From 0572527b2caab68ad87f132cfd3fcf098b658ff9 Mon Sep 17 00:00:00 2001
From: Ales Raszka <araszka@redhat.com>
Date: Tue, 10 Nov 2026 14:53:49 +0100
Subject: [PATCH] ci: track builder base digest with Renovate

Signed-off-by: Ales Raszka <araszka@redhat.com>
---
 Containerfile.cli |  2 +-
 renovate.json     | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 renovate.json

diff --git a/Containerfile.cli b/Containerfile.cli
index 5082339..074d123 100644
--- a/Containerfile.cli
+++ b/Containerfile.cli
@@ -1,4 +1,4 @@
-ARG BUILDER_IMAGE=quay.io/light-factory/python-builder@sha256:a2b3df73bfcc2bdda40250b91aa168aaf7923be88b1605cf1eec891c0a51984f
+ARG BUILDER_IMAGE=quay.io/light-factory/python-builder:latest@sha256:a2b3df73bfcc2bdda40250b91aa168aaf7923be88b1605cf1eec891c0a51984f
 
 FROM quay.io/konflux-ci/oras:latest@sha256:1beeecce012c99794568f74265c065839f9703d28306a8430b667f639343a98b AS oras-bin
 FROM ghcr.io/sigstore/cosign/cosign:v3.1.4@sha256:0f06154836d2de34f887a5c273506d52ca43edaa1d9e53e6510fa78a48f69c2d AS cosign-bin
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..31e3199
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "automerge": false,
+  "enabledManagers": [
+    "dockerfile"
+  ],
+  "dockerfile": {
+    "managerFilePatterns": [
+      "/^Containerfile\\.cli$/"
+    ]
+  },
+  "packageRules": [
+    {
+      "matchManagers": [
+        "dockerfile"
+      ],
+      "enabled": false
+    },
+    {
+      "matchManagers": [
+        "dockerfile"
+      ],
+      "matchPackageNames": [
+        "quay.io/light-factory/python-builder"
+      ],
+      "enabled": true,
+      "pinDigests": true,
+      "automerge": false,
+      "allowedVersions": "/^latest$/"
+    }
+  ]
+}