From 6298682a5542c7ea8c47ab3ed2bbde5a43bf9ea1 Mon Sep 17 00:00:00 2001
From: Jeffrey Clark <h0tw1r3@users.noreply.github.com>
Date: Mon, 22 Jun 2026 11:38:44 -0500
Subject: [PATCH 1/3] derive alternate versions

---
 Makefile         | 2 ++
 dependencies.env | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c38eba1..6c7a81e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,7 @@
 # image and tool versions
 include dependencies.env
+FLANNEL_MINI_VERSION = $(shell echo "$(FLANNEL_VERSION)" | sed 's/-flannel[0-9]*//')
+BINFMT_QEMU_VERSION = $(shell echo "$(BINFMT_VERSION)" | sed 's|deploy/v||;s/-[0-9]*$$//')
 
 # runtime
 RUNTIME ?= docker
diff --git a/dependencies.env b/dependencies.env
index 9572740..7eb1ed8 100644
--- a/dependencies.env
+++ b/dependencies.env
@@ -1,8 +1,6 @@
 UBUNTU_VERSION="24.04"
 UBUNTU_CODENAME="noble"
 BINFMT_VERSION="deploy/v7.0.0-28"
-BINFMT_QEMU_VERSION="7.0.0"
 DOCKER_VERSION="29.5.2"
 NERDCTL_VERSION="2.3.1"
 FLANNEL_VERSION="1.9.1-flannel1"
-FLANNEL_MINI_VERSION="1.9.1"

From fa12f4c0a6c823e692ace98cbe672d0c315d6007 Mon Sep 17 00:00:00 2001
From: Jeffrey Clark <h0tw1r3@users.noreply.github.com>
Date: Mon, 22 Jun 2026 11:55:56 -0500
Subject: [PATCH 2/3] use renovate to keep versions up to date

---
 .github/chainguard/renovate.sts.yaml | 11 ++++++
 .github/renovate.json                | 52 ++++++++++++++++++++++++++++
 .github/workflows/renovate.yml       | 36 +++++++++++++++++++
 3 files changed, 99 insertions(+)
 create mode 100644 .github/chainguard/renovate.sts.yaml
 create mode 100644 .github/renovate.json
 create mode 100644 .github/workflows/renovate.yml

diff --git a/.github/chainguard/renovate.sts.yaml b/.github/chainguard/renovate.sts.yaml
new file mode 100644
index 0000000..3116f32
--- /dev/null
+++ b/.github/chainguard/renovate.sts.yaml
@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+subject: repo:btolab/colima-core:ref:refs/heads/main
+
+permissions:
+  checks: write
+  contents: write
+  issues: write
+  members: read
+  pull_requests: write
+  statuses: write
+  workflows: write
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..61fe835
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,52 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    "helpers:pinGitHubActionDigestsToSemver"
+  ],
+  "minimumReleaseAge": "1 day",
+  "prHourlyLimit": 0,
+  "automergeType": "pr",
+  "packageRules": [
+    {
+      "description": "Automerge safe updates (patch) plus digest updates once checks pass",
+      "matchUpdateTypes": ["patch", "digest"],
+      "automerge": true
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["DOCKER_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "moby/moby",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["NERDCTL_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "containerd/nerdctl",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["FLANNEL_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "flannel-io/cni-plugin",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$",
+      "versioningTemplate": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-flannel(?<build>\\d+)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["BINFMT_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "tonistiigi/binfmt",
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "regex:^deploy/v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-(?<build>\\d+)$"
+    }
+  ]
+}
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 0000000..a4813a1
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,36 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: renovate
+
+      - uses: renovatebot/github-action@v46.1.16
+        with:
+          configurationFile: .github/renovate.json
+        env:
+          RENOVATE_TOKEN: ${{ steps.octo-sts.outputs.token }}
+          RENOVATE_REPOSITORIES: ${{ github.repository }}

From 50c4713929fab3da4319119d0117ded31e2b94c1 Mon Sep 17 00:00:00 2001
From: "octo-sts[bot]" <157150467+octo-sts[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 18:00:16 +0000
Subject: [PATCH 3/3] Update actions/download-artifact action to v4.3.0

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f122d5d..ce35fb1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,7 +64,7 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: dist/img