[vannt-dev]

Found by the first real Renovate run on GitLab, on the python pilot project.

What went wrong

Renovate reads .gitlab-ci.yml like any other file, and repokeeper's own jobs there name images with a version: renovate/renovate:44.128.1, node:24, the .NET SDK of the dotnet and powershell jobs. Renovate's first run opened a merge request that raised the renovate/renovate tag: an edit to a managed key. Merged, it would be reported by repokeeper check and taken back by the next repokeeper update; and since that image is named to the patch, a new one would come every week.

The fix

The generated renovate.json gets one more package rule: in .gitlab-ci.yml, the images repokeeper's jobs pin to a version are not updated. They are the standard's to move, with repokeeper update.

{
  "matchManagers": ["gitlabci"],
  "matchFileNames": [".gitlab-ci.yml"],
  "matchPackageNames": ["node", "renovate/renovate", "mcr.microsoft.com/dotnet/sdk"],
  "enabled": false
}

A test builds the CI file of every fixture on GitLab and fails when one of repokeeper's jobs pins an image that is not on this list (seen failing with an entry taken out).

One side effect, documented in docs/gitlab.md: a job of the user's own in .gitlab-ci.yml that uses one of these images is not updated either.

Only GitLab's renovate.json changes, so the standard stays 1.4.3, as with the earlier changes to the GitLab output.

Tested on GitLab

With a build of this branch, packed and installed as the published package would be, on the private pilot repokeeper-demo-gitlab-python:

• Before: Renovate's run opened !2, "update renovate/renovate docker tag to v44.149.2", against the managed renovate job, and its dashboard listed node 24 (twice) and renovate/renovate under .gitlab-ci.yml.
• repokeeper update wrote the new rule into renovate.json; pushed; the Renovate schedule run again.
• After: Renovate closed !2 itself ("autoclosed") and deleted its branch; no merge request is open; the dashboard lists only the pilot's own image (alpine 3) under .gitlab-ci.yml. The project's own dependencies (pyproject.toml) are still listed.

npm run lint, npm run typecheck, npm test (426 tests).

Also in the docs

Renovate's run warned that github.com limits requests without a token, and skipped release notes. docs/gitlab.md now names the optional GITHUB_COM_TOKEN variable. That variable was not tried on the pilot.

Not tested

• A project with the dotnet or powershell stack on GitLab: the rule's third entry is covered by the unit test only.
• A node major: none was on offer during the runs, so that the rule holds it back was not seen, only that node left the dashboard's list.

🤖 Generated with Claude Code