chore: Configure Renovate

[alaudaa-renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

---

Detected Package Files

• cmd/config/internal/commands/e2e/e2econtainerconfig/Dockerfile (dockerfile)
• cmd/config/internal/commands/e2e/e2econtainerenvgenerator/Dockerfile (dockerfile)
• cmd/config/internal/commands/e2e/e2econtainermountbind/Dockerfile (dockerfile)
• cmd/config/internal/commands/e2e/e2econtainersimplegenerator/Dockerfile (dockerfile)
• hack/krmFunctionBenchmark/example_tshirt/execfn/Dockerfile (dockerfile)
• hack/krmFunctionBenchmark/label_namespace/execfn/Dockerfile (dockerfile)
• kustomize.Dockerfile (dockerfile)
• kyaml/fn/framework/example/Dockerfile (dockerfile)
• site/Dockerfile (dockerfile)
• .gitmodules (git-submodules)
• api/go.mod (gomod)
• cmd/config/go.mod (gomod)
• cmd/config/internal/commands/e2e/e2econtainerconfig/go.mod (gomod)
• cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.mod (gomod)
• cmd/config/internal/commands/e2e/e2econtainermountbind/go.mod (gomod)
• cmd/config/internal/commands/e2e/e2econtainersimplegenerator/go.mod (gomod)
• cmd/depprobcheck/go.mod (gomod)
• cmd/gorepomod/go.mod (gomod)
• cmd/k8scopy/go.mod (gomod)
• cmd/mdtogo/go.mod (gomod)
• cmd/pluginator/go.mod (gomod)
• hack/go.mod (gomod)
• kustomize/go.mod (gomod)
• kyaml/go.mod (gomod)
• plugin/builtin/annotationstransformer/go.mod (gomod)
• plugin/builtin/configmapgenerator/go.mod (gomod)
• plugin/builtin/hashtransformer/go.mod (gomod)
• plugin/builtin/helmchartinflationgenerator/go.mod (gomod)
• plugin/builtin/iampolicygenerator/go.mod (gomod)
• plugin/builtin/imagetagtransformer/go.mod (gomod)
• plugin/builtin/labeltransformer/go.mod (gomod)
• plugin/builtin/namespacetransformer/go.mod (gomod)
• plugin/builtin/patchjson6902transformer/go.mod (gomod)
• plugin/builtin/patchstrategicmergetransformer/go.mod (gomod)
• plugin/builtin/patchtransformer/go.mod (gomod)
• plugin/builtin/prefixtransformer/go.mod (gomod)
• plugin/builtin/replacementtransformer/go.mod (gomod)
• plugin/builtin/replicacounttransformer/go.mod (gomod)
• plugin/builtin/secretgenerator/go.mod (gomod)
• plugin/builtin/sortordertransformer/go.mod (gomod)
• plugin/builtin/suffixtransformer/go.mod (gomod)
• plugin/builtin/valueaddtransformer/go.mod (gomod)
• plugin/someteam.example.com/v1/bashedconfigmap/go.mod (gomod)
• plugin/someteam.example.com/v1/calvinduplicator/go.mod (gomod)
• plugin/someteam.example.com/v1/dateprefixer/go.mod (gomod)
• plugin/someteam.example.com/v1/printpluginenv/go.mod (gomod)
• plugin/someteam.example.com/v1/secretsfromdatabase/go.mod (gomod)
• plugin/someteam.example.com/v1/sedtransformer/go.mod (gomod)
• plugin/someteam.example.com/v1/someservicegenerator/go.mod (gomod)
• plugin/someteam.example.com/v1/stringprefixer/go.mod (gomod)
• plugin/someteam.example.com/v1/validator/go.mod (gomod)
• plugin/untested/v1/gogetter/go.mod (gomod)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Update _VERSION variables in Dockerfiles.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch and select the Retry/Rebase checkbox below. Renovate will update the Pull Request description the next time it runs.

---

You have configured Renovate to use branch master as base branch.

What to Expect

With your current configuration, Renovate will create 6 Pull Requests:

chore(deps): update module golang.org/x/crypto to v0.45.0 [security]

• Branch name: renovate/go-golang.org-x-crypto-vulnerability
• Merge into: master
• Upgrade golang.org/x/crypto to v0.45.0

chore(deps): update module golang.org/x/net to v0.45.0 [security]

• Branch name: renovate/go-golang.org-x-net-vulnerability
• Merge into: master
• Upgrade golang.org/x/net to v0.45.0

chore(deps): update module github.com/cli/cli to v2 [security]

• Branch name: renovate/go-github.com-cli-cli-vulnerability
• Merge into: master
• Upgrade github.com/cli/cli to v2.62.0

chore(deps): update site/themes/docsy digest to 901887d

• Schedule: ["at any time"]
• Branch name: renovate/site-themes-docsy-digest
• Merge into: master
• Upgrade site/themes/docsy to 901887d353c306b28d00d1afd006ebb63f386289

chore(deps): update docker.io/library/golang docker tag to v1.24.13

• Schedule: ["at any time"]
• Branch name: renovate/patch-patch-upgrades
• Merge into: master
• Upgrade docker.io/library/golang to 1.24.13-alpine

chore(deps): update docker.io/library/golang docker tag to v1.25.7

• Schedule: ["at any time"]
• Branch name: renovate/go-official-packages
• Merge into: master
• Upgrade docker.io/library/golang to 1.25.7-alpine

🚸 Branch creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prhourlylimit for details.

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Renovate Bot.

[alaudabot]

🤖 AI Code Review

Property	Value
Model	z-ai/glm-4.7:free
Style	strict
Issues Found	2
Warnings/Errors	0
Personalized Prompt	❌ No
Reviewed at	2026-03-07 02:15:11 UTC

---

Summary

This PR adds a Renovate configuration file (renovate.json) to enable automated dependency updates for the repository. The configuration extends a shared Renovate config and targets branch names matching the pattern alauda-v*. The changes are straightforward but contain a minor issue with the regex pattern syntax.

Review Statistics

Category	Count
Critical Issues	0
Warnings	1
Suggestions	1
Files Reviewed	1

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

None identified.

Warnings

Issues that SHOULD be addressed but are not blocking

• [renovate.json:280] The regex pattern uses forward slashes (/^alauda-v.*/) which are not standard for Renovate's baseBranches configuration. Renovate expects a plain regex string without delimiters.

Suggestions

Recommendations for improvement (nice to have)

• [renovate.json:279-281] Inconsistent indentation: the baseBranches array values have leading whitespace while other values do not. Consider aligning the indentation for consistency.

Positive Feedback

• The JSON structure is valid and well-formed
• The use of $schema is a good practice for IDE validation
• Extending a shared base configuration (github>AlaudaDevops/renovate-config:base) promotes consistency across repositories

---

---

ℹ️ About this review

This review was automatically generated using the run-actions workflow.

• Shared prompt: .github/prompts/code-review.md
• No repository-specific prompt configured