From 716306c914de0fc9cc0d21bef072951d94f6342b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andrei=20C=C4=83uti=C8=99anu?=
 <andreicautisanu@Andreis-MacBook-Pro.local>
Date: Wed, 14 Oct 2026 11:58:33 +0300
Subject: [PATCH] [DND-1779] Onboard to central Renovate with the security
 preset

Extends github>comet-ml/renovate-config:security for the images this chart
ships inside the self-hosted release: busybox from values.yaml, and the
s3proxy image, whose tag defaults to the chart's appVersion, through a small
regex manager on Chart.yaml. s3proxy 3.3.0 -> 4.x is a major, so it waits
for a Dependency Dashboard tick.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/renovate.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .github/renovate.json

diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..8e02282
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>comet-ml/renovate-config:security"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "The s3proxy image tag defaults to the chart's appVersion, which helm-values can't see",
+      "managerFilePatterns": ["/(^|/)charts/s3proxy/Chart\\.yaml$/"],
+      "matchStrings": ["appVersion:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"],
+      "depNameTemplate": "andrewgaul/s3proxy",
+      "datasourceTemplate": "docker"
+    }
+  ]
+}