Add renovate.json configuration

CONTRIBUTING.md

@@ -41,14 +41,16 @@ The following are required to build the devfile index container image containing
 
     - Make sure the name matches the devfile stack's name and be in the format `<language>-<framework>`. E.g. `java-quarkus`, `python-django`, etc.
 
-5) Add the devfile.yaml and any other necessary files for the stack under the stack folder.
+5) In case one of your components has a reference to an image, use a fixed version tag (e.g `<image>:1.1.0`) instead of `latest`. Our renovate bot will take care of the updates to the image tags.
 
-6) Run the `.ci/build.sh` to build the registry into a container image.
+6) Add the devfile.yaml and any other necessary files for the stack under the stack folder.
 
+7) Run the `.ci/build.sh` to build the registry into a container image.
+
     - This will also validate the devfiles in this repository, making sure they conform to a minimum standard.
     - This step will also be run in the PR build for the repository.
 
-7) Open a pull request against this repository with a brief description of the change.
+8) Open a pull request against this repository with a brief description of the change.
 
 #### Updating
 
@@ -64,7 +66,11 @@ Updating an existing devfile stack is relatively straightforward:
     - Minimally, testing with odo v2 (`odo create`, `odo push`, etc) and odo v3 (`odo init`, `odo dev`, etc) is recommended, however if your Devfile is used with other tools, it's recommended to test there as well.
 5) Open a pull request against this repository with your changes.
 
-### Samples
+### Automatic Stack Image Update
+
+As images used inside the stacks need to be up-to-date and in order to avoid using the `latest` tag, the renovate bot runs periodically ensuring that all images used from stacks (for example, inside components) have the latest version. As a result, all images used inside a devfile of a stack need to have a fixed version (e.g `1.1.0`) instead of `latest`.
+
+## Samples
 
 #### Contributing
 

renovate.json

@@ -0,0 +1,39 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+      "config:base",
+      "helpers:pinGitHubActionDigests"
+    ],
+    "enabledManagers": ["regex", "github-actions"],
+    "regexManagers": [
+      {
+        "fileMatch": [
+          "devfile.*y[a]?ml$"
+        ],
+        "matchStrings": [
+          "image: (?<depName>\\S*):(?<currentValue>\\S*)"
+        ],
+        "datasourceTemplate": "docker",
+        "depNameTemplate": "{{{depName}}}"
+      }
+    ],
+    "packageRules": [
+        {
+          "matchManagers": ["github-actions"],
+          "groupName": "github actions",
+          "groupSlug": "github-actions",
+          "commitMessageTopic": "{{depName}}"
+        }
+    ],
+    "ignorePaths": [
+      "**/docker/**",
+      ".ci/**",
+      "tests/**",
+      "stacks/java-openliberty/**",
+      "stacks/java-openliberty-gradle/**",
+      "stacks/java-websphereliberty/**",
+      "stacks/java-websphereliberty-gradle/**"
+    ],
+    "prHourlyLimit": 20,
+    "prConcurrentLimit": 5
+  }

stacks/nodejs/2.1.1/devfile.yaml

@@ -19,7 +19,7 @@ starterProjects:
 components:
   - name: runtime
     container:
-      image: registry.access.redhat.com/ubi8/nodejs-16:latest
+      image: registry.access.redhat.com/ubi8/nodejs-16:1-105.1684740145
       args: ['tail', '-f', '/dev/null']
       memoryLimit: 1024Mi
       mountSources: true