Let renovate update Go toolchain in a single PR

.github/renovate.json5

@@ -2,11 +2,18 @@
   // self-hosted configuration
   "username": "cilium-renovate[bot]",
   "repositories": ["cilium/tetragon"],
+  // renovate first reads this configuration, then reads the repository
+  // configuration, since we don't split between the self-hosted and the
+  // repository configuration, this can lead to duplicate of some areas of the
+  // config, for example the regex. See:
+  // https://docs.renovatebot.com/self-hosted-configuration/#requireconfig
+  "requireConfig": "ignored",
   "allowedPostUpgradeCommands": [
     "^/tmp/install-buildx$", 
     "^make codegen$", 
     "^make generate$", 
-    "^install/kubernetes/test.sh$"
+    "^install/kubernetes/test.sh$",
+    "^go mod vendor$"
   ],
   // repository configuration
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
@@ -26,6 +33,7 @@
     "pkg/k8s/go.sum",
     "Dockerfile*",
     "install/kubernetes/values.yaml",
+    "Makefile.cli"
   ],
   "postUpdateOptions": [
     "gomodTidy"
@@ -74,6 +82,9 @@
       "matchFileNames": [
         ".github/workflows/**"
       ],
+      "matchManagers": [
+        "github-actions"
+      ],
       "separateMinorPatch": false,
     },
     {
@@ -203,14 +214,6 @@
         "main"
       ],
     },
-    {
-      // Images that directly use docker.io/library/golang for building.
-      "groupName": "golang-images",
-      "matchFileNames": [
-        "Dockerfile",
-        "Makefile"
-      ]
-    },
     {
       "matchPackageNames": [
         "docker.io/library/busybox"
@@ -219,12 +222,25 @@
         "Dockerfile"
       ],
     },
+    // Upgrade the Go module directive, see:
+    // https://docs.renovatebot.com/modules/versioning/#go-modules-directive-versioning
+    // depName is 'go' so it will be group with the 'Go' groupName
+    {
+      "matchDatasources": ["golang-version"],
+      "rangeStrategy": "bump",
+    },
     {
       "groupName": "Go",
       "matchDepNames": [
         "go",
         "docker.io/library/golang"
       ],
+      // postUpgradeTasks is only for when the Go module directives are bumped
+      "postUpgradeTasks": {
+        "commands": ["go mod vendor"],
+        "fileFilters": ["**/**"],
+        "executionMode": "branch"
+      },
     },
     {
       // Group golangci-lint updates to overrule grouping of version updates in the GHA files.
@@ -245,6 +261,7 @@
         "executionMode": "branch"
       }
     },
+    // ignore deps section
     {
       // do not update those packages as they are replaced by the local copy
       // see https://github.com/cilium/tetragon/blob/7623babdf54e9a38326420c1b188308f6cf96fff/go.mod#L178-L179
@@ -268,5 +285,25 @@
       ],
       "enabled": false
     }
+  ],
+  // Those regexes manage version strings in variousfiles, similar to the
+  // examples shown here: https://docs.renovatebot.com/modules/manager/regex/#advanced-capture
+  "regexManagers": [
+    {
+      "fileMatch": [
+        "^\\.github/workflows/[^/]+\\.ya?ml$"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+.+version: *['\"]?(?<currentValue>[^'\"\\s]*)"
+      ]
+    },
+    {
+      "fileMatch": [
+        "Makefile.cli"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?)\\s+GO_IMAGE[[:blank:]]*=[[:blank:]]*(?<depName>.*?):(?<currentValue>[^\\s]*)"
+      ]
+    }
   ]
 }

.github/workflows/generated-files.yaml

@@ -18,6 +18,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
+          # renovate: datasource=golang-version depName=go
           go-version: '1.19.6'
       - name: Validate that generated files are up to date.
         run: |

.github/workflows/gotests.yml

@@ -25,6 +25,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
+        # renovate: datasource=golang-version depName=go
         go-version: '1.19.6'
 
     - name: Install dependencies

.github/workflows/run-e2e-tests.yaml

@@ -33,6 +33,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
+        # renovate: datasource=golang-version depName=go
         go-version: '1.19.6'
 
     - name: Set Up Job Variables

.github/workflows/static-checks.yaml

@@ -20,6 +20,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
+          # renovate: datasource=golang-version depName=go
           go-version: '1.19.6'
       - name: Run static checks
         uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0

.github/workflows/vmtests.yml

@@ -21,6 +21,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
+        # renovate: datasource=golang-version depName=go
         go-version: '1.19.6'
 
     - name: Checkout code

Dockerfile

@@ -20,7 +20,7 @@ RUN make tetragon-bpf LOCAL_CLANG=1 TARGET_ARCH=$TARGETARCH
 # Second builder (cross-)compile:
 # - tetragon (pkg/bpf uses CGO, so a gcc cross compiler is needed)
 # - tetra
-FROM --platform=$BUILDPLATFORM quay.io/cilium/cilium-builder:832f86bb0f7c7129c1536d5620174deeec645117@sha256:6dbac9f9eba3e20f8edad4676689aa8c11b172035fe5e25b533552f42dea4e9a as tetragon-builder
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.19.6@sha256:1a86aa60f99a253ad32ec0e8820f5813d557b1735ac5cc32e042397379d57fb2 as tetragon-builder
 WORKDIR /go/src/github.com/cilium/tetragon
 ARG TETRAGON_VERSION TARGETARCH BUILDARCH
 RUN apt-get update

Dockerfile.operator

@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG BASE_IMAGE=scratch
-ARG GOLANG_IMAGE=quay.io/cilium/cilium-builder:832f86bb0f7c7129c1536d5620174deeec645117@sha256:6dbac9f9eba3e20f8edad4676689aa8c11b172035fe5e25b533552f42dea4e9a
+ARG GOLANG_IMAGE=docker.io/library/golang:1.19.6@sha256:1a86aa60f99a253ad32ec0e8820f5813d557b1735ac5cc32e042397379d57fb2
 ARG ALPINE_IMAGE=docker.io/library/alpine:3.18.2@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1
 
 # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit.

Makefile.cli

@@ -2,6 +2,8 @@
 # Copyright Authors of Tetragon
 
 GO_BUILD = CGO_ENABLED=0 $(GO) build -tags standalone
+# renovate: datasource=docker
+GO_IMAGE = docker.io/library/golang:1.19.6-alpine
 TARGET=tetra
 
 RELEASE_UID ?= $(shell id -u)
@@ -11,7 +13,7 @@ cli-release:
 	docker run \
 		--rm \
 		--workdir /tetragon \
-		--volume `pwd`:/tetragon docker.io/library/golang:1.19.0-alpine3.16 \
+		--volume `pwd`:/tetragon $(GO_IMAGE) \
 		sh -c "apk add --no-cache make git setpriv && \
 		        /usr/bin/setpriv --reuid=$(RELEASE_UID) --regid=$(RELEASE_GID) --clear-groups \
 			make GOCACHE=/tmp/cache cli-local-release VERSION=${VERSION}"