Package Rules Are Not Applied to Skipped Dependencies

[toledompm]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab - Latest

Please tell us more about your question or problem

When updating Helm chart versions in multiple Flux HelmRelease resources across various repositories, I encountered an issue. Flux requires a matching HelmRepository definition to exist in the same repository:

// https://docs.renovatebot.com/modules/manager/flux/#helmrelease-support  
Extracts helm dependencies from HelmRelease resources.  

The flux manager extracts helm dependencies for HelmRelease resources linked to HelmRepository or GitRepository sources. Renovate supports OCI HelmRepository sources, those with type: oci. Renovate will then extract the docker dependencies for the referenced HelmRelease resources.  

In addition, for the flux manager to properly link HelmRelease and HelmRepository resources, both of the following conditions must be met:  
- The HelmRelease resource must either have its metadata.namespace property set or its spec.chart.spec.sourceRef.namespace property set  
- The referenced HelmRepository resource must have its metadata.namespace property set  

The issue occurred because the flux manager could not identify the registry URL for HelmRelease resources without a matching HelmRepository. To address this, I considered using a package rule to overwrite the registry URL for these dependencies. However, the flux manager marks such dependencies with a skipReason of unknown-registry, and package rules are not applied to skipped dependencies (source)

Does it make sense for package rules to bypass skipped dependencies? In cases like this, applying package rules might resolve the skip reason and allow Renovate to process these dependencies correctly.

I came up with a simple PR (#32620) and ran it locally to get a critical update out. However, I’d like to open a discussion to explore whether this feature or a similar approach could be included upstream. We are planning to roll out Renovate broadly and would like to avoid using a custom manager(similar to this suggestion).

I created a repo in my personal GH account with a similar setup to illustrate the situation better: https://github.com/toledompm/renovate-test

Logs (if relevant)

Logs

DEBUG: Repository config
{
  "fileName": "renovate.json"
  "config": {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
      "config:recommended"
    ],
    "packageRules": [
      {
        "matchDatasources": [
          "helm"
        ],
        "matchPackageNames": [
          "app"
        ],
        "registryUrls": [
          "https://toledompm.github.io/homelab-charts"
        ]
      }
    ],
    "flux": {
      "fileMatch": [
        "^.+\\.yaml$"
      ]
    },
    "enabledManagers": [
      "flux"
    ]
  }
}

...

DEBUG: PackageFiles.add() - Package file saved for base branch
{
  "baseBranch": "main"
}

DEBUG: Package releases lookups complete
{
  "baseBranch": "main"
}

DEBUG: branchifyUpgrades
DEBUG: detectSemanticCommits()
DEBUG: semanticCommits: returning "disabled" from cache
DEBUG: 0 flattened updates found: 
DEBUG: Returning 0 branch(es)
DEBUG: config.repoIsOnboarded=true
DEBUG: packageFiles with updates
{
  "baseBranch": "main"
  "config": {
    "flux": [
      {
        "deps": [
          {
            "currentValue": "0.5.0",
            "datasource": "helm",
            "depName": "app",
            "packageName": "app",
            "skipReason": "unknown-registry",
            "updates": []
          }
        ],
        "packageFile": "helmrelease.yaml"
      }
    ]
  }
}

[rarkins]

I think this indicates we need one or both of these:

• Managers should not set skipReason if the problem is recoverable (e.g. by setting registryUrls)
• We could allow to re-enable/unskip using packageRules

[toledompm]

From my perspective as a user it was confusing that this wasn't how packageRules worked:

We could allow to re-enable/unskip using packageRules

But I'm not sure of a good way of implementing this so that skipReasons other than unknown-registry could be fixed.