Merge branch 'main' into fix/compose-router-rules

fix(traefik): correct AdGuard and SearXNG Compose router expressions
2026-10-06 15:10:26 +00:00 · 2026-10-06 16:05:17 +02:00
6 changed files with 55 additions and 88 deletions
@@ -138,10 +138,9 @@ jobs:
  # lets it start after a failed dependency; the needs on apply-compose are a
  # barrier, so verification begins only once both applies are done.
  verify-k8s:
-    needs: [preflight, apply-k8s, apply-compose]
+    needs: [apply-k8s, apply-compose]
    if: >-
      always() &&
-      needs.preflight.result == 'success' &&
      needs.apply-k8s.result != 'skipped' &&
      needs.apply-compose.result != 'skipped'
    runs-on: [self-hosted, linux, arch, homelab, prod]
@@ -184,11 +183,8 @@ jobs:
  # suppressing them on a rollback would hide the one run where the answer
  # matters most.
  smoke:
-    needs: [preflight, verify-k8s]
-    if: >-
-      always() &&
-      needs.preflight.result == 'success' &&
-      needs.verify-k8s.result != 'skipped'
+    needs: [verify-k8s]
+    if: always() && needs.verify-k8s.result != 'skipped'
    runs-on: [self-hosted, linux, arch, homelab, prod]
    timeout-minutes: 10
    steps:
@@ -71,7 +71,7 @@ spec:
            name: glance-config
        - name: glance-assets
          configMap:
-            name: glance-assets
+            name: glance-config
        - name: docker-socket
          hostPath:
            path: /var/run/docker.sock
@@ -1,7 +1,6 @@
 POSTGRES_ADMIN_PASSWORD=
 AUTHENTIK_DB_PASSWORD=
 GITEA_DB_PASSWORD=
-NETBOX_DB_PASSWORD=
 NETRONOME_DB_PASSWORD=
 PENPOT_DB_PASSWORD=
 STATUSPAGE_DB_PASSWORD=
@@ -19,9 +19,6 @@ data:
      "dependencyDashboard": true,
      "prCreation": "immediate",
      "labels": ["dependencies", "automated"],
-      "docker-compose": {
-        "managerFilePatterns": ["renovate/renovate-compose.yaml"]
-      },
      "helm-values": {
        "managerFilePatterns": ["/k8s/.+values\\.ya?ml$/"]
      },
@@ -32,7 +29,7 @@ data:
        {
          "customType": "regex",
          "description": "singlesource: playwright npm version pinned in npx command (k8s + compose)",
-          "managerFilePatterns": ["edu_master/k8s/playwright.yaml", "edu_master/compose.yaml"],
+          "managerFilePatterns": ["^edu_master/k8s/playwright\\.yaml$", "^edu_master/compose\\.yaml$"],
          "matchStrings": ["playwright@(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
          "datasourceTemplate": "npm",
          "depNameTemplate": "playwright"
@@ -40,24 +37,15 @@ data:
        {
          "customType": "regex",
          "description": "singlesource: PLAYWRIGHT_VERSION file",
-          "managerFilePatterns": ["edu_master/PLAYWRIGHT_VERSION"],
-          "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)(?:\\r?\\n)?$"],
+          "managerFilePatterns": ["^edu_master/PLAYWRIGHT_VERSION$"],
+          "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)$"],
          "datasourceTemplate": "pypi",
          "depNameTemplate": "playwright"
        },
-        {
-          "customType": "regex",
-          "description": "singlesource: playwright Python client version pinned in Dockerfile ARG",
-          "managerFilePatterns": ["edu_master/webinar-checker/Dockerfile"],
-          "matchStrings": ["(?:^|\\n)ARG PLAYWRIGHT_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)(?:\\r?\\n|$)"],
-          "datasourceTemplate": "pypi",
-          "depNameTemplate": "playwright",
-          "versioningTemplate": "pep440"
-        },
        {
          "customType": "regex",
          "description": "kube-prometheus-stack chart version pinned in the deploy workflow",
-          "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+          "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
          "matchStrings": ["\\|prometheus-community/kube-prometheus-stack\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
          "datasourceTemplate": "helm",
          "depNameTemplate": "kube-prometheus-stack",
@@ -66,7 +54,7 @@ data:
        {
          "customType": "regex",
          "description": "grafana/loki chart version pinned in the deploy workflow",
-          "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+          "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
