[ENG-1702] Renovate: track Earthfile tool pins, the lunar-scripts base and GitHub Actions

.github/renovate.json5

@@ -0,0 +1,51 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  // Same shape as earthly/actions-setup, earthly/earthly and earthly/dind.
+  extends: ['config:recommended'],
+  configMigration: true,
+  prHourlyLimit: 2,
+  schedule: ['after 6am on monday'], // utc
+  labels: ['renovate'],
+  // Earthfiles are Dockerfiles for FROM purposes: golang:/python:/alpine: builder
+  // images and the earthly/lunar-scripts:$SCRIPTS_VERSION base (ARG-resolved).
+  dockerfile: {
+    managerFilePatterns: ['/(^|/)Earthfile$/'],
+  },
+  customManagers: [
+    {
+      // Every bundled tool is an `ARG <TOOL>_VERSION=<x>` pin in an Earthfile.
+      // Tag it with `# renovate: datasource=<ds> depName=<name> [extractVersion=…]`
+      // on the line above and Renovate keeps it current.
+      customType: 'regex',
+      managerFilePatterns: ['/(^|/)Earthfile$/'],
+      matchStrings: [
+        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+ARG [A-Z0-9_]+=(?<currentValue>[^\\s]+)',
+      ],
+      versioningTemplate: '{{#if versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}',
+    },
+  ],
+  packageRules: [
+    {
+      // The helm collector is validated on Helm 3; Helm 4 is a deliberate migration.
+      matchDepNames: ['helm/helm'],
+      allowedVersions: '<4',
+    },
+    {
+      // All six lunar-scripts references (alpine base + five debian images) move together.
+      matchDepNames: ['earthly/lunar-scripts'],
+      groupName: 'lunar-scripts base',
+    },
+    {
+      // alpine:/python: only appear in +test / +lint / artifact targets, never in a
+      // shipped image; leave them alone so the queue stays about what we publish.
+      matchManagers: ['dockerfile'],
+      matchDepNames: ['alpine', 'python'],
+      enabled: false,
+    },
+    {
+      matchManagers: ['github-actions'],
+      matchUpdateTypes: ['minor', 'patch'],
+      groupName: 'github-actions (non-major)',
+    },
+  ],
+}

collectors/ast-grep/Earthfile

@@ -7,6 +7,7 @@ image:
 
     # Install ast-grep CLI
     ARG TARGETARCH
+    # renovate: datasource=github-releases depName=ast-grep/ast-grep
     ARG AST_GREP_VERSION=0.40.5
     # apt-get upgrade: pull in the OS security fixes Debian has published for the
     # pinned lunar-scripts base (it only installs, never upgrades — see the root

collectors/checkov/Earthfile

@@ -10,6 +10,7 @@ image:
     # for rustworkx, so pip falls back to a source build that needs a Rust
     # toolchain. All build deps are virtual and removed after install, so the
     # runtime image is unaffected.
+    # renovate: datasource=pypi depName=checkov
     ARG CHECKOV_VERSION=3.2.360
     RUN apk add --no-cache --virtual .build-deps gcc musl-dev python3-dev libffi-dev cargo && \
         pip install --no-cache-dir --break-system-packages "checkov==${CHECKOV_VERSION}" && \

collectors/docker/Earthfile

@@ -22,6 +22,7 @@ image:
         echo "${DOCKERFILE_JSON_VERSION}" > /usr/local/bin/dockerfile-json.version
 
     # Install hadolint
+    # renovate: datasource=github-releases depName=hadolint/hadolint extractVersion=^v(?<version>.*)$
     ARG HADOLINT_VERSION=2.12.0
     RUN ARCH=$(echo "${TARGETARCH}" | sed 's/amd64/x86_64/') && \
         curl -sSL "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-Linux-${ARCH}" -o /usr/local/bin/hadolint && \

collectors/grype/Earthfile

@@ -14,6 +14,7 @@ image:
     FROM --pass-args ../../+base-image
 
     # Install Grype
+    # renovate: datasource=github-releases depName=anchore/grype extractVersion=^v(?<version>.*)$
     ARG GRYPE_VERSION=0.114.0
     ARG TARGETARCH
     RUN curl -sSfL "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_${TARGETARCH}.tar.gz" | tar xz -C /usr/local/bin grype && \

collectors/license-origins/Earthfile

@@ -36,6 +36,7 @@ image:
         sh -s -- -y --default-toolchain stable --profile minimal
 
     # Install Node.js (amd64 -> x64 for Node naming, arm64 stays arm64)
+    # renovate: datasource=node-version depName=node
     ARG NODE_VERSION=22.23.2
     RUN case "${TARGETARCH}" in amd64) ARCH=x64;; *) ARCH="${TARGETARCH}";; esac && \
         wget -q "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${ARCH}.tar.gz" -O node.tar.gz && \
@@ -44,6 +45,7 @@ image:
 
     # The npm bundled with Node 22 (10.9.x) vendors tar < 7.5.19, which grype flags
     # critical (GHSA-23hp-3jrh-7fpw); npm 12 depends on tar ^7.5.19.
+    # renovate: datasource=npm depName=npm
     ARG NPM_VERSION=12.0.2
     RUN npm install -g "npm@${NPM_VERSION}"
 

collectors/nodejs/Earthfile

@@ -12,6 +12,7 @@ image:
     RUN --no-cache apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
 
     # Install Node.js (download from official source for latest LTS)
+    # renovate: datasource=node-version depName=node
     ARG NODE_VERSION=22.23.2
     ARG TARGETARCH
     RUN ARCH=$(echo "${TARGETARCH}" | sed 's/amd64/x64/') && \
@@ -21,6 +22,7 @@ image:
 
     # The npm bundled with Node 22 (10.9.x) vendors tar < 7.5.19, which grype flags
     # critical (GHSA-23hp-3jrh-7fpw); npm 12 depends on tar ^7.5.19.
+    # renovate: datasource=npm depName=npm
     ARG NPM_VERSION=12.0.2
     RUN npm install -g "npm@${NPM_VERSION}"