[PR #1689] [CLOSED] [WIP] Add regexManager for detecting pip install pins in workflows #3047

New issue

Closed

opened 2026-03-01 18:42:31 +03:00 by kerem · 0 comments

kerem commented

2026-03-01 18:42:31 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netbootxyz/netboot.xyz/pull/1689
Author: @Copilot
Created: 11/1/2025
Status: ❌ Closed

Base: development ← Head: copilot/add-regex-manager-for-workflow-files

📝 Commits (1)

9fb4553 Initial plan

📄 Description

Understand the current renovate.json configuration and workflow files
Update renovate.json to add regexManagers for detecting pip install patterns in workflow files
Validate the regex patterns match the pip install commands in pull-requests.yml
Test the renovate.json syntax is valid JSON
Complete implementation

Original prompt

Problem: Renovate is not picking up ansible and ansible-lint pinned versions in the PR test job because those pins are inside workflow run steps (pip install ...) and not in a standard dependency file. We want Renovate to automatically detect and update these inline pip install pins inside .github/workflows/*.yml files.

Goal: Add a regexManager to renovate.json that scans workflow YAML files for pip install package==version patterns and configures Renovate to treat those as PyPI dependencies so it can open PRs updating the pinned versions.

Files to change:

renovate.json (update to include regexManagers for workflow files)

Proposed change (new renovate.json content):
{
  "extends": [
    "config:recommended"
  ],
  "regexManagers": [
    {
      "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"],
      "matchStrings": [
        "(?:pip(?:3)? install)\\s+([^=\\s]+)==(?<currentValue>\\d+(?:\\.\\d+){0,})"
      ],
      "datasourceTemplate": "pypi",
      "depNameTemplate": "$1"
    },
    {
      "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"],
      "matchStrings": [
        "(?:pip(?:3)? install)\\s+-r\\s+([^\\s]+)"
      ],
      "datasourceTemplate": "file",
      "depNameTemplate": "$1"
    }
  ]
}
Notes and rationale:

The first regexManager scans workflow YAML files for pip install == and maps the captured package name to a PyPI datasource so Renovate can lookup new versions and create PRs.

fileMatch restricts scanning to .github/workflows YAML files to avoid false positives elsewhere.

The second regexManager is a helper to detect pip install -r requirements.txt style calls; it uses the file datasource so Renovate will then parse that requirements file with the built-in pip manager if present.

This keeps dependencies inline while enabling Renovate to update them. Alternatively moving deps to requirements.txt remains an option for future cleanup.

Acceptance criteria:

renovate.json is updated on a new branch and a pull request is opened.

Renovate runs subsequently and creates PRs to update pinned PyPI packages found in workflows (e.g. ansible and ansible-lint). If Renovate does not auto-run immediately, maintainers can trigger a run or wait for the next scheduled run.

Please create a branch and open a pull request implementing the change above in repository netbootxyz/netboot.xyz. Do not change other files.

This pull request was created as a result of the following prompt from Copilot chat.

Problem: Renovate is not picking up ansible and ansible-lint pinned versions in the PR test job because those pins are inside workflow run steps (pip install ...) and not in a standard dependency file. We want Renovate to automatically detect and update these inline pip install pins inside .github/workflows/*.yml files.

Goal: Add a regexManager to renovate.json that scans workflow YAML files for pip install package==version patterns and configures Renovate to treat those as PyPI dependencies so it can open PRs updating the pinned versions.

Files to change:

renovate.json (update to include regexManagers for workflow files)

Proposed change (new renovate.json content):
{
  "extends": [
    "config:recommended"
  ],
  "regexManagers": [
    {
      "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"],
      "matchStrings": [
        "(?:pip(?:3)? install)\\s+([^=\\s]+)==(?<currentValue>\\d+(?:\\.\\d+){0,})"
      ],
      "datasourceTemplate": "pypi",
      "depNameTemplate": "$1"
    },
    {
      "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"],
      "matchStrings": [
        "(?:pip(?:3)? install)\\s+-r\\s+([^\\s]+)"
      ],
      "datasourceTemplate": "file",
      "depNameTemplate": "$1"
    }
  ]
}
Notes and rationale:

The first regexManager scans workflow YAML files for pip install == and maps the captured package name to a PyPI datasource so Renovate can lookup new versions and create PRs.

fileMatch restricts scanning to .github/workflows YAML files to avoid false positives elsewhere.

The second regexManager is a helper to detect pip install -r requirements.txt style calls; it uses the file datasource so Renovate will then parse that requirements file with the built-in pip manager if present.

This keeps dependencies inline while enabling Renovate to update them. Alternatively moving deps to requirements.txt remains an option for future cleanup.

Acceptance criteria:

renovate.json is updated on a new branch and a pull request is opened.

Renovate runs subsequently and creates PRs to update pinned PyPI packages found in workflows (e.g. ansible and ansible-lint). If Renovate does not auto-run immediately, maintainers can trigger a run or wait for the next scheduled run.

