Configure renovation of cert-manager version

[erikgb]

I noticed that the cert-manager version in the cert-manager module was outdated. This should make Renovate suggest upgrades for it (ungrouped).

[octo-sts]

Reconfigure PR Results

This is a reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:

---

Detected Package Files

• .github/workflows/base-images-upgrade.yaml (github-actions)
• .github/workflows/e2e-test.yaml (github-actions)
• .github/workflows/kind-images-upgrade.yaml (github-actions)
• .github/workflows/renovate.yaml (github-actions)
• .github/workflows/validate-renovate-config.yaml (github-actions)
• modules/go/base/.github/workflows/govulncheck.yaml (github-actions)
• modules/repository-base/base/.github/workflows/make-self-upgrade.yaml (github-actions)
• modules/repository-base/base/.github/workflows/renovate.yaml (github-actions)
• modules/olm-bundle/olm-to-oci/go.mod (gomod)
• tests/e2e-projects/test-project/go.mod (gomod)
• modules/tools/00_mod.mk (regex)
• modules/tools/00_mod.mk (regex)
• modules/tools/00_mod.mk (regex)
• modules/tools/00_mod.mk (regex)

Configuration Summary

Based on the default config's presets, Renovate will:

• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Pin Docker digests.
• Pin github-action digests.
• Enable Renovate configuration migration PRs when needed.
• Pin dependency versions for development dependencies.
• Recommended configuration for abandoned packages, treating packages without a release for 1 year as abandoned, while taking into account community-sourced overrides.
• Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.
• Update _VERSION environment variables in GitHub Action files.
• Append Signed-off-by: to signoff Git commits.
• Use semantic prefixes for commit messages and PR titles.
• Disable vulnerability alerts completely.
• Remove hourly and concurrent rate limits.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Pin Docker digests.
• Pin github-action digests.
• Enable Renovate configuration migration PRs when needed.
• Pin dependency versions for development dependencies.
• Recommended configuration for abandoned packages, treating packages without a release for 1 year as abandoned, while taking into account community-sourced overrides.
• Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.
• Update _VERSION environment variables in GitHub Action files.
• Append Signed-off-by: to signoff Git commits.
• Use semantic prefixes for commit messages and PR titles.
• Disable vulnerability alerts completely.
• Remove hourly and concurrent rate limits.

---

What to Expect

With your current configuration, Renovate will create 3 Pull Requests:

chore(deps): update actions/checkout action to v6

• Schedule: ["at any time"]
• Branch name: renovate/major-misc-github-actions
• Merge into: main
• Upgrade actions/checkout to 1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

chore(deps): update module github.com/sigstore/cosign/v2 to v3

• Schedule: ["at any time"]
• Branch name: renovate/github.com-sigstore-cosign-v2-3.x
• Merge into: main
• Upgrade github.com/sigstore/cosign/v2 to v3.0.2

chore(deps): update renovate/renovate docker tag to v42

• Schedule: ["at any time"]
• Branch name: renovate/renovate-renovate-42.x
• Merge into: main
• Upgrade renovate/renovate to sha256:0f129ba37673d828fd03de6a9dd548492bfb7a11da33245c43cbb5a1078a8bab

[Copilot]

Pull Request Overview

This PR configures Renovate to automatically manage cert-manager version updates by adding the necessary renovate comment annotation and updating the Renovate configuration to support the cert-manager module.

• Added renovate datasource annotation to enable automatic version updates for cert-manager
• Updated Renovate configuration to process cert-manager module files alongside tools
• Restructured packageRules to ensure correct post-upgrade tasks run for each module type

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
modules/cert-manager/00_mod.mk	Added renovate comment annotation to enable version tracking for cert-manager releases
.github/renovate.json5	Extended custom regex manager to include cert-manager files; added universal postUpgradeTasks rule for image SHA learning; made file patterns more specific by adding *.mk suffix; scoped Tools group to only tools files

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[inteon]

/approve
/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment