chore(ci): enable weekly flake.lock maintenance for nix manager - #1087
Conversation
Motivation:
Our Go toolchain comes from the nixpkgs-unstable flake input, which is
pinned by a branch ref rather than a version. Renovate's nix manager
tracks this input, but a branch ref never shows a newer version to bump
to, so Renovate never proposes updating flake.lock. As a result the
locked revision - and therefore our Go version - never advances; we
have been stuck on Go 1.25.9 while 1.25.12 is current.
Approach:
Enable Renovate's lockFileMaintenance for the nix manager, which runs
`nix flake update` on a schedule regardless of whether Renovate detects
a version bump. This is the mechanism that actually moves branch-ref
inputs like nixpkgs-unstable forward. Also switch the cadence from
monthly to weekly, since we still depend on upstream nixpkgs picking up
new Go releases first and want to pick up those updates faster once it
does. This mirrors the lockFileMaintenance configuration already in use
in crossplane/crossplane's .github/renovate-nix.json5.
This is a Renovate/CI automation config change only; it does not alter
any runtime code or user-facing behavior. It changes how often and
under what conditions our automated dependency-update bot opens a PR
to bump flake.lock.
Validation:
Ran this repo's own CI validation checks for Renovate presets locally:
npx --yes json5 .github/renovate-nix.json5
npx --yes --package renovate -- renovate-config-validator
Both passed ("Config validated successfully").
Fixes crossplane#1086
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
jbw976
left a comment
jbw976
left a comment
There was a problem hiding this comment.
awesome @pujitha24, thanks for taking this on so quickly! i was also working on a fix last night that updates a couple other config settings, so to stay fair and keep your credit for contribution here, i'll just push my additional settings as an extra commit to this branch/PR, unless you have major objections to that 😇
|
Thanks @jbw976! No objections at all — happy for you to push your additional config settings as an extra commit on this branch. Let me know if there's anything else you'd like adjusted here. |
…nches schedule:weekly resolves to "* 0-3 * * 1", a window of 00:00 to 03:59 UTC on Monday. Our Renovate workflow's cron fires at 08:00 UTC, and GitHub only delays scheduled runs rather than advancing them, so our job will never hit that window. A literal 'on monday' covers the whole day, so it stays reachable however late the run starts. The blanket release-branch opt-out in the base config also suppressed the refresh on release-2.2 and newer. Those branches build with nix and pin the Go toolchain in flake.lock the same way main does, so a rule re-enables lock file maintenance for them. release-2.1 and older use Earthly and have no flake.lock, so they stay excluded. While we're at it, bump the prConcurrentLimit back up to Renovate's default of 10, so we get more throughput when there's a backlog. Signed-off-by: Jared Watts <jbw976@gmail.com>
|
Awesome, thanks for the collaboration @pujitha24! 🙌 I pushed 3982028, so now this PR has both of our commits, to add a couple more settings:
|
|
Thanks for the fixes, @jbw976! The |
Motivation:
Our Go toolchain comes from the nixpkgs-unstable flake input, which is
pinned by a branch ref rather than a version. Renovate's nix manager
tracks this input, but a branch ref never shows a newer version to bump
to, so Renovate never proposes updating flake.lock. As a result the
locked revision - and therefore our Go version - never advances; we
have been stuck on Go 1.25.9 while 1.25.12 is current.
Approach:
Enable Renovate's lockFileMaintenance for the nix manager, which runs
nix flake updateon a schedule regardless of whether Renovate detectsa version bump. This is the mechanism that actually moves branch-ref
inputs like nixpkgs-unstable forward. Also switch the cadence from
monthly to weekly, since we still depend on upstream nixpkgs picking up
new Go releases first and want to pick up those updates faster once it
does. This mirrors the lockFileMaintenance configuration already in use
in crossplane/crossplane's .github/renovate-nix.json5.
This is a Renovate/CI automation config change only; it does not alter
any runtime code or user-facing behavior. It changes how often and
under what conditions our automated dependency-update bot opens a PR
to bump flake.lock.
Validation:
Ran this repo's own CI validation checks for Renovate presets locally:
npx --yes json5 .github/renovate-nix.json5
npx --yes --package renovate -- renovate-config-validator
Both passed ("Config validated successfully").
Related to #1086
Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com