ci: group all docker image updates into single rolling PR

renovate.json

@@ -1,14 +1,14 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "enabledManagers": ["custom.regex", "kubernetes"],
+  "enabledManagers": ["kubernetes", "custom.regex"],
   "kubernetes": {
-    "fileMatch": ["^k8s/.+\\.yaml$"]
+    "fileMatch": ["(^k8s|^infra/k8s)/.+\\.yaml$"]
   },
   "customManagers": [
     {
       "customType": "regex",
-      "fileMatch": ["^manifests/.*\\.yml$"],
+      "fileMatch": ["^manifests/.*\\.yml$", "compose.*\\.yml$", "(^k8s|^infra/k8s)/.+\\.yaml$"],
       "matchStrings": [
         "image:\\s*(?<depName>[\\w.\\-/]+):(?<currentValue>[\\w][\\w.\\-]+)"
       ],
@@ -18,36 +18,33 @@
   ],
   "packageRules": [
     {
-      "description": "Auto-merge minor + patch for Zoo images",
+      "description": "Group all image updates into a single PR",
       "matchDatasources": ["docker"],
-      "matchPackagePatterns": ["ghcr.io/zooai/.*"],
-      "automerge": true,
-      "automergeType": "pr",
-      "matchUpdateTypes": ["minor", "patch"]
+      "groupName": "docker-images",
+      "groupSlug": "docker-images",
+      "automerge": false,
+      "labels": ["dependencies", "docker"]
     },
     {
-      "description": "Auto-merge patch for Hanzo infra images",
+      "description": "Auto-merge patch updates for internal images",
       "matchDatasources": ["docker"],
-      "matchPackagePatterns": ["ghcr.io/hanzoai/.*"],
+      "matchPackagePatterns": ["ghcr.io/(hanzoai|luxfi|zooai)/.*"],
+      "matchUpdateTypes": ["patch"],
       "automerge": true,
-      "automergeType": "pr",
-      "matchUpdateTypes": ["patch"]
+      "automergeType": "pr"
     },
     {
-      "description": "Auto-merge patch for Lux images",
-      "matchDatasources": ["docker"],
-      "matchPackagePatterns": ["ghcr.io/luxfi/.*"],
-      "automerge": true,
-      "automergeType": "pr",
-      "matchUpdateTypes": ["patch"]
-    },
-    {
-      "description": "Major versions require manual review",
+      "description": "Major versions require review",
       "matchDatasources": ["docker"],
       "matchUpdateTypes": ["major"],
       "automerge": false,
       "labels": ["major-upgrade"]
     },
+    {
+      "description": "Ignore ARC runner images",
+      "matchPackagePatterns": ["ghcr.io/actions/actions-runner"],
+      "enabled": false
+    },
     {
       "description": "Pin digests for deterministic deploys",
       "matchDatasources": ["docker"],
@@ -56,6 +53,7 @@
   ],
   "schedule": ["every 15 minutes"],
   "prHourlyLimit": 10,
-  "prConcurrentLimit": 5,
+  "prConcurrentLimit": 3,
+  "rebaseWhen": "behind-base-branch",
   "labels": ["renovate", "dependencies"]
 }