          "matchStrings": ["\\|grafana/loki\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
          "datasourceTemplate": "helm",
          "depNameTemplate": "loki",
@@ -75,7 +63,7 @@ data:
        {
          "customType": "regex",
          "description": "grafana/alloy chart version pinned in the deploy workflow",
-          "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+          "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
          "matchStrings": ["\\|grafana/alloy\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
          "datasourceTemplate": "helm",
          "depNameTemplate": "alloy",
@@ -84,7 +72,7 @@ data:
        {
          "customType": "regex",
          "description": "actionlint version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)ACTIONLINT_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "github-tags",
          "depNameTemplate": "rhysd/actionlint"
@@ -92,7 +80,7 @@ data:
        {
          "customType": "regex",
          "description": "shellcheck version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)SHELLCHECK_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "github-tags",
          "depNameTemplate": "koalaman/shellcheck"
@@ -100,7 +88,7 @@ data:
        {
          "customType": "regex",
          "description": "kubeconform version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)KUBECONFORM_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "github-tags",
          "depNameTemplate": "yannh/kubeconform"
@@ -108,7 +96,7 @@ data:
        {
          "customType": "regex",
          "description": "uv version used to build the pytest venv",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)UV_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "github-tags",
          "depNameTemplate": "astral-sh/uv"
@@ -116,7 +104,7 @@ data:
        {
          "customType": "regex",
          "description": "prettier version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)PRETTIER_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "npm",
          "depNameTemplate": "prettier"
@@ -124,7 +112,7 @@ data:
        {
          "customType": "regex",
          "description": "ruff version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)RUFF_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "pypi",
          "depNameTemplate": "ruff"
@@ -132,7 +120,7 @@ data:
        {
          "customType": "regex",
          "description": "pip-audit version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)PIP_AUDIT_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "pypi",
          "depNameTemplate": "pip-audit"
@@ -140,7 +128,7 @@ data:
        {
          "customType": "regex",
          "description": "yamllint version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)YAMLLINT_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "pypi",
          "depNameTemplate": "yamllint"
@@ -148,7 +136,7 @@ data:
        {
          "customType": "regex",
          "description": "hadolint version used by the ci workflow",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)HADOLINT_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "github-tags",
          "depNameTemplate": "hadolint/hadolint"
@@ -156,7 +144,7 @@ data:
        {
          "customType": "regex",
          "description": "node version the ci workflow runs npm with",
-          "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+          "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
          "matchStrings": ["(?:^|\\n)NODE_VERSION=\"(?<currentValue>[0-9.]+)\""],
          "datasourceTemplate": "node",
          "depNameTemplate": "node"
@@ -164,7 +152,7 @@ data:
        {
          "customType": "regex",
          "description": "stakater/reloader chart version pinned in the deploy workflow",
-          "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+          "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
          "matchStrings": ["\\|stakater/reloader\\|reloader\\|(?<currentValue>[0-9.]+)\\|"],
          "datasourceTemplate": "helm",
          "depNameTemplate": "reloader",
@@ -173,7 +161,7 @@ data:
      ],
      "packageRules": [
        {
-          "description": "Automerge ordinary digest and patch updates after successful checks; specific manual-review rules below override this.",