Please create a branch and open a pull request implementing the change above in repository netbootxyz/netboot.xyz. Do not change other files.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netbootxyz/netboot.xyz/pull/1689 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 11/1/2025 **Status:** ❌ Closed **Base:** `development` ← **Head:** `copilot/add-regex-manager-for-workflow-files` --- ### 📝 Commits (1) - [`9fb4553`](https://github.com/netbootxyz/netboot.xyz/commit/9fb4553185b9c76ce6488be1bf72099ec0139fbc) Initial plan ### 📄 Description - [ ] Understand the current renovate.json configuration and workflow files - [ ] Update renovate.json to add regexManagers for detecting pip install patterns in workflow files - [ ] Validate the regex patterns match the pip install commands in pull-requests.yml - [ ] Test the renovate.json syntax is valid JSON - [ ] Complete implementation  <details> <summary>Original prompt</summary> > Problem: Renovate is not picking up ansible and ansible-lint pinned versions in the PR test job because those pins are inside workflow run steps (pip install ...) and not in a standard dependency file. We want Renovate to automatically detect and update these inline pip install pins inside .github/workflows/*.yml files. > > Goal: Add a regexManager to renovate.json that scans workflow YAML files for pip install package==version patterns and configures Renovate to treat those as PyPI dependencies so it can open PRs updating the pinned versions. > > Files to change: > - renovate.json (update to include regexManagers for workflow files) > > Proposed change (new renovate.json content): > ```json name=renovate.json url=https://github.com/netbootxyz/netboot.xyz/blob/cc9587dd38e229bee7bcbfb81f0a468f12bf3095/renovate.json > { > "extends": [ > "config:recommended" > ], > "regexManagers": [ > { > "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"], > "matchStrings": [ > "(?:pip(?:3)? install)\\s+([^=\\s]+)==(?<currentValue>\\d+(?:\\.\\d+){0,})" > ], > "datasourceTemplate": "pypi", > "depNameTemplate": "$1" > }, > { > "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"], > "matchStrings": [ > "(?:pip(?:3)? install)\\s+-r\\s+([^\\s]+)" > ], > "datasourceTemplate": "file", > "depNameTemplate": "$1" > } > ] > } > ``` > > Notes and rationale: > - The first regexManager scans workflow YAML files for pip install <package>==<version> and maps the captured package name to a PyPI datasource so Renovate can lookup new versions and create PRs. > - fileMatch restricts scanning to .github/workflows YAML files to avoid false positives elsewhere. > - The second regexManager is a helper to detect pip install -r requirements.txt style calls; it uses the file datasource so Renovate will then parse that requirements file with the built-in pip manager if present. > - This keeps dependencies inline while enabling Renovate to update them. Alternatively moving deps to requirements.txt remains an option for future cleanup. > > Acceptance criteria: > - renovate.json is updated on a new branch and a pull request is opened. > - Renovate runs subsequently and creates PRs to update pinned PyPI packages found in workflows (e.g. ansible and ansible-lint). If Renovate does not auto-run immediately, maintainers can trigger a run or wait for the next scheduled run. > > Please create a branch and open a pull request implementing the change above in repository netbootxyz/netboot.xyz. Do not change other files. > </details> *This pull request was created as a result of the following prompt from Copilot chat.* > Problem: Renovate is not picking up ansible and ansible-lint pinned versions in the PR test job because those pins are inside workflow run steps (pip install ...) and not in a standard dependency file. We want Renovate to automatically detect and update these inline pip install pins inside .github/workflows/*.yml files. > > Goal: Add a regexManager to renovate.json that scans workflow YAML files for pip install package==version patterns and configures Renovate to treat those as PyPI dependencies so it can open PRs updating the pinned versions. > > Files to change: > - renovate.json (update to include regexManagers for workflow files) > > Proposed change (new renovate.json content): > ```json name=renovate.json url=https://github.com/netbootxyz/netboot.xyz/blob/cc9587dd38e229bee7bcbfb81f0a468f12bf3095/renovate.json > { > "extends": [ > "config:recommended" > ], > "regexManagers": [ > { > "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"], > "matchStrings": [ > "(?:pip(?:3)? install)\\s+([^=\\s]+)==(?<currentValue>\\d+(?:\\.\\d+){0,})" > ], > "datasourceTemplate": "pypi", > "depNameTemplate": "$1" > }, > { > "fileMatch": ["^\\.github\\/workflows\\/.*\\.ya?ml$"], > "matchStrings": [ > "(?:pip(?:3)? install)\\s+-r\\s+([^\\s]+)" > ], > "datasourceTemplate": "file", > "depNameTemplate": "$1" > } > ] > } > ``` > > Notes and rationale: > - The first regexManager scans workflow YAML files for pip install <package>==<version> and maps the captured package name to a PyPI datasource so Renovate can lookup new versions and create PRs. > - fileMatch restricts scanning to .github/workflows YAML files to avoid false positives elsewhere. > - The second regexManager is a helper to detect pip install -r requirements.txt style calls; it uses the file datasource so Renovate will then parse that requirements file with the built-in pip manager if present. > - This keeps dependencies inline while enabling Renovate to update them. Alternatively moving deps to requirements.txt remains an option for future cleanup. > > Acceptance criteria: > - renovate.json is updated on a new branch and a pull request is opened. > - Renovate runs subsequently and creates PRs to update pinned PyPI packages found in workflows (e.g. ansible and ansible-lint). If Renovate does not auto-run immediately, maintainers can trigger a run or wait for the next scheduled run. > > Please create a branch and open a pull request implementing the change above in repository netbootxyz/netboot.xyz. Do not change other files. >  --- ✨ Let Copilot coding agent [set things up for you](https://github.com/netbootxyz/netboot.xyz/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-03-01 18:42:31 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/netboot.xyz#3047

No description provided.

Rows
Columns