dependabot.yml

---
version: 2

updates:
  # Pinned container images in compose.yaml. This is what makes pinning
  # sustainable — without it, pinned tags simply rot.
  #
  # grafana/alloy is the exception to "one PR per directory is fine". lab,
  # sensor, soc, bloodhound and analyst all mount this stack's
  # alloy/config.alloy, so their Alloy has to be this one, digest for digest,
  # and check_image_pins.py fails a pull request that moves one without the
  # others (#848). Those six entries cannot be merged the way soc and scratch
  # were, because here and in lab Alloy rides in the grafana-stack group. So
  # when an Alloy bump arrives, push the same bump to the other five stacks
  # onto that PR and close the rest.
  - package-ecosystem: docker-compose
    directory: /stacks/observability
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "observability"]
    groups:
      grafana-stack:
        patterns: ["grafana/*"]
      prometheus-stack:
        patterns: ["prom/*"]
    # Grafana below 13.2.4 is skipped (#1122). By the pinned trivy, 13.2.3
    # carries one more fixable HIGH/CRITICAL than the 13.0.10 pin: it adds
    # two grpc findings in the bundled Prometheus and Loki datasource plugins,
    # which we use. 13.1.7 clears only one of the seven findings. The 13.x patch
    # releases already being prepared carry the Go and x/net fixes, so wait
    # for 13.2.4 and scan it before merging. Drop this entry once the pin is
    # at 13.2.4 or later.
    ignore:
      - dependency-name: grafana/grafana
        versions: ["< 13.2.4"]

  # The lab stack. A second entry rather than a second directory on the one
  # above, because Dependabot takes a single directory per entry — and without
  # it the lab's pins would rot exactly the way the comment above says pinned
  # tags do, while the estate's stayed current. The two run the same four
  # images, so they are expected to move together; they get separate PRs
  # because they are separate deploys to separate hosts, and the lab's is a
  # host the operator has to be sitting in front of.
  - package-ecosystem: docker-compose
    directory: /stacks/lab
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "lab"]
    groups:
      grafana-stack:
        patterns: ["grafana/*"]
      prometheus-stack:
        patterns: ["prom/*"]
    # Skips Grafana below 13.2.4 for the reason given on the observability
    # entry (#1122).
    ignore:
      - dependency-name: grafana/grafana
        versions: ["< 13.2.4"]

  # The sensitive tier. Its images share nothing with the other stacks, so
  # no groups; each bump is its own PR, and each merge is a deploy: trinity's
  # homelab-converge-sensitive applies it within the hour (#533), so review
  # it as one. Written before the host existed, for the reason the lab entry
  # gives: pins rot from the day they are written.
  #
  # Postgres majors are held, by wiki's rule below: the tier's three Postgres
  # volumes — Immich's, Paperless's and Miniflux's — are quiesced data
  # directory tars in `make backup`, restorable only into the same major, and
  # a major is a dump and a restore (ADR-0065), never a digest bump. This
  # entry carried no such line while wiki's and bloodhound's did, and here the
  # merge IS the deploy: trinity would have started the next major against
  # the previous major's data directory within the hour, with the previous
  # night's set the only way back. Two names, because Immich's is its own image: the vectorchord
  # build's tag moves with both the Postgres major and the extension's, and
  # either is a migration Immich documents, not a bump.
  - package-ecosystem: docker-compose
    directory: /stacks/sensitive
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    ignore:
      - dependency-name: postgres
        update-types: ["version-update:semver-major"]
      - dependency-name: ghcr.io/immich-app/postgres
        update-types: ["version-update:semver-major"]
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "sensitive"]

  # The SOC stack, on odin. Three wazuh/* images that move together and are
  # grouped so one PR carries a release — the indexer, manager and dashboard
  # must match to the patch version, and three separate bumps would be three
  # deploys of a half-upgraded SIEM. Velociraptor and Alloy bump alone. Present
  # before the host is, for the reason the entries above give: pins rot from
  # the day they are written. One thing Dependabot cannot bump is the Wazuh
  # cert tool vendored in stacks/soc/wazuh/certs-tool/ (ADR-0094), which tracks
  # the wazuh/* major.minor — the compose file says so where it is used.
  #
  # stacks/scratch (#438, ADR-0071), the disposable copy of soc on diabolos,
  # rides in this entry rather than its own. It mounts soc's config
  # (../soc/wazuh/..., ../soc/velociraptor/...), so a scratch store on a
  # different Wazuh from odin's answers a different question. With its own
  # entry a release arrived as two PRs that had to be merged together, and only
  # discipline made sure they were. Since #848 check_image_pins.py fails either
  # one alone, and `directories` puts each group's bump to both stacks in ONE PR.
  # Velociraptor gets a group for the same reason; an ungrouped dependency would
  # still arrive as one PR per directory.
  - package-ecosystem: docker-compose
    directories: [/stacks/soc, /stacks/scratch]
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "soc", "scratch"]
    groups:
      wazuh:
        patterns: ["wazuh/*"]
      velociraptor:
        patterns: ["velocidex/*"]

