Julien Gautier
f396140786
Until now the Trivy and gitleaks pins in .gitea/workflows/*.yml were manual — Renovate's built-in managers only see package-manager-tracked deps (npm, docker-compose images, GitHub Actions, etc.) and ignore plain env vars. We had a comment in each workflow telling the next contributor to "bump manually from the releases page", which is exactly the kind of friction that gets forgotten between two security advisories. Add a `customManagers` regex in renovate.json that picks up any `# renovate: datasource=… depName=…` annotation immediately followed by an env-var assignment of the form `<NAME>_VERSION: '<version>'`. Annotate the four pins (TRIVY_VERSION + GITLEAKS_VERSION in ci.yml and security-scheduled.yml) accordingly, with the github-releases datasource and the upstream `owner/repo` depName. The `extractVersionTemplate: ^v?(?<version>.+)$` strips the `v` prefix used by both projects' release tags so the version substituted into the env var (which our shell script consumes without `v`) stays correct. The dashboard triage header in renovate.json that previously listed Trivy / gitleaks under "pinned constraints — not Renovate- tracked yet" is updated to reflect the new tracking. Verified with a Node-side dry-run of the regex against both workflow files: 4/4 expected matches with the right datasource / depName / currentValue captures.
Documentation index
This is the entry point to all project documentation. It is maintained automatically: any addition, rename, or removal of a .md file under docs/ must be reflected here in the same change.
Conventions
- Documentation is written in English.
- One topic per file. Group related files into a folder when there are three or more.
- Cross-reference with relative links so they keep working in GitHub, IDEs, and exported sites.
- For architectural decisions, do not add them here — they belong in decisions/ as MADR 4.0.0 ADRs.
Sections
Daily development
- development.md — repo layout, prerequisites, initial setup, daily commands, observability dev-loop (Jaeger UI, log ↔ trace correlation), dependency updates (Renovate), conventional commit cycle. Day-to-day reference for working on the project.
Architecture
- architecture.md — cross-cutting Mermaid diagrams: C4 system context, C4 containers, Nx module boundaries, CI/CD pipeline. Single-decision diagrams (auth sequence, ERD, etc.) live inline in their ADR.
Onboarding & environment
Setup guides for new contributors:
- setup/01-wsl-terminal-setup.md — modern WSL terminal (Zsh + Powerlevel10k + CLI tools)
- setup/02-dev-web-stack.md — Node via nvm, pnpm via corepack, Docker
- setup/03-angular-nx-monorepo.md — Angular + Nx monorepo bootstrap
Operations & runbooks
Empty — to be populated when we deploy.
Security, performance, accessibility
Empty — placeholders to be filled with rationale docs alongside their corresponding ADRs.