.gitea/workflows/check-renovate.yml.hold

@@ -0,0 +1,20 @@
+name: Check Renovate Updates
+
+on:
+  pull_request:
+    branches:
+      - main
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'docker-compose.yml'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    if: ${{ contains(toLower(github.event.pull_request.user.login), 'renovate') }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Validate docker-compose.yml
+        run: docker compose config

.gitea/workflows/renovate-pr-deploy.yml.hold

@@ -0,0 +1,98 @@
+name: Deploy Renovate Updates
+
+on:
+  workflow_run:
+    workflows: ["Check Renovate Updates"]
+    types:
+      - completed
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    if: >
+      ${{
+        github.event.workflow_run.conclusion == 'success' &&
+        contains(toLower(github.event.workflow_run.head_commit.author.name), 'renovate')
+      }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # we need full history to compute merge-base
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker (if needed)
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Install yq
+        run: |
+          sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
+          sudo chmod +x /usr/bin/yq
+
+      - name: Get modified services including dependencies
+        id: modified_services
+        run: |
+          echo "Finding modified services in docker-compose.yml..."
+
+          # Find merge-base with previous main commit
+          BASE_COMMIT=$(git merge-base HEAD HEAD~1)
+
+          # Extract changed services between merge-base and HEAD
+          CHANGED_SERVICES=$(git diff --name-only $BASE_COMMIT HEAD -- docker-compose.yml \
+            | xargs -r -I{} yq e '.services | keys | .[]' {})
+
+          if [ -z "$CHANGED_SERVICES" ]; then
+            echo "No services changed, skipping."
+            exit 0
+          fi
+
+          declare -A VISITED
+          ALL_DEPLOY=()
+
+          get_deps() {
+            local service=$1
+            if [[ -n "${VISITED[$service]}" ]]; then
+              return
+            fi
+            VISITED[$service]=1
+            ALL_DEPLOY+=("$service")
+
+            # Array style depends_on
+            deps=$(yq e ".services.\"$service\".depends_on[]?" docker-compose.yml 2>/dev/null)
+            for dep in $deps; do
+              get_deps "$dep"
+            done
+
+            # Mapping style depends_on (with condition)
+            deps_map=$(yq e ".services.\"$service\".depends_on | keys[]" docker-compose.yml 2>/dev/null)
+            for dep in $deps_map; do
+              get_deps "$dep"
+            done
+          }
+
+          for svc in $CHANGED_SERVICES; do
+            get_deps "$svc"
+          done
+
+          echo "Services to deploy: ${ALL_DEPLOY[@]}"
+          echo "modified_services=${ALL_DEPLOY[@]}" >> $GITHUB_ENV
+
+      - name: Pull images for modified services
+        if: env.modified_services != ''
+        run: |
+          echo "Pulling images for services: $modified_services"
+          for svc in $modified_services; do
+            docker compose pull $svc || echo "Failed to pull $svc, continuing..."
+          done
+
+      - name: Deploy updated services
+        if: env.modified_services != ''
+        run: |
+          echo "Deploying services: $modified_services"
+          docker compose up -d $modified_services

renovate.json

@@ -15,37 +15,43 @@
   ],
   "packageRules": [
     {
-      "matchCategories": [
+      "description": "Pin ClickHouse to the exact version used by Signoz",
-        "docker"
+      "matchPackageNames": ["clickhouse/clickhouse-server"],
-      ],
+      "allowedVersions": "^24\\.1\\.2-alpine$",
-      "enabled": true
+      "groupName": "signoz-clickhouse",
+      "semanticCommitScope": "signoz-clickhouse"
     },
     {
-      "matchDatasources": [
+      "description": "Allow only Alpine tag upgrades for all Alpine-based images",
-        "docker"
+      "matchDatasources": ["docker"],
-      ],
+      "matchPackagePatterns": [".*alpine.*"],
-      "matchPackageNames": [
+      "allowedVersions": ".*alpine.*",
-        "clickhouse/clickhouse-server"
+      "groupName": "alpine-upgrades",
-      ],
+      "semanticCommitScope": "{{depName}}"
-      "enabled": false
     },
     {
-      "matchDatasources": [
+      "description": "Pin postgres image – never upgrade",
-        "docker"
+      "matchPackageNames": ["postgres"],
-      ],
+      "pin": true,
-      "allowedVersions": "/.*-alpine$/",
+      "semanticCommitScope": "postgres"
-      "matchPackageNames": [
-        "/.*-alpine$/"
-      ]
     },
     {
-      "matchDatasources": [
+      "description": "Pin pgvector image – never upgrade",
-        "docker"
+      "matchPackageNames": ["pgvector/pgvector"],
-      ],
+      "pin": true,
-      "enabled": false,
+      "semanticCommitScope": "pgvector"
-      "matchPackageNames": [
+    },
-        "/^.*:latest$/"
+    {
-      ]
+      "description": "Pin pgvecto‑rs image – never upgrade",
+      "matchPackageNames": ["pgvecto-rs/pgvecto-rs"],
+      "pin": true,
+      "semanticCommitScope": "pgvecto-rs"
+    },
+    {
+      "description": "Default rule for all remaining Docker images",
+      "matchDatasources": ["docker"],
+      "groupName": "docker-images",
+      "semanticCommitScope": "{{depName}}"
     }
   ],
   "customManagers": [],