Integrate with Renovate

Renovate  is an open-source dependency update tool that scans your repositories and automatically suggests updates for the dependencies it finds, such as container images, Helm charts or package manager dependencies.

Why use Renovate?

If you use Application Collection as the source for your container images, Helm charts or Python libraries, wouldn’t it be great to be notified whenever a newer version becomes available, without having to manually check it yourself?

Renovate supports all the artifact packaging formats offered by Application Collection out of the box:

• Container images, through its Docker manager 
• Helm charts, through its Helmv3 manager 
• Python libraries, through its pip_requirements manager  (and other Python managers)

To do so, Renovate only needs to know:

• Which registries to authenticate against, and with which credentials
• Which packages should be resolved from Application Collection instead of their default public registry

Both of these are configured in the renovate.json configuration file that lives at the root of your repository.

Prerequisites

Before configuring Renovate, make sure you have a service account with the necessary subscriptions. Follow the Authentication guide if you don’t have one yet.

You will need the service account username and secret to configure authentication in the steps below.

Configuration

Authentication

Renovate authenticates to Application Collection through a host rule  that targets the Application Collection Distribution Platform hostname, dp.apps.rancher.io.

Add the following hostRules entry to your renovate.json file:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "hostRules": [
    {
      "matchHost": "dp.apps.rancher.io",
      "username": "{{ secrets.APPCO_SA_USERNAME }}",
      "password": "{{ secrets.APPCO_SA_SECRET }}"
    }
  ]
}

If you are running Renovate locally to try it out, you can instead pass the secrets through the RENOVATE_SECRETS environment variable:

LOG_LEVEL=debug RENOVATE_SECRETS='{
  "APPCO_SA_USERNAME": "<your-service-account-username>",
  "APPCO_SA_SECRET": "<your-service-account-secret>"
}' \
renovate --platform=local --dry-run=lookup

Packaging formats

With authentication in place, you now need to tell Renovate which packages it should resolve from Application Collection. This is done with package rules .

{
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "matchPackageNames": ["dp.apps.rancher.io/containers/**"]
    }
  ]
}

FROM dp.apps.rancher.io/containers/nodejs:24

{
  "packageRules": [
    {
      "matchDatasources": ["docker", "helm"],
      "matchPackageNames": ["dp.apps.rancher.io/containers/**", "dp.apps.rancher.io/charts/**"]
    }
  ]
}

dependencies:
  - name: redis
    version: 2.7.1
    repository: oci://dp.apps.rancher.io/charts

{
  "packageRules": [
    {
      "matchDatasources": ["pypi"],
      "registryUrls": [
        "https://dp.apps.rancher.io/libraries/python/simple/"
      ]
    }
  ]
}

fastapi==0.95.2

Python index fallback

Not every Python package is mirrored in Application Collection. With the registryUrls configuration shown above, Renovate only looks up packages in the Application Collection index, so a package that hasn’t been published there yet will fail to resolve.

If you want Renovate to fall back to the public PyPI  index whenever a package can’t be found in Application Collection, add https://pypi.org/simple/ as an additional entry in registryUrls:

{
  "packageRules": [
    {
      "matchDatasources": ["pypi"],
      "registryUrls": [
        "https://dp.apps.rancher.io/libraries/python/simple/",
        "https://pypi.org/simple/"
      ]
    }
  ]
}

Renovate queries every registry listed in registryUrls and picks the highest version returned across all of them, so packages available in both indexes will still resolve to their Application Collection version whenever it’s the newest one.

Putting it all together

Combining authentication and the three package rules above results in a renovate.json file that keeps container images, Helm charts and Python libraries up to date from Application Collection:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "hostRules": [
    {
      "matchHost": "dp.apps.rancher.io",
      "username": "{{ secrets.APPCO_SA_USERNAME }}",
      "password": "{{ secrets.APPCO_SA_SECRET }}"
    }
  ],
  "packageRules": [
    {
      "matchDatasources": ["docker", "helm"],
      "matchPackageNames": ["dp.apps.rancher.io/containers/**", "dp.apps.rancher.io/charts/**"]
    },
    {
      "matchDatasources": ["pypi"],
      "registryUrls": [
        "https://dp.apps.rancher.io/libraries/python/simple/"
      ]
    }
  ]
}

Run Renovate

Once your renovate.json file is in place, you can install Renovate and run it against your repository:

# Make sure you're running Node v24
npm install -g renovate

To validate your configuration before enabling it as a scheduled job in your CI platform, run it in dry-run mode against your local repository:

LOG_LEVEL=debug RENOVATE_SECRETS='{
  "APPCO_SA_USERNAME": "<your-service-account-username>",
  "APPCO_SA_SECRET": "<your-service-account-secret>"
}' \
renovate --platform=local --dry-run=lookup

Renovate does not print the suggested updates directly to the console, so review the execution logs to find the resolved versions for each dependency.