/site/site.xml"],
-      "matchStrings": ["<version>(?<currentValue>.*?)<\/version>"],
+      "matchStrings": ["<version>(?<currentValue>.*?)</version>"],
       "depNameTemplate": "org.apache.maven.skins:maven-fluido-skin",
       "datasourceTemplate": "maven"
     }
   ],
   "labels": ["dependencies", "skip-changelog"],
-  "rebaseWhen": "conflicted"
+  "rebaseWhen": "conflicted",
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/examples/**",
+    "**/__tests__/**",
+    "**/tests/**",
+    "**/__fixtures__/**"
+  ]
 }
diff --git a/core/pom.xml b/core/pom.xml
@@ -40,6 +40,8 @@ THE SOFTWARE.
 
   <properties>
     <xmlunit.version>2.10.0</xmlunit.version>
+    <!-- Minimum Remoting version, which is tested for API compatibility, duplicated so that renovate only updates the latest remoting version property -->
+    <remoting.minimum.supported.version>3107.v665000b_51092</remoting.minimum.supported.version>
     <!-- Filled in by jacoco-maven-plugin -->
     <jacocoSurefireArgs />
   </properties>

diff --git a/pom.xml b/pom.xml
@@ -88,8 +88,6 @@ THE SOFTWARE.
 
     <!-- Bundled Remoting version -->
     <remoting.version>3256.3258.v858f3c9a_f69d</remoting.version>
-    <!-- Minimum Remoting version, which is tested for API compatibility -->
-    <remoting.minimum.supported.version>3107.v665000b_51092</remoting.minimum.supported.version>
 
     <spotbugs.effort>Max</spotbugs.effort>
     <spotbugs.threshold>Medium</spotbugs.threshold>

diff --git a/test/pom.xml b/test/pom.xml
@@ -38,6 +38,8 @@ THE SOFTWARE.
 
   <properties>
     <mavenDebug>false</mavenDebug>
+    <!-- Minimum Remoting version, which is tested for API compatibility, duplicated so that renovate only updates the latest remoting version property -->
+    <remoting.minimum.supported.version>3107.v665000b_51092</remoting.minimum.supported.version>
     <!-- Filled in by jacoco-maven-plugin -->
     <jacocoSurefireArgs />
     <!--

diff --git a/war/pom.xml b/war/pom.xml
@@ -47,6 +47,8 @@ THE SOFTWARE.
     <!-- HTTP listener port -->
     <port>8080</port>
     <mina-sshd-api.version>2.13.1-117.v2f1a_b_66ff91d</mina-sshd-api.version>
+    <!-- Minimum Remoting version, which is tested for API compatibility, duplicated so that renovate only updates the latest remoting version property -->
+    <remoting.minimum.supported.version>3107.v665000b_51092</remoting.minimum.supported.version>
     <node.version>20.16.0</node.version>
     <!-- frontend-maven-plugin will install this Yarn version as bootstrap, then hand over control to Yarn Berry. -->
     <yarn.version>1.22.19</yarn.version>