  # The media stack on smaug. Present before the pool is, for the reason the
  # entries above give — but this one was absent while three documents said it
  # was here: ADR-0040 keeps stacks/media in this repository rather than making
  # it a TrueNAS catalogue app precisely so "Dependabot, the digest pins and
  # make validate keep reaching it", and build-the-nas.md §6 and the stack's own
  # README repeat the claim. The pins and make validate did reach it. This is
  # the third.
  #
  # Four images now: #256 added a node_exporter beside Jellyfin, because this
  # host is scraped rather than running an agent, #140 added Audiobookshelf,
  # from ghcr.io, and #141 Navidrome. They share nothing, so no groups — each bump is its own PR.
  - package-ecosystem: docker-compose
    directory: /stacks/media
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "media"]

  # stacks/wiki (#251): Wiki.js and its Postgres on oracle, deployed by hand
  # from main the way stacks/media is, so a bump merged here reaches the host
  # only when README.md's fetch is run there. Postgres is held to 17 by
  # ignoring majors: a major is a dump and a restore (ADR-0065), never a
  # digest bump.
  - package-ecosystem: docker-compose
    directory: /stacks/wiki
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    ignore:
      - dependency-name: postgres
        update-types: ["version-update:semver-major"]
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "wiki"]

  # stacks/sensor (#437): Zeek and Alloy on fenrir. It shipped without an
  # entry, so for its first day its two digests were pinned and bumped by
  # nothing, the rot the first entry warns about. ADR-0069 found the gap,
  # because its whole argument leans on this stack's image being kept current.
  # Deployed by hand with `docker compose` on fenrir, like media and wiki, so
  # a merged bump reaches the host when the stack is pulled there.
  - package-ecosystem: docker-compose
    directory: /stacks/sensor
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "sensor"]

  # stacks/bloodhound (#451, ADR-0081): BloodHound CE and the one Postgres
  # that holds its state and its graph, on eden. Postgres majors are held, by
  # wiki's rule: a major is a dump and a restore. An entry from the first
  # commit, which is the lesson sensor's comment above records.
  - package-ecosystem: docker-compose
    directory: /stacks/bloodhound
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    ignore:
      - dependency-name: postgres
        update-types: ["version-update:semver-major"]
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "bloodhound"]

  # stacks/analyst (#921, ADR-0091): Alloy and its socket proxy on garuda,
  # and nothing else. An entry from the first commit, by sensor's lesson.
  - package-ecosystem: docker-compose
    directory: /stacks/analyst
    schedule:
      interval: weekly
      day: sunday
    open-pull-requests-limit: 5
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "analyst"]

  # ansible/ (ADR-0077): ansible-core in requirements.txt, ansible-lint in
  # requirements-lint.txt, both exact. The collections in requirements.yml are
  # not an ecosystem Dependabot reads, and stay a deliberate edit like Packer's
  # plugin pin; the weekly scripts/check_tool_versions.py job in digests.yml is
  # what says a newer one exists (#848). Monthly: phoenix applies these by
  # hand, so a weekly PR would outrun anyone running them.
  - package-ecosystem: pip
    directory: /ansible
    schedule:
      interval: monthly
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "lab"]

  # scripts/: three pins, all monthly — neither is a deploy, and a new linter
  # release can bring new findings, so one PR a month to fix them is enough.
  #   - PyYAML, with its hashes, in requirements.txt, which scripts/_deps.py
  #     installs on a CI runner and nowhere else; a host takes it from apt (#848).
  #   - yamllint in requirements-lint.txt, for scripts/lint.sh (#848).
  #   - ruff in requirements-lint.txt, for scripts/lint.sh (#853).
  - package-ecosystem: pip
    directory: /scripts
    schedule:
      interval: monthly
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "ci"]

  # tofu/ (ADR-0076, #848): the bpg/proxmox provider in versions.tf and its
  # hashes in .terraform.lock.hcl. Dependabot's opentofu ecosystem resolves it
  # against registry.opentofu.org, the registry the lock file names. Its lock
  # edit is incomplete: the first one (#961) left constraints on the old
  # version and one zh: hash out, and scripts/lint.sh fails that. Expect each
  # bump to be red until `tofu -chdir=tofu init -upgrade -backend=false` is
  # committed onto it. Monthly: phoenix applies it by hand, like ansible/ above.
  - package-ecosystem: opentofu
    directory: /tofu
    schedule:
      interval: monthly
    commit-message:
      prefix: "chore(deps)"
    labels: ["dependencies", "lab"]

  - package-ecosystem: github-actions
    directory: /
    schedule:
      # Weekly since #839. The actions are pinned to commit SHAs now, so a
      # security fix in one reaches CI only through this PR; a month is too
      # long to wait for that.
      interval: weekly
    commit-message:
      prefix: "chore(ci)"
    labels: ["dependencies", "ci"]