+          "description": "Automerge digest and patch updates - safe by definition, review adds nothing, keeps the renovate queue and the deploy line short. Specific no-automerge rules below still override this for playwright, helm and majors.",
          "matchUpdateTypes": ["digest", "patch"],
          "automerge": true
        },
@@ -184,12 +172,6 @@ data:
          "groupSlug": "all-minor",
          "automerge": false
        },
-        {
-          "description": "Group ordinary patch updates; the specific groups and manual-review rules below take precedence",
-          "matchUpdateTypes": ["patch"],
-          "groupName": "all patch updates",
-          "groupSlug": "all-patch"
-        },
        {
          "description": "Keep private homelab images unchanged",
          "matchDatasources": ["docker"],
@@ -214,7 +196,7 @@ data:
          "automerge": false
        },
        {
-          "description": "Keep CI Node runtime updates in a separate, manually reviewed group",
+          "description": "CI runs npm on the node the panel image is built from - the NODE_VERSION pin in tool-versions.env and node:22-alpine in the Dockerfile are the same dependency and move as one",
          "matchPackageNames": ["node"],
          "groupName": "node runtime",
          "groupSlug": "node",
@@ -223,8 +205,6 @@ data:
        {
          "description": "Helm chart bumps change PVC fields and admission behaviour, keep them reviewable",
          "matchDatasources": ["helm"],
-          "groupName": "Helm chart {{depName}}",
-          "groupSlug": "helm-{{depName}}",
          "automerge": false
        },
        {
@@ -233,6 +213,12 @@ data:
          "dependencyDashboardApproval": true,
          "automerge": false
        },
+        {
+          "description": "Group patch updates from all sources - automerge still applies via the digest/patch rule above (helm/playwright stay manual via their own rules)",
+          "matchUpdateTypes": ["patch"],
+          "groupName": "all patch updates",
+          "groupSlug": "all-patch"
+        },
        {
          "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
          "matchDatasources": ["docker"],
@@ -2,7 +2,7 @@ services:
  renovate:
    # Kept in step with renovate/k8s/cronjob.yaml by the "renovate self-update"
    # package rule in renovate/renovate.json.
-    image: renovate/renovate:44.136.0
+    image: renovate/renovate:44.115.9
    container_name: renovate
    restart: "no"
    env_file:
@@ -8,9 +8,6 @@
  "dependencyDashboard": true,
  "prCreation": "immediate",
  "labels": ["dependencies", "automated"],
-  "docker-compose": {
-    "managerFilePatterns": ["renovate/renovate-compose.yaml"]
-  },
  "helm-values": {
    "managerFilePatterns": ["/k8s/.+values\\.ya?ml$/"]
  },
@@ -21,7 +18,7 @@
    {
      "customType": "regex",
      "description": "singlesource: playwright npm version pinned in npx command (k8s + compose)",
-      "managerFilePatterns": ["edu_master/k8s/playwright.yaml", "edu_master/compose.yaml"],
+      "managerFilePatterns": ["^edu_master/k8s/playwright\\.yaml$", "^edu_master/compose\\.yaml$"],
      "matchStrings": ["playwright@(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
      "datasourceTemplate": "npm",
      "depNameTemplate": "playwright"
@@ -29,24 +26,15 @@
    {
      "customType": "regex",
      "description": "singlesource: PLAYWRIGHT_VERSION file",
-      "managerFilePatterns": ["edu_master/PLAYWRIGHT_VERSION"],
-      "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)(?:\\r?\\n)?$"],
+      "managerFilePatterns": ["^edu_master/PLAYWRIGHT_VERSION$"],
+      "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)$"],
      "datasourceTemplate": "pypi",
      "depNameTemplate": "playwright"
    },
-    {
-      "customType": "regex",
-      "description": "singlesource: playwright Python client version pinned in Dockerfile ARG",
-      "managerFilePatterns": ["edu_master/webinar-checker/Dockerfile"],
-      "matchStrings": ["(?:^|\\n)ARG PLAYWRIGHT_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)(?:\\r?\\n|$)"],
-      "datasourceTemplate": "pypi",
-      "depNameTemplate": "playwright",
-      "versioningTemplate": "pep440"
-    },
    {
      "customType": "regex",
      "description": "kube-prometheus-stack chart version pinned in the deploy workflow",
