From da0d3aed1a5285344fd6fd51340f3dba84bb06fe Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 6 Oct 2026 08:14:21 +0200 Subject: [PATCH] fix(renovate): offer Talos patch releases while a minor upgrade is parked Renovate proposes only the newest non-major release of a dependency, so while the v1.14 upgrade waits on its migration no patch for the running v1.13 line is offered. separateMinorPatch gives the talos group a second branch for patch releases. Part of #3388 Co-Authored-By: Claude Opus 5.5 --- .github/renovate.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/renovate.json b/.github/renovate.json index 6730b78674..9dc9abf9f4 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -251,9 +251,10 @@ "groupName": "crossplane aws providers" }, { - "description": "Talos Linux distribution upgrades (tracked by the custom manager above; depName siderolabs/talos). The Go module github.com/siderolabs/talos/pkg/machinery is grouped into the same PR because its version tracks the Talos release line exactly and the repository's Kubernetes/Talos compatibility check reads it, so a Talos bump that arrives without it fails that check. Renovate opens the PR automatically — the same flow as every other dependency, with no Dependency Dashboard approval gate. It is NOT automerged: the custom manager bumps the talos.version pin in ksail.prod.yaml (KSail derives the installer image from it plus the extensions list), but the Hetzner iso snapshot id in ksail.prod.yaml is not a version string and cannot be auto-derived, and a lockstep kubernetesVersion bump may be needed when Talos's supported Kubernetes range moves. CI's system-test also runs off ksail.yaml (docker), so it never boots this prod config. A maintainer completes the iso (and any kubernetesVersion) edit on the open PR, and also sets TALOSCTL_SHA256 in .github/scripts/setup-talosctl.sh: Renovate moves TALOS_VERSION there but cannot compute an asset checksum, so the CI setup step fails closed and, when the served bytes match the release's published sha256sum.txt, prints the exact value to set. prBodyNotes repeats this checklist on every Talos PR. Then merges. automerge:false is placed last so it overrides the broad talos/** and major-update automerge rules above.", + "description": "Talos Linux distribution upgrades (tracked by the custom manager above; depName siderolabs/talos). The Go module github.com/siderolabs/talos/pkg/machinery is grouped into the same PR because its version tracks the Talos release line exactly and the repository's Kubernetes/Talos compatibility check reads it, so a Talos bump that arrives without it fails that check. Renovate opens the PR automatically — the same flow as every other dependency, with no Dependency Dashboard approval gate. It is NOT automerged: the custom manager bumps the talos.version pin in ksail.prod.yaml (KSail derives the installer image from it plus the extensions list), but the Hetzner iso snapshot id in ksail.prod.yaml is not a version string and cannot be auto-derived, and a lockstep kubernetesVersion bump may be needed when Talos's supported Kubernetes range moves. CI's system-test also runs off ksail.yaml (docker), so it never boots this prod config. A maintainer completes the iso (and any kubernetesVersion) edit on the open PR, and also sets TALOSCTL_SHA256 in .github/scripts/setup-talosctl.sh: Renovate moves TALOS_VERSION there but cannot compute an asset checksum, so the CI setup step fails closed and, when the served bytes match the release's published sha256sum.txt, prints the exact value to set. prBodyNotes repeats this checklist on every Talos PR. Then merges. automerge:false is placed last so it overrides the broad talos/** and major-update automerge rules above. separateMinorPatch gives patch releases their own branch (renovate/patch-talos) beside the minor one (renovate/talos): without it Renovate proposes only the newest non-major release, so while a minor upgrade waits on a migration — v1.14 sat parked for weeks — no patch for the running release line is ever offered (#3388).", "matchPackageNames": ["siderolabs/talos", "github.com/siderolabs/talos/pkg/machinery"], "groupName": "talos", + "separateMinorPatch": true, "automerge": false, "addLabels": ["talos"], "prBodyNotes": [