docs: add dependency management section — renovate must track all pinned Dockerfile packages

2026-06-09 16:18:58 +00:00
parent b7bd789d99
commit 990aceff0e
1 changed files with 7 additions and 1 deletions
@@ -14,10 +14,16 @@ This repository builds and publishes a Docker image for [OpenCode](https://openc
 └── README.md       # Usage documentation
 ```

+## Dependency management
+
+- **Always pin versions** in the Dockerfile `npm install` command (e.g. `opencode-ai@1.16.2 n2-soul@9.0.9`). Never leave packages unpinned.
+- **Update renovate customManagers** when adding, removing, or renaming a dependency tracked in the Dockerfile. Each pinned package must have a corresponding `customManager` entry in `renovate.json` with a regex `matchStrings` pattern that captures the version. If a dependency is added without a renovate entry, Renovatebot will not open automated PRs for it.
+- **apt packages** (apt-get install lines in Dockerfile) and **COPY --from** image references are not currently tracked by Renovate. Pinning these manually is acceptable for now but adding renovate managers for them is encouraged.
+
 ## Dockerfile conventions

 - **Base image**: `node:24` — Debian-based Node.js image (not Alpine, needed for apt packages).
- **Install**: `npm i -g opencode-ai n2-soul@<version>` — installs OpenCode and Soul globally.
+- **Install**: `npm i -g opencode-ai@<version> n2-soul@<version>` — installs OpenCode and Soul globally, both pinned.
 - **Version check**: `RUN opencode --version` after install to validate the build and record the installed version in build logs.
 - **Dedicated user**: a non-root `opencode` user and group are created with `groupadd`/`useradd` (UID/GID 1000). All runtime steps run as this user.
 - **Cluster tooling**: `kubectl` is copied from the official `registry.k8s.io/kubectl` image (multi-stage COPY).