Does Renovate support excluding digest updates on NPM?

[arrrgi]

I have a recurring PR on hosted Gitlab for a monorepo dependency that has a digest version which was released without a tag. Renovate wants to keep creating PR's which I close but I'd like to avoid these being created for anything but major/minor/patch for the monorepo.

My config looks like this:

{
  "extends": [
    ":automergeDisabled",
    ":dependencyDashboard",
    ":docker",
    ":ignoreModulesAndTests",
    ":ignoreUnstable",
    ":renovatePrefix",
    ":semanticCommits",
    ":semanticPrefixChore",
    ":separateMajorReleases",
    "docker:disableMajor",
    "group:monorepos",
    "group:recommended"
  ],
  "commitBodyTable": true,
  "dependencyDashboardAutoclose": true,
  "docker": {
    "pinDigests": true
  },
  "packageRules": [
    {
      "extends": "monorepo:docusaurus",
      "groupName": "docusaurus monorepo",
      "matchUpdateTypes": ["major", "minor", "patch"]
    }
  ],
  "enabledManagers": ["dockerfile", "npm"],
  "labels": ["renovate"],
  "lockFileMaintenance": {
    "enabled": true
  },
  "node": {
    "supportPolicy": ["lts_latest"]
  },
  "prCreation": "status-success",
  "rangeStrategy": "bump",
  "separateMinorPatch": true,
  "schedule": "every weekend",
  "stabilityDays": 3
}

My understanding is that versions like this 2.0.0-alpha.71 should match, while versions like this v2.0.0-alpha.ffe8b6106 should be ignored.

Does Renovate classify a digest tagged update as a patch? Am I missing something from my config? Is the pinDigests rule being interpreted globally instead of just for Dockerfiles?

[rarkins]

v2.0.0-alpha.ffe8b6106 is a version, not a digest. It just so happens that the publishers are choosing to put a digest into the version string. Assuming this is related to Docusaurus, @HonkingGoose I think you already have a solution to this for your own needs? I forget where we discussed it, but assume you have it handy

[HonkingGoose]

NOTE: deleted my previous reply to copy/paste it below, as you cannot mark a "reply" as an answer in a GitHub discussion...

[HonkingGoose]

Assuming this is related to Docusaurus, @HonkingGoose I think you already have a solution to this for your own needs? I forget where we discussed it, but assume you have it handy

Good memory! 😄 Docusaurus uses some weird versioning unfortunately.
Luckily I already got config help from the Renovate wizards. 🧙 🧙 🙃

I'm using this config to filter out the canary releases and let through the normal full-fat releases:

  "packageRules": [
    {
      "description": "Allow mainline @docusaurus releases, ignore canary releases",
      "matchPackagePatterns": ["^@docusaurus"],
      "allowedVersions": "/^\\d+\\.\\d+\\.\\d+(-alpha\\.(\\d+))?$/"
    }

If you want to see the config in the context of a complete Renovate config, you can check out: https://github.com/HonkingGoose/git-gosling/blob/main/renovate.json to see the full config I'm using now.

[HonkingGoose]

@madcatsu Could you maybe copy/paste your new config? I'm curious what you ended up with, and if that is easier to understand/reason about than my current config?

[arrrgi]

Sure, my full config looks like this now:

{
  "extends": [
    ":automergeDisabled",
    ":dependencyDashboard",
    ":docker",
    ":ignoreModulesAndTests",
    ":ignoreUnstable",
    ":renovatePrefix",
    ":semanticCommits",
    ":semanticPrefixChore",
    ":separateMajorReleases",
    "docker:disableMajor",
    "group:monorepos",
    "group:recommended"
  ],
  "assignees": ["@madcatsu"],
  "commitBodyTable": true,
  "dependencyDashboardAutoclose": true,
  "docker": {
    "pinDigests": true
  },
  "packageRules": [
    {
      "description": "Allow only @docusaurus mainstream releases",
      "groupName": "docusaurus monorepo",
      "matchSourceUrlPrefixes": ["https://github.com/facebook/docusaurus"],
      "allowedVersions": "!/\\b([a-f0-9]{9})?$/"
    }
  ],
  "enabledManagers": ["dockerfile", "npm"],
  "labels": ["renovate"],
  "lockFileMaintenance": {
    "enabled": true
  },
  "node": {
    "supportPolicy": ["lts_latest"]
  },
  "prCreation": "status-success",
  "prHourlyLimit": 0,
  "prConcurrentLimit": 0,
  "rangeStrategy": "bump",
  "separateMinorPatch": true,
  "schedule": "every weekend",
  "stabilityDays": 3,
  "timezone": "Australia/Brisbane",
  "vulnerabilityAlerts": {
    "labels": ["security"],
    "assignees": ["@madcatsu"]
  }
}

[HonkingGoose]

Cheers! 😄

[arrrgi]

@HonkingGoose - is that working for you? Renovate isn't picking up the 2.0.0-alpha.72 release for me even though that rule is an exclusion, not a selective inclusion rule.

[HonkingGoose]

@madcatsu I have not tested your new config yet, but you should have gotten a PR by now, as alpha.72 is more than 3 stabilityDays old. So something about your configuration is still not right, but I'm not sure what the problem is.

I got a update PR from Renovate bot for alpha.72 just fine using the config below (See PR HonkingGoose/git-gosling#166):

  "packageRules": [
    {
      "description": "Allow mainline @docusaurus releases, ignore canary releases",
      "matchPackagePatterns": ["^@docusaurus"],
      "allowedVersions": "/^\\d+\\.\\d+\\.\\d+(-alpha\\.(\\d+))?$/"
    },
    {
      "description": "Wait 3 days before creating a npm update PR",
      "matchDatasources": ["npm"],
      "stabilityDays": 3
    }
  ],