/renovate

name: renovate
description: Generate renovate.json covering all dependency file types used in a repo, emit a GitHub Actions workflow that validates renovate.json on every PR, or generate a pre-commit hook for local validation.
argument-hint: "[generate|workflow|precommit|all]"
title: "Renovate Command"
sidebar_label: "renovate"
custom_edit_url: null

Interactive Wizard (fires when $ARGUMENTS is empty)

When invoked with no arguments, ask these questions before proceeding. Ask each question individually and wait for the answer before asking the next.

**Q1 — Mode?**

What do you need?
  1. generate   — scan this repo and create renovate.json covering all detected dep file types
  2. workflow   — generate a GitHub Actions workflow that validates renovate.json on every PR
  3. precommit  — generate a .pre-commit-config.yaml hook that validates renovate.json locally
  4. all        — generate renovate.json + pre-commit hook + GitHub Actions workflow in one pass

Enter 1–4 or mode name:

**Q2 — Pinning strategy?** (ask only for modes that emit renovate.json: `generate`, `all`)

How should Renovate pin dependency versions?

  1. digest   — pin GitHub Actions and container images to commit SHA; semver for packages
                (maximum supply chain security — recommended)
  2. semver   — pin to semver tags/versions for all ecosystems; no SHA digests
                (simpler PRs, easier to read at a glance)

Enter 1–2:

**Q3 — Automerge scope?** (ask only for modes that emit renovate.json: `generate`, `all`)

Which update types should Renovate automerge without requiring a review?

  1. patch-only   — automerge patch updates only (1.2.3 → 1.2.4) — safest
  2. minor-patch  — automerge minor and patch (1.2.x → 1.3.x) — recommended for most teams
  3. none         — require human review for every update

Enter 1–3:

**Q4 — Update schedule?** (ask only for modes that emit renovate.json: `generate`, `all`)

When should Renovate open PRs?

  1. weekday-morning  — before 6am Monday–Friday (spreads PRs across the week) — recommended
  2. monday-morning   — before 6am on Monday only (batched, one review session per week)
  3. weekend          — before 6am Saturday–Sunday (keeps weekdays clear)
  4. always           — no schedule restriction (Renovate runs whenever it detects changes)

Enter 1–4:

**Q5 — Internal Terraform module source?** (ask only for modes that emit renovate.json, and only if `terraform` manager was or may be detected)

Do you reference Terraform modules from private GitHub repos or a private registry?

  1. github-org      — source = "github.com/<org>/<repo>//<path>?ref=<tag>"
  2. private-registry — source = "<hostname>/<namespace>/<module>/<provider>"
  3. no              — only public registry.terraform.io modules

Enter 1–3 (or press Enter to skip):

If `github-org`: What is your GitHub org? (e.g., `myorg`) If `private-registry`: What is the registry hostname? (e.g., `app.terraform.io`)

**Q6 — Private Helm registry?** (ask only for modes that emit renovate.json, and only if `helmv3` manager was or may be detected)

Do you use a private Helm chart registry?

  1. oci   — oci://registry.example.com (OCI-based, e.g. ECR, GHCR, Harbor)
  2. http  — https://charts.example.com (classic HTTP repository)
  3. no    — only public charts (Artifact Hub, Bitnami, etc.)

Enter 1–3 (or press Enter to skip):

If `oci` or `http`: Registry URL? (e.g., `registry.example.com`)

**Q7 — Private container image registry?** (ask only for modes that emit renovate.json, and only if `docker`, `dockerfile`, `kubernetes`, or `docker-compose` manager was or may be detected)

Do you use a private container image registry?

  1. ecr     — AWS ECR (123456789012.dkr.ecr.<region>.amazonaws.com)
  2. gcr     — Google GCR or Artifact Registry (gcr.io / <region>-docker.pkg.dev)
  3. acr     — Azure ACR (myregistry.azurecr.io)
  4. harbor  — Harbor or other self-hosted registry (registry.example.com)
  5. no      — Docker Hub and public registries only

Enter 1–5 (comma-separate multiple, or press Enter to skip):

If private: Registry hostname for each selected type? (e.g., `123456789012.dkr.ecr.us-east-1.amazonaws.com`)

Store all answers and proceed into the relevant mode(s) below using them.

---

You are a senior platform engineer specialising in dependency update automation with Renovate.

The input is: $ARGUMENTS

Parse the first word as the mode:

• `generate` — scan this repo and emit renovate.json
• `workflow` — emit a GitHub Actions validation workflow
• `precommit` — emit a pre-commit hook config
• `all` — run generate, then precommit, then workflow in sequence

If the mode was supplied via $ARGUMENTS (not the wizard), still ask Q2–Q7 for any mode that emits renovate.json before proceeding.

---

Mode: generate

Reference: `references/renovate.md`

Scan the repo working tree for dependency file types, then emit a `renovate.json` that covers exactly those managers — no more, no less.

Step 1 — Detect ecosystems

Scan for files matching these patterns. Exclude `.git/`, `node_modules/`, `vendor/`, `.terraform/`, `charts/`.

| File pattern | Manager | Key rule | |---|---|---| | `.github/workflows/*.yml` | `github-actions` | SHA digest pinning | | `*.tf`, `*.tfvars` | `terraform` | Providers + modules | | `Chart.yaml`, `requirements.yaml` | `helmv3` | Helm chart deps | | `go.mod` | `gomod` | Go modules | | `package.json`, `package-lock.json`, `yarn.lock` | `npm` | Node packages | | `requirements*.txt`, `Pipfile`, `pyproject.toml` | `pip` | Python packages | | `Dockerfile`, `docker-compose*.yml` | `docker` | Container images | | `Cargo.toml` | `cargo` | Rust crates | | Kubernetes manifests (`kind: Deployment/StatefulSet/DaemonSet`) | `kubernetes` | Image tags |

Print a coverage table before emitting output:

Detected dependency file types:
✅ github-actions  → .github/workflows/ (N files)
✅ terraform       → examples/**/*.tf (N files)