Skip to content

ci: Simply renovate bot config to only propose google sdk, testing, and ci dep updates #4155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
lqiu96 wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

ci: Simply renovate bot config to only propose google sdk, testing, and ci dep updates #4155

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b6de897
ci: Simply renovate bot config to only propose google sdk, testing, a…
lqiu96 Mar 18, 2026
648ffeb
chore: Address PR comment about semantic commit type and scope
lqiu96 Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
158 changes: 53 additions & 105 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,12 @@
"customManagers": [
{
"customType": "regex",
"fileMatch": ["dependencies.txt"],
"matchStrings": ["(?<depName>.*),(.*)=(?<currentValue>.*)"],
"fileMatch": [
"dependencies.txt"
],
"matchStrings": [
"(?<depName>.*),(.*)=(?<currentValue>.*)"
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The regex (?<depName>.*) is very broad and will match all dependencies in dependencies.txt, including many third-party libraries (e.g., slf4j, jackson, httpcomponents).

Given the PR's goal is to "only propose google sdk, testing, and ci dep updates", this might generate more update PRs than intended. Previously, other rules might have disabled some of these, but with the new "disable all, then enable specific" structure, this rule for dependencies.txt will enable updates for everything in that file.

If the intention is to limit updates to Google-related dependencies from this file, consider making the regex more specific. For example, the suggestion below would limit matches to dependencies from com.google.*, io.grpc.*, and dev.cel.* group IDs. Please adjust the regex to match the intended scope.

Suggested change
"(?<depName>.*),(.*)=(?<currentValue>.*)"
"(?<depName>(?:com\\.google|io\\.grpc|dev\\.cel).*),.*=(?<currentValue>.*)"

],
"datasourceTemplate": "maven"
},
{
Expand Down Expand Up @@ -89,143 +93,87 @@
],
"packageRules": [
{
"matchPackageNames": [
"com.google.cloud:google-cloud-shared-config"
],
"registryUrls": [
"https://repo.maven.apache.org/maven2/",
"https://repo1.maven.org/maven2"
]
},
{
"matchUpdateTypes": [
"major"
],
"enabled": false,
"matchPackageNames": [
"*"
]
},
{
"enabled": false,
"matchPackageNames": [
"/^com.google.protobuf:/"
]
},
{
"versioning": "docker",
"matchPackageNames": [
"/^com.google.guava:/"
],
"enabled": false
},
{
"semanticCommitType": "deps",
"semanticCommitScope": null,
"matchPackageNames": [
"*"
]
},
{
"semanticCommitType": "build",
"semanticCommitScope": "deps",
"enabled": true,
"matchPackageNames": [
"/^org.apache.maven/",
"/^org.jacoco:/",
"/^org.codehaus.mojo:/",
"/^org.sonatype.plugins:/",
"/^com.google.cloud:google-cloud-shared-config/"
]
},
{
"semanticCommitType": "chore",
"semanticCommitScope": "deps",
"matchPackageNames": [
"/^{{metadata['repo']['distribution_name']}}/",
"/^com.google.cloud:libraries-bom/",
"/^com.google.cloud.samples:shared-configuration/"
]
},
{
"semanticCommitType": "test",
"semanticCommitScope": "deps",
"matchPackageNames": [
"/^junit:junit/",
"/^com.google.truth:truth/",
"/^org.mockito:mockito-core/",
"/^org.objenesis:objenesis/",
"/^com.google.cloud:google-cloud-conformance-tests/"
]
},
{
"ignoreUnstable": false,
"matchPackageNames": [
"/^com.google.cloud:google-cloud-/"
]
"/^org.junit/"
],
"groupName": "Testing Libraries",
"enabled": true,
"semanticCommitType": "test",
"semanticCommitScope": "deps"
},
{
"groupName": "jackson dependencies",
"matchPackageNames": [
"/^com.fasterxml.jackson.core/"
]
"/^org.apache.maven/",
"/^org.jacoco:/",
"/^org.codehaus.mojo:/",
"/^org.sonatype.plugins:/"
],
"groupName": "Maven Plugins",
"enabled": true,
"semanticCommitType": "build",
"semanticCommitScope": "deps"
},
{
"groupName": "gRPC dependencies",
"matchPackageNames": [
"/^io.grpc/"
"matchManagers": [
"github-actions"
],
"enabled": false
"matchFileNames": [
".cloudbuild/**",
".github/workflows/**"
],
"groupName": "CI/CD Updates",
"enabled": true
},
{
"groupName": "Google Auth Library dependencies",
"matchPackageNames": [
"/^com.google.auth/"
]
},
{
"groupName": "Google API dependencies",
"matchPackageNames": [
"/com.google.api.grpc:grpc-google-common-protos/",
"/com.google.api.grpc:grpc-google-iam-v1/",
"/com.google.api.grpc:proto-google-common-protos/",
"/com.google.api.grpc:proto-google-iam-v1/",
"/com.google.api:api-common/"
]
],
"enabled": true
},
{
"groupName": "Google HTTP Client dependencies",
"matchPackageNames": [
"/^com.google.http-client/"
]
},
{
"groupName": "OpenCensus dependencies",
"matchPackageNames": [
"/^io.opencensus/"
]
},
{
"groupName": "Netty dependencies",
"matchPackageNames": [
"/^io.netty/"
]
],
"enabled": true
},
{
"groupName": "Error Prone dependencies",
"groupName": "Java SDK Shared Config",
"matchPackageNames": [
"/^com.google.errorprone/"
]
"com.google.cloud:google-cloud-shared-config"
],
"enabled": true,
"semanticCommitType": "build",
"semanticCommitScope": "deps"
},
{
"matchManagers": [
"regex"
],
"semanticCommitType": "chore",
"matchFileNames": ["dependencies.txt"],
"matchDatasources": ["maven"],
"matchFileNames": [
"dependencies.txt"
],
"matchDatasources": [
"maven"
],
"groupName": "Upper Bound Dependencies File",
"description": "Group all dependencies from the Upper Bound Dependencies File"
"description": "Group all dependencies from the Upper Bound Dependencies File",
"enabled": true
}
]
}
],
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The new configuration disables updates for all packages by default, and then selectively re-enables them. It seems that updates for com.google.cloud:gapic-generator-java-transport and com.google.cloud:gapic-generator-java-rest-numeric-enums, which are tracked via a regex manager on rules_java_gapic/java_gapic.bzl, are now disabled as they are not re-enabled by any rule.

Given that the PR intends to keep "google sdk" updates, was this intentional? If not, you might want to add a new package rule to re-enable them, for example:

    {
      "matchPackageNames": [
        "com.google.cloud:gapic-generator-java-transport",
        "com.google.cloud:gapic-generator-java-rest-numeric-enums"
      ],
      "groupName": "GAPIC Generator Dependencies",
      "enabled": true,
      "semanticCommitType": "chore",
      "semanticCommitScope": "deps"
    }

"vulnerabilityAlerts": {
"enabled": true
},
"osvVulnerabilityAlerts": true
}
Loading