Configuration

Merge semantics

The rules are Renovate's, measured against it:

• Objects deep-merge, arrays replace, null clears a key.
• packageRules concatenate across all layers and apply in array order. Every matching rule applies to a dependency, later ones win per key.
• Rules run twice, as in Renovate: once per dependency before the lookup (a rule can disable, change versioning and registries), once per update, when matchUpdateTypes and matchEffective are known.
• A matcher on an unknown field does not match. A matchUpdateTypes rule is silent before the lookup, a matchEffective rule before an analyzer has run.

Every resolved value keeps its whole origin chain. pinup print-config --config … --explain packageRules[25].automerge shows every source that set a path, winner last. A held update in the plan names the rule the same way.

The keys

pinup migrate --config … classifies every key. Supported means: the key does what it does in Renovate, measured. Partial names the difference. Unsupported means: nothing reads it, and the run says so.

Supported

$schema, addLabels, additionalBranchPrefix, allowedCommands, allowedVersions, automerge, branchPrefix, branchTopic, commitMessageAction, commitMessageExtra, commitMessageLowerCase, commitMessagePrefix, commitMessageSuffix, commitMessageTopic, customDatasources, customManagers, dependencyDashboard, dependencyDashboardApproval, dependencyDashboardTitle, description, enabled, enabledManagers, extends, extractVersion, fetchChangeLogs, groupName, groupSlug, ignoreDeps, ignorePaths, ignoreUnstable, internalChecksFilter, labels, lockFileMaintenance, matchCurrentValue, matchDatasources, matchDepNames, matchDepTypes, matchFileNames, matchManagers, matchPackageNames, matchUpdateTypes, minimumReleaseAge, minimumReleaseAgeBehaviour, osvVulnerabilityAlerts, packageRules, pinDigests, platformAutomerge, postUpgradeTasks, prBodyDefinitions, prBodyNotes, prConcurrentLimit, prHourlyLimit, rangeStrategy, registryUrls, schedule, semanticCommitScope, semanticCommitType, semanticCommits, separateMajorMinor, timezone, versioning, vulnerabilityAlerts – and pinup's own analyze, matchEffective, trustEffective.

Partial

• matchCurrentVersion – matched as a version, not as a range
• matchSourceUrls – the URL as the datasource reports it
• matchJsonata – only isLockfileUpdate and sourceUrl
• commitBody – read, not templated
• prCreation – only immediate; the not-pending deadlock is gone by design
• rebaseWhen – a branch with foreign commits is left alone, otherwise rebase on conflict
• separateMinorPatch, separateMultipleMajor, separateMultipleMinor – read into the template variables; separateMajorMinor decides
• postUpdateOptions – gomodTidy is what the gomod lock refresh does anyway, the rest is not read
• executionTimeout – the runner decides (PINUP_EXECUTION_TIMEOUT), never a repository

Unsupported

• matchCategories – no category model; the rule never fires, and migrate says so

A key not listed here is not read; migrate lists it as unsupported.

pinup's own keys

Custom managers

customManagers with customType: regex work as in Renovate: RE2 expressions with named groups (depName, currentValue, currentDigest, datasource, versioning, registryUrl, packageName, extractVersion), the *Template keys with a Handlebars subset ({{{x}}}, {{#if}}/{{else}}, {{#if (equals a "b")}}), matchStringsStrategyany and recursive. A captured group beats its template. # renovate: and # pinup: are both read.

Environment

Checking a configuration: pinup advise

pinup advise resolves a configuration the way a run does and says what should change. Every finding carries its pointer, the layer that wrote the value – file, preset or default – and, where the file owns the value, a fix.

pinup advise --config renovate.json --runner 'local>group/pinup-runner'
pinup advise --config renovate.json --plan plan.json      # plus what the runs found
pinup advise --config renovate.json --fix --out fixed.json

With --plan the runs join in: rules no dependency reached, managers that found nothing, a repository whose every update one setting holds.

--fix applies the fixes byte for byte to JSON, JSONC and JSON5. Comments, order and formatting stay. Nothing is written until a gate has passed: the file is resolved before and after, and every line that differs must lie under a pointer a fix declared. A fix that declares nothing must leave the resolution unchanged. Without --out or --write it is a dry run. --skip holds back checks that need a decision. A YAML file is reported, not rewritten.

Every check with its ID, severity and fix is listed in docs/commands.md in the repository.