Skip to content

Renovate: dependency and image updates in GitLab

CI/CD · Dependencies
Not studied

Added 2026-10-29.

Problem

Images and dependencies are updated by hand and rarely. Pinning by digest is safe, but without automation the digest goes stale, and vulnerable versions live on for months.

Solution

Renovate is "an automated dependency update tool": it looks for references to dependencies and, if newer versions are available, creates pull requests (merge requests in GitLab) to update them, with information to help you decide which updates to accept. It supports over 90 package managers, including Docker.

Run Renovate on a schedule as a job in self-hosted GitLab. Image pinning by digest is enabled with the docker:pinDigests preset. Automerge only when CI has tests.

Example

.gitlab-ci.yml in a separate bot project, triggered from Pipeline schedules. RENOVATE_TOKEN is a masked CI variable with a dedicated user's token.

renovate:
  image: renovate/renovate:44.196.1   # pin by digest
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  variables:
    RENOVATE_PLATFORM: gitlab
    RENOVATE_ENDPOINT: $CI_API_V4_URL
    RENOVATE_REPOSITORIES: infra/devops-kb
  script:
    - renovate

renovate.json in the managed repository:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", "docker:pinDigests"],
  "schedule": ["* 0-5 * * 1"],
  "packageRules": [
    { "matchDatasources": ["docker"], "groupName": "docker images" }
  ]
}

For dependencies hosted on github.com you also need RENOVATE_GITHUB_COM_TOKEN, otherwise Renovate will hit API rate limits.

When to use

In any repository with a Dockerfile, compose files or package-manager dependencies.

Source

How to apply it yourself

  1. Create a bot user allowed to open MRs only in the projects that need it.
  2. Run it on one repository, without automerge.
  3. Review the first MR with a digest update and changelog.
  4. Mark it "Studied" once updates arrive weekly and get merged after a green CI.