-      "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+      "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
      "matchStrings": ["\\|prometheus-community/kube-prometheus-stack\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
      "datasourceTemplate": "helm",
      "depNameTemplate": "kube-prometheus-stack",
@@ -55,7 +43,7 @@
    {
      "customType": "regex",
      "description": "grafana/loki chart version pinned in the deploy workflow",
-      "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+      "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
      "matchStrings": ["\\|grafana/loki\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
      "datasourceTemplate": "helm",
      "depNameTemplate": "loki",
@@ -64,7 +52,7 @@
    {
      "customType": "regex",
      "description": "grafana/alloy chart version pinned in the deploy workflow",
-      "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+      "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
      "matchStrings": ["\\|grafana/alloy\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
      "datasourceTemplate": "helm",
      "depNameTemplate": "alloy",
@@ -73,7 +61,7 @@
    {
      "customType": "regex",
      "description": "actionlint version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)ACTIONLINT_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "github-tags",
      "depNameTemplate": "rhysd/actionlint"
@@ -81,7 +69,7 @@
    {
      "customType": "regex",
      "description": "shellcheck version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)SHELLCHECK_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "github-tags",
      "depNameTemplate": "koalaman/shellcheck"
@@ -89,7 +77,7 @@
    {
      "customType": "regex",
      "description": "kubeconform version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)KUBECONFORM_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "github-tags",
      "depNameTemplate": "yannh/kubeconform"
@@ -97,7 +85,7 @@
    {
      "customType": "regex",
      "description": "uv version used to build the pytest venv",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)UV_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "github-tags",
      "depNameTemplate": "astral-sh/uv"
@@ -105,7 +93,7 @@
    {
      "customType": "regex",
      "description": "prettier version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)PRETTIER_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "npm",
      "depNameTemplate": "prettier"
@@ -113,7 +101,7 @@
    {
      "customType": "regex",
      "description": "ruff version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)RUFF_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "pypi",
      "depNameTemplate": "ruff"
@@ -121,7 +109,7 @@
    {
      "customType": "regex",
      "description": "pip-audit version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)PIP_AUDIT_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "pypi",
      "depNameTemplate": "pip-audit"
@@ -129,7 +117,7 @@
    {
      "customType": "regex",
      "description": "yamllint version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)YAMLLINT_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "pypi",
      "depNameTemplate": "yamllint"
@@ -137,7 +125,7 @@
    {
      "customType": "regex",
      "description": "hadolint version used by the ci workflow",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)HADOLINT_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "github-tags",
      "depNameTemplate": "hadolint/hadolint"
@@ -145,7 +133,7 @@
    {
      "customType": "regex",
      "description": "node version the ci workflow runs npm with",
-      "managerFilePatterns": [".gitea/workflows/tool-versions.env"],
+      "managerFilePatterns": ["^\\.gitea/workflows/tool-versions\\.env$"],
      "matchStrings": ["(?:^|\\n)NODE_VERSION=\"(?<currentValue>[0-9.]+)\""],
      "datasourceTemplate": "node",
      "depNameTemplate": "node"
@@ -153,7 +141,7 @@
    {
      "customType": "regex",
      "description": "stakater/reloader chart version pinned in the deploy workflow",
-      "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+      "managerFilePatterns": ["^\\.gitea/workflows/deploy-lib\\.sh$"],
      "matchStrings": ["\\|stakater/reloader\\|reloader\\|(?<currentValue>[0-9.]+)\\|"],
