How to lock package from multiple datasource to same version number

[amimas]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

{'platform': 'gitlab', 'version': '~37'}

Please tell us more about your question or problem

Hello,

I'm not sure how to configure a renovate for a specific setup. I have a GitLab project that uses terraform. Below are some relevant configs:

# providers.tf
terraform {
  required_version = "~> 1.7.2"

  required_providers {
    aws = {
      version = "~> 5.44"
      source  = "hashicorp/aws"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

provider "aws" {
  alias  = "us_east_2"
  region = "us-east-2"
}

I have a GitLab CI config that does terraform plan and terraform apply as needed. Relevant config of the CI job is like this:

# .gitlab-ci.yml

terraform-plan-job:
  image:
    name: registry.company.com/docker.io/hashicorp/terraform:1.7.2
    entrypoint: [""]

Notice that the version of terraform in the GitLab CI (.gitlab-ci.yml) above matches with the version of terraform specified in providers.tf file. Ideally they both would update at the same time.

I can add a packageRules in renovate.json so that both gitlab-ci and terraform updates are together in a single MR, but they don't always need to be (or should be) grouped together. They only need to be grouped when it's a terraform version update related change. Secondly, it's not just about grouping... The MR should be opened when an update for both datasources to the same version is available (i.e. terraform version and corresponding docker image for that version).

Not sure what keyword I should search for. Do you have any suggestions or reference to how this can be done?

Currently renovate has opened an MR for me to update only the GitLab CI config to update the terraform image. Moreover, looking at the Rate-Limited updates, I don't see anything for updating the providers.tf file, even though I can see renovate recognizing providers.tf and the terraform version. See the following image of Dependency Dashboard created by renovate.

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[reneleonhardt]

If renovate already recognizes 1.7.2 in both files, wouldn't it be enough for you to group updates together (first example)? 🤔

"packageRules": [
    {
      "description": "Group .gitlab-ci.yml and providers.tf terraform updates"
      "groupName": "terraform",
      "matchPackagePatterns": [
        "docker.io/hashicorp/terraform$"
        "^hashicorp/terraform"
      ],
      "matchManagers": ["gitlabci-include", "terraform"]
    }
]

https://stackoverflow.com/questions/67465571/renovate-group-dependencies-in-one-merge-request

[amimas]

I thought about that. But my understanding of grouping is that if there's an update available for both as in your grouping example, it'll just open a single PR instead of 2. Otherwise if only one of them has an update, you'll still have a single PR but only for the matching file.

What I'm looking for is the selected package in both files must be updated at the same time in a single PR. If an update available only for one of them, do not propose update for either one. Hope that makes sense.

[reneleonhardt]

Now that is a new feature request at least I never thought of 😅
You want to lock down single datasources until all required datasources offer exactly the same update to stay perfectly in sync... good luck with that 😄

I want any update as fast as possible because I hope that patches don't contain breaking changes but useful (security) fixes and are still compatible with patch-1... why should authors go through all the trouble of releasing a new patch to millions of users otherwise? 🤔

[amimas]

Yeah, that's what I thought too. Wasn't sure if this a feature request since renovate already provides so many different possibilities.

[RahulGautamSingh]

What you are loooking for is not possible currently.

[amimas]

Thanks for confirming.