ni/python-renovate-config

ni/python-renovate-config is a Git repository containing Renovate configurations for NI Python projects.

Table of Contents

• ni/python-renovate-config
  • Table of Contents
  • default.json
  • recommended.json
  • Presets
    • presets/enableGitSubmodules.json
    • presets/enableVulnerabilityAlerts.json
    • Group Presets
      • presets/group/githubActions.json
      • presets/group/python.json
    • Packages Presets
      • presets/packages/niPython.json

default.json

The default configuration includes settings that are common to all NI Python projects.

• Extends config:recommended
• Branch prefix: users/renovate
• Time zone: US/Central

recommended.json

The recommended configuration includes settings that are recommended for all NI Python projects, but which some project owners may want to configure differently.

• Extends default.json
• Updates GitHub Actions on Sundays
• Updates Python packages on Sundays
• Runs lock file maintenance monthly in order to upgrade indirect dependencies that are not covered by the weekly update, such as certifi or typing_extensions.
• Enables vulnerability alerts (presets/enableVulnerabilityAlerts.json)
• Pins GitHub Action digests to semver (helpers:pinGitHubActionDigestsToSemver). This pins the digest hash so that builds are reproducible even if upstream updates their Git tags. It also adds a comment showing the version and treats the version as semantic versioning. For example, this converts uses: actions/checkout@v4 to uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2.
• Rebases stale PRs (:rebaseStalePrs)
• Sets minimumReleaseAge to 14 days by default and 1 day for ni/python-actions and NI Python packages. If an upstream package is compromised, delaying makes it more likely that the compromised version will be detected and pulled from the repository before we try to upgrade. This should not affect security vulnerability alerts.

  • If your project uses Poetry, you should also configure Poetry's solver.min-release-age setting and solver.min-release-age-exclude settings:

    # poetry.toml
    [solver]
    # Set min-release-age to 2 weeks, same as in https://github.com/ni/python-renovate-config
    min-release-age = 14
    min-release-age-exclude = ["ni-python-styleguide"]

    Without this configuration, Renovate may display an "Artifact update problem" because poetry update updated a dependency to a newer version than Renovate was expecting.

    You should also rerun poetry lock with Poetry 2.4.x or later and make sure the comment at the top of poetry.lock says "# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand." Renovate uses this comment to decide which version of Poetry to run. If Renovate uses Poetry 2.3.x or earlier, the solver.min-release-age setting is ignored.

Using Outside of GitHub repos

If Renovate is running somewhere that cannot resolve this repository's local> preset references, use the generated mirror under docs/ instead of referencing the repository root files directly.

Example:

{
  "extends": [
    "https://ni.github.io/python-renovate-config/recommended.json"
  ]
}

PR builds validate that docs/ is in sync, and a script is provided to keep it in sync.

Presets

presets/enableGitSubmodules.json

• Enables the git-submodules manager.

presets/enableVulnerabilityAlerts.json

• Extends :enableVulnerabilityAlerts
• Enables osvVulnerabilityAlerts

Group Presets

presets/group/githubActions.json

Group GitHub Actions together.

presets/group/python.json

Group Python packages together.

Packages Presets

presets/packages/niPython.json

Matches all NI Python packages.