      "datasourceTemplate": "helm",
      "depNameTemplate": "reloader",
@@ -162,7 +150,7 @@
  ],
  "packageRules": [
    {
-      "description": "Automerge ordinary digest and patch updates after successful checks; specific manual-review rules below override this.",
+      "description": "Automerge digest and patch updates - safe by definition, review adds nothing, keeps the renovate queue and the deploy line short. Specific no-automerge rules below still override this for playwright, helm and majors.",
      "matchUpdateTypes": ["digest", "patch"],
      "automerge": true
    },
@@ -173,12 +161,6 @@
      "groupSlug": "all-minor",
      "automerge": false
    },
-    {
-      "description": "Group ordinary patch updates; the specific groups and manual-review rules below take precedence",
-      "matchUpdateTypes": ["patch"],
-      "groupName": "all patch updates",
-      "groupSlug": "all-patch"
-    },
    {
      "description": "Keep private homelab images unchanged",
      "matchDatasources": ["docker"],
@@ -203,7 +185,7 @@
      "automerge": false
    },
    {
-      "description": "Keep CI Node runtime updates in a separate, manually reviewed group",
+      "description": "CI runs npm on the node the panel image is built from - the NODE_VERSION pin in tool-versions.env and node:22-alpine in the Dockerfile are the same dependency and move as one",
      "matchPackageNames": ["node"],
      "groupName": "node runtime",
      "groupSlug": "node",
@@ -212,8 +194,6 @@
    {
      "description": "Helm chart bumps change PVC fields and admission behaviour, keep them reviewable",
      "matchDatasources": ["helm"],
-      "groupName": "Helm chart {{depName}}",
-      "groupSlug": "helm-{{depName}}",
      "automerge": false
    },
    {
@@ -222,6 +202,12 @@
      "dependencyDashboardApproval": true,
      "automerge": false
    },
+    {
+      "description": "Group patch updates from all sources - automerge still applies via the digest/patch rule above (helm/playwright stay manual via their own rules)",
+      "matchUpdateTypes": ["patch"],
+      "groupName": "all patch updates",
+      "groupSlug": "all-patch"
+    },
    {
      "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
      "matchDatasources": ["docker"],
Author	SHA1	Message	Date
forust	dde5eac628	Merge branch 'main' into fix/compose-router-rules ci / validate (push) Skipped ci / lint-prettier (push) Skipped ci / lint-ruff (push) Skipped ci / lint-yaml (push) Skipped ci / lint-dockerfiles (push) Skipped renovate-ci / validate-renovate (push) Skipped renovate-ci / validate-renovate (pull_request) Skipped ci / lint-compose (pull_request) Successful in 11s Details ci / lint-actionlint (pull_request) Successful in 4s Details ci / lint-shellcheck (pull_request) Successful in 18s Details ci / lint-prettier (pull_request) Successful in 21s Details ci / lint-ruff (pull_request) Successful in 10s Details ci / lint-yaml (pull_request) Successful in 14s Details ci / lint-dockerfiles (pull_request) Successful in 8s Details ci / validate (pull_request) Successful in 6s Details ci / build (pull_request) Skipped Details	2026-10-06 15:10:26 +00:00
forust	7bb4e9d872	fix(traefik): correct AdGuard and SearXNG Compose router expressions renovate-ci / validate-renovate (push) Skipped ci / lint-compose (push) Successful in 9s Details ci / lint-actionlint (push) Successful in 5s Details ci / lint-shellcheck (push) Successful in 9s Details ci / lint-prettier (push) Successful in 15s Details ci / lint-ruff (push) Successful in 6s Details ci / lint-yaml (push) Successful in 10s Details ci / lint-dockerfiles (push) Successful in 5s Details ci / validate (push) Successful in 7s Details ci / build (push) Skipped Details ci / lint-compose (pull_request) Successful in 8s Details ci / lint-actionlint (pull_request) Successful in 7s Details ci / lint-shellcheck (pull_request) Successful in 8s Details ci / lint-prettier (pull_request) Successful in 18s Details ci / lint-ruff (pull_request) Successful in 7s Details ci / lint-yaml (pull_request) Successful in 11s Details ci / lint-dockerfiles (pull_request) Successful in 6s Details ci / validate (pull_request) Successful in 8s Details ci / build (pull_request) Skipped Details renovate-ci / validate-renovate (pull_request) Successful in 10s Details	2026-10-06 16:05:17 +02:00