Configure Renovate to target specific branches for Docker Dependency Updates

[javaxiss]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

41.115.1

Please tell us more about your question or problem

Hello,

I'm trying to configure a preset that controls which branchs receive the MRs, with specific rules regarding which branches the updates should be sent to.

For a specific subgroup or project, Renovate should send MRs for Docker dependencies to both develop and master branches.
For all other repositories, Renovate should only send MRs for Docker dependencies to the master branch.

Is it possible to set up a Renovate preset specifically for Docker dependencies that follows the above branch-specific MR creation rules ?

I trying the following preset via packageRules but, it still send MR to both develop and master branchs despite defining matchRepositories option

    {
        "description": "All clients docker images (client projects)",
        "labels": ["docker-renovate"],
        "defaultRegistryUrls": ["https://myregistry.io"],
        // enable only dockerfile manager, no need to activate docker-compose
        "enabledManagers": ["dockerfile"],
        "baseBranches": ["master", "develop"],
        "packageRules": [
            {
                "matchDatasources": ["docker"],
                "matchUpdateTypes": ["digest","patch","minor","major"],
                "automerge": false,
                "addLabels": ["common-upgrade"],
                "matchBaseBranches": ["master"],
                "matchRepositories": ["!/^MyGroup/mysubgroup/myprojects\\/.*/"]
                
            } ,        
            {
                // enable automerge renovation except for major versions
                "matchDatasources": ["docker"],
                "matchUpdateTypes": ["digest","patch","minor","major"],
                "automerge": false,
                "addLabels": ["specific-upgrade"],
                //only runners projects
                "matchRepositories": ["/^MyGroup/mysubgroup/myprojects$/"],
                "matchBaseBranches": ["develop"]
            }
        ]
    }

Logs (if relevant)

No response

[Nickalus12]

This looks like a logic issue with how baseBranches interacts with packageRules. Since you've defined both branches in the global baseBranches array, Renovate will scan and attempt updates for both across all repositories. packageRules don't filter which branches are scanned; they only apply settings once an update is discovered.

To restrict develop updates to specific projects, you need to explicitly set enabled: false for all other repositories when the base branch is develop:

{
  "packageRules": [
    {
      "matchBaseBranches": ["develop"],
      "matchRepositories": ["!/^MyGroup/mysubgroup/myprojects/"],
      "enabled": false
    }
  ]
}

One gotcha: matchRepositories matches the full repository slug (e.g., org/repo or group/subgroup/project). If your GitLab instance uses a different path structure or if your regex has trailing slashes/escapes that don't match the slug exactly, the rule won't trigger. IIRC, it's often safer to use a simpler regex like /^MyGroup\/mysubgroup\/myprojects/ without the complex anchors until you've verified it works in the logs.

[javaxiss]

Thanks for the tips !

I actually tried the following configuration:

{
  "packageRules": [
    {
      "matchBaseBranches": ["develop"],
      "matchRepositories": ["!/^MyGroup/mysubgroup/myprojects/*"],
      "enabled": false
    },
    {
      "matchBaseBranches": ["develop"],
      "matchRepositories": ["/^MyGroup/mysubgroup/myprojects/*"]
    }
  ]
}

Even with a simplified regex, it doesn't seem to trigger the rule as expected (only master branch still receiving MR). The projects expecting MR on develop are under /myprojects GitLab subgroup. Am I missing something ?

[javaxiss]

My bad, I made a mistake with the option value earlier! The regex should actually be enclosed in // for it to be properly evaluated. Here's the corrected example, and it’s working like a charm now!

{
"description": "All clients docker images (client projects)",
"labels": ["docker-renovate"],
"defaultRegistryUrls": ["https://myregistry.io"],
// enable only dockerfile manager, no need to activate docker-compose
"enabledManagers": ["dockerfile"],
"baseBranches": ["master", "develop"],
  "packageRules": [
    {
      "matchBaseBranches": ["develop"],
      "matchRepositories": ["!/^MyGroup/mysubgroup/myprojects/*"],
      "enabled": false
    },
    {
      "matchBaseBranches": ["develop"],
      "matchRepositories": ["/^MyGroup/mysubgroup/myprojects/*"]
    }
  ]
}

Projects in MyGroup/mysubgroup/myprojects subgroup will get updates on develop and master branchs, , while the others will only have them only on master.

Hopefully, this can help someone else who might run into the same issue I did.

Thank you again for your precious help, really appreciate it!

[Nickalus12]

🎉 Nice! For future questions, open a new thread and tag @Nickalus12 if you want me to take a look.