Renovate for Ansible

Your Ansible project pins its dependencies in a requirements.yml:
the Galaxy collections and the roles it pulls in, each at a version.
Those versions go stale. Upstream ships fixes and features, your file
keeps pointing at last year's tag, and you only notice when something
breaks or when you finally sit down to bump them all by hand and hope
nothing regresses. That manual bump is exactly the kind of chore that
never happens on time.

Renovate does it for you. It is a dependency-update bot that watches
your dependencies, and it has a built-in Ansible manager that reads
requirements.yml directly. It sees that a collection or role has a
newer version, opens a pull request bumping it, and lets your CI run
against the change before you merge. You review a diff, not a
changelog you went hunting for.

What It Actually Does

Point Renovate at your repository and it finds the requirements.yml,
parses the collections and git-based roles, and looks each one up
against its source, Ansible Galaxy for collections, the git tags for
roles pulled from git. When a newer version exists, you get a PR with
just that bump, its own branch, its own CI run. One dependency, one
PR, so a role update that breaks something is isolated instead of
buried in a batch.

The config is small. A renovate.json extending the recommended
preset is enough to start; the Ansible manager is on by default and
needs no special setup for a standard requirements.yml. From there
you tune: schedule the PRs for a quiet window, group related updates,
and enable automerge for the low-risk ones, patch bumps on a role you
trust, so those land without you touching them and only the
interesting updates reach your review.

For anything the built-in manager does not cover, a version string
somewhere other than requirements.yml, a custom regex manager tells
Renovate where to look and what datasource to check. That is how
people keep an OCI tag in defaults/main.yml and the version in
galaxy.yml moving together in one PR.

The One Catch Worth Knowing

Git tags and the version strings in your file have to match exactly,
prefix and all. If a role's tags are v1.2.0 but your
requirements.yml says 1.2.0, then ansible-galaxy runs
git checkout 1.2.0, finds no such ref, and the install fails. When
Renovate bumps a git-based dependency, make sure it preserves the tag
format the upstream actually uses. Renovate has a setting to control
the written version string for exactly this, and getting it wrong
turns a routine bump into a broken checkout. Test with
renovate-config-validator for the config and a local
renovate --platform=local run to confirm it detects what you expect
before you turn it loose.

The Takeaway

Renovate reads your Ansible requirements.yml, watches your
collections and roles for new versions, and opens one PR per update so
your CI judges each bump before you do. Start with the recommended
preset, automerge the boring updates, and use a regex manager for the
versions that live outside requirements.yml. Just keep the tag
prefixes consistent, because a mismatched v is the one thing that
turns the convenience into a failed install.