Files
Michael Kriese 55a7341be2 test(manager): close long-tail branch coverage gaps (#45954)
* test(manager): close azure-pipelines, bundler and cocoapods gaps

Adds a pipeline whose step task is not versioned, so nothing is
extracted, and a gem lock line carrying no version, which is skipped.

Marks four guards that cannot be false: `extractContainer()` always
returns a dep, `getLockFilePath()` always returns a path, and the
cocoapods dep name, spec name and git account all derive from values
their enclosing check already proved present.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): close cargo, composer and cpanfile gaps

Adds a composer repository map that disables something other than
packagist, which is dropped rather than recorded.

Marks five guards: the cargo warning only fires for a crate dep and its
retry only runs when a dep was already current, a gitlab rule without a
token never passes the auth check, and both cpanfile handlers run only
once their match produced a value.

Two implicit elses stay counted, in the cargo version resolver and the
composer repository mapper, since a coverage-ignore hint does not attach
to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): close deps-edn, docker-compose and dockerfile gaps

Adds three extractions: a deps.edn alias whose value is not a map, a
compose extension carrying no image, and a dockerfile escape directive
naming a character other than a backtick, which leaves the default in
place.

Marks the deps-edn repository name check, since object keys are always
strings, and notes the repository spec chain, where a coverage-ignore
hint does not attach to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager/flux): close the flux coverage gaps

Adds two GitRepository resources whose url is ssh rather than http, one
pinned to a tag and one to a commit. Neither yields a source url, since
only http urls can be turned into one.

Marks the Kustomization image guard: the schema rejects an image without
a name, so `extractImage()` cannot return null there.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): mark github-actions, gitlabci and glasskube guards

None of these six needs a test. A parsed action ref is either a docker
or a repository ref, `getDep()` always returns a dep for a job container
and a service, and the remaining three need a listed file that cannot be
read, a listed file that yields no deps, or a manifest whose
repositories match no name.

The glasskube resource kind chain stays counted, since a coverage-ignore
hint does not attach to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): mark gomod and gradle-wrapper guards

Four guards that need setups no test provides: a removed dep that is not
added back, a go.mod the replace massaging leaves unchanged, and a
daemon-jvm file carrying no toolchain version. A parsed go directive
always yields a version.

The additional-dependency count chain stays counted, since a
coverage-ignore hint does not attach to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

---------

Co-authored-by: Claude Opus 5 <michael.kriese+claude-code@mend.io>
2026-09-15 07:10:10 +00:00
..

This manager parses Flux YAML manifests and supports:

  1. HelmRelease resources
  2. GitRepository resources
  3. OCIRepository resources
  4. Flux system manifests

HelmRelease support

Extracts helm dependencies from HelmRelease resources.

The flux manager extracts helm dependencies for HelmRelease resources linked to HelmRepository or GitRepository sources. HelmRepository resources can be referenced via spec.chart or indirectly via a HelmChart when using spec.chartRef. Renovate supports OCI HelmRepository sources, those with type: oci. Renovate will then extract the docker dependencies for the referenced HelmRelease resources.

In addition, for the flux manager to properly link HelmRelease and HelmRepository resources, both of the following conditions must be met:

  1. The HelmRelease resource must either have its metadata.namespace property set or its spec.chart.spec.sourceRef.namespace property (when not using chartRef) set
  2. The referenced HelmRepository and HelmChart (when using chartRef) resources must have their metadata.namespace property set

Namespaces will not be inferred from the context (e.g. from the parent Kustomization).

Renovate updates HelmRelease resources coming from GitRepository by updating the GitRepository resource.

Renovate updates Docker dependencies inside HelmRelease values like the helm-values manager.

When a referenced HelmRepository resource is not present in the scanned manifests (for example, it is defined in another repository or as a cluster-global resource), you can statically map the sourceRef.name of the HelmRelease (or HelmChart) to a registry URL using registryAliases in your flux configuration:

{
  "packageRules": [
    {
      "matchManagers": ["flux"],
      "matchDatasources": ["helm"],
      "registryAliases": {
        "podinfo-repo": "https://stefanprodan.github.io/podinfo"
      }
    }
  ]
}

In this example, a HelmRelease whose spec.chart.spec.sourceRef.name is podinfo-repo will be treated as if it were backed by a HelmRepository with URL https://stefanprodan.github.io/podinfo.

GitRepository support

Renovate can update git references from GitRepository resources.

The flux manager only updates GitRepository fields that have a tag or commit key. When commit is being updated, if a branch key is also present, only commits from that branch will be considered.

Kustomization support

Renovate can update image1 references from Kustomization resources.

OCIRepository support

Renovate can update oci references from OCIRepository resources.

The flux manager updates OCIRepository fields that have a digest, tag or both keys.

Flux system manifests support

Renovate supports updating Flux system manifests generated during Flux installation. System manifests are identified via being named gotk-components.y(a)ml and containing comment headers as generated by flux bootstrap.

!!! warning Renovate cannot identify the use of custom bootstrap flags, such as --cluster-domain. In such a scenario Renovate's PR will overwrite these values with the Flux defaults. See issue #13952 on GitHub for more information.

Updating system manifests requires that either:

  1. The flux tool is pre-installed, or
  2. You run a Docker image based on containerbase, such as the official Renovate images, and have binarySource=install configured

Default managerFilePatterns

By default, the flux manager only matches **/gotk-components.y(a)ml. So it only checks system manifest files generated by the flux bootstrap command.

This is because there is no commonly accepted file/directory naming convention for Flux manifests and we don't want to check every single *.yaml file in repositories just in case some of them have Flux definitions.

If most .yaml files in your repository are Flux manifests, then you could add this to your config:

{
  "flux": {
    "managerFilePatterns": ["/\\.yaml$/"]
  }
}

If instead you have all your Flux manifests inside a flux/ directory, you would add this:

{
  "flux": {
    "managerFilePatterns": ["/flux/.+\\.yaml$/"]
  }
}

Versioning

If you need to change the versioning format, read the versioning documentation to learn more.