Configure Renovate

[renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

• Dockerfile (dockerfile)
• Dockerfile.CSM (dockerfile)
• Dockerfile.pprof (dockerfile)
• .github/workflows/PRBuild.yml (github-actions)
• .github/workflows/Release.yml (github-actions)
• .github/workflows/scorecard.yml (github-actions)
• go.mod (gomod)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs

---

What to Expect

With your current configuration, Renovate will create 24 Pull Requests:

Update actions/upload-artifact digest to ff15f03

• Schedule: ["at any time"]
• Branch name: renovate/actions-upload-artifact-digest
• Merge into: main
• Upgrade actions/upload-artifact to ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5

Update actions/attest-build-provenance action to v4.1.1

• Schedule: ["at any time"]
• Branch name: renovate/actions-attest-build-provenance-4.x
• Merge into: main
• Upgrade actions/attest-build-provenance to v4.1.1

Update actions/checkout action to v6.0.3

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-6.x
• Merge into: main
• Upgrade actions/checkout to v6.0.3

Update module github.com/Cray-HPE/hms-certs to v1.7.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-cray-hpe-hms-certs-1.x
• Merge into: main
• Upgrade github.com/Cray-HPE/hms-certs to v1.7.1

Update module github.com/Cray-HPE/hms-msgbus to v1.13.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-cray-hpe-hms-msgbus-1.x
• Merge into: main
• Upgrade github.com/Cray-HPE/hms-msgbus to v1.13.1

Update module github.com/golang-jwt/jwt/v5 to v5.3.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-golang-jwt-jwt-v5-5.x
• Merge into: main
• Upgrade github.com/golang-jwt/jwt/v5 to v5.3.1

Update module github.com/hashicorp/go-retryablehttp to v0.7.8

• Schedule: ["at any time"]
• Branch name: renovate/github.com-hashicorp-go-retryablehttp-0.x
• Merge into: main
• Upgrade github.com/hashicorp/go-retryablehttp to v0.7.8

Update module github.com/lestrrat-go/jwx/v2 to v2.1.7

• Schedule: ["at any time"]
• Branch name: renovate/github.com-lestrrat-go-jwx-v2-2.x
• Merge into: main
• Upgrade github.com/lestrrat-go/jwx/v2 to v2.1.7

Update module github.com/sirupsen/logrus to v1.9.4

• Schedule: ["at any time"]
• Branch name: renovate/github.com-sirupsen-logrus-1.x
• Merge into: main
• Upgrade github.com/sirupsen/logrus to v1.9.4

Update actions/checkout action to v4.3.1

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-4.x
• Merge into: main
• Upgrade actions/checkout to 34e114876b0b11c390a56381ad16ebd13914f8d5

Update actions/setup-go action to v6.5.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-go-6.x
• Merge into: main
• Upgrade actions/setup-go to v6.5.0

Update docker/login-action action to v4.4.0

• Schedule: ["at any time"]
• Branch name: renovate/docker-login-action-4.x
• Merge into: main
• Upgrade docker/login-action to v4.4.0

Update module github.com/Cray-HPE/hms-securestorage to v1.18.0

• Schedule: ["at any time"]
• Branch name: renovate/github.com-cray-hpe-hms-securestorage-1.x
• Merge into: main
• Upgrade github.com/Cray-HPE/hms-securestorage to v1.18.0

Update module github.com/go-chi/chi/v5 to v5.3.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-go-chi-chi-v5-5.x
• Merge into: main
• Upgrade github.com/go-chi/chi/v5 to v5.3.1

Update module github.com/golang-migrate/migrate/v4 to v4.19.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-golang-migrate-migrate-v4-4.x
• Merge into: main
• Upgrade github.com/golang-migrate/migrate/v4 to v4.19.1

Update module github.com/invopop/jsonschema to v0.14.0

• Schedule: ["at any time"]
• Branch name: renovate/github.com-invopop-jsonschema-0.x
• Merge into: main
• Upgrade github.com/invopop/jsonschema to v0.14.0

Update module github.com/lib/pq to v1.12.3

• Schedule: ["at any time"]
• Branch name: renovate/github.com-lib-pq-1.x
• Merge into: main
• Upgrade github.com/lib/pq to v1.12.3

Update module github.com/openchami/tokensmith to v0.4.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-openchami-tokensmith-0.x
• Merge into: main
• Upgrade github.com/openchami/tokensmith to 81c39c4b08ef5262bb7cdc110f61aedd35a9f16f

Update module github.com/rs/zerolog to v1.35.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-rs-zerolog-1.x
• Merge into: main
• Upgrade github.com/rs/zerolog to v1.35.1

Update ossf/scorecard-action action to v2.4.3

• Schedule: ["at any time"]
• Branch name: renovate/ossf-scorecard-action-2.x
• Merge into: main
• Upgrade ossf/scorecard-action to 4eaacf0543bb3f2c246792bd56e8cdeffafb205a

Update actions/checkout action to v7

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-7.x
• Merge into: main
• Upgrade actions/checkout to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
• Upgrade actions/checkout to v7.0.0

Update actions/upload-artifact action to v7

• Schedule: ["at any time"]
• Branch name: renovate/major-github-artifact-actions
• Merge into: main
• Upgrade actions/upload-artifact to 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

Update github/codeql-action action to v4

• Schedule: ["at any time"]
• Branch name: renovate/github-codeql-action-4.x
• Merge into: main
• Upgrade github/codeql-action to v4

Update module github.com/lestrrat-go/jwx/v2 to v4

• Schedule: ["at any time"]
• Branch name: renovate/github.com-lestrrat-go-jwx-v2-4.x
• Merge into: main
• Upgrade github.com/lestrrat-go/jwx/v2 to v4.1.0

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

• Failed to look up docker package artifactory.algol60.net/docker.io/library/golang: no-result
• Failed to look up docker package artifactory.algol60.net/docker.io/alpine: no-result

Files affected: Dockerfile.CSM

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.