only allow sops encryption of *.sops.* files

Pretix and Pretalx both use CalVer, so we don't want to have upgrades to
their second number be identified as minor updates and get grouped with
all the other minor and patch updates.
The regex to re-classify the second number as major doesn't work.
Probably because of:
"Important: all capture groups must contain only purely numeric values."
(https://docs.renovatebot.com/modules/versioning/regex/)
So instead match on the minor update type for Pretix and Pretalx and set
the group name to null.

.sops.yaml

@@ -43,170 +43,170 @@ keys:
 
 creation_rules:
   ## group vars
-  - path_regex: inventories/chaosknoten/group_vars/all.*
+  - path_regex: "inventories/chaosknoten/group_vars/.+\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           *host_chaosknoten_age_keys
-  - path_regex: inventories/external/group_vars/all.*
+  - path_regex: "inventories/external/group_vars/.+\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           *host_external_age_keys
-  - path_regex: inventories/z9/group_vars/all.*
+  - path_regex: "inventories/z9/group_vars/.+\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
   ## host vars
   # chaosknoten hosts
-  - path_regex: inventories/chaosknoten/host_vars/acmedns.*
+  - path_regex: "inventories/chaosknoten/host_vars/acmedns\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_acmedns_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/cloud.*
+  - path_regex: "inventories/chaosknoten/host_vars/cloud\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_cloud_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/keycloak.*
+  - path_regex: "inventories/chaosknoten/host_vars/keycloak\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_keycloak_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/grafana.*
+  - path_regex: "inventories/chaosknoten/host_vars/grafana\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_grafana_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/pad.*
+  - path_regex: "inventories/chaosknoten/host_vars/pad\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_pad_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/ccchoir.*
+  - path_regex: "inventories/chaosknoten/host_vars/ccchoir\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_ccchoir_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/pretalx.*
+  - path_regex: "inventories/chaosknoten/host_vars/pretalx\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_pretalx_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/netbox.*
+  - path_regex: "inventories/chaosknoten/host_vars/netbox\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_netbox_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/tickets.*
+  - path_regex: "inventories/chaosknoten/host_vars/tickets\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_tickets_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/onlyoffice.*
+  - path_regex: "inventories/chaosknoten/host_vars/onlyoffice\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_onlyoffice_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/zammad.*
+  - path_regex: "inventories/chaosknoten/host_vars/zammad\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_zammad_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/ntfy.*
+  - path_regex: "inventories/chaosknoten/host_vars/ntfy\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_ntfy_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/eh22-wiki.*
+  - path_regex: "inventories/chaosknoten/host_vars/eh22-wiki\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_eh22_wiki_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/sunders.*
+  - path_regex: "inventories/chaosknoten/host_vars/sunders\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_sunders_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/wiki.*
+  - path_regex: "inventories/chaosknoten/host_vars/wiki\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_wiki_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/renovate.*
+  - path_regex: "inventories/chaosknoten/host_vars/renovate\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_renovate_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/lists.*
+  - path_regex: "inventories/chaosknoten/host_vars/lists\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_lists_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/mumble.*
+  - path_regex: "inventories/chaosknoten/host_vars/mumble\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_mumble_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/public-reverse-proxy.*
+  - path_regex: "inventories/chaosknoten/host_vars/public-reverse-proxy\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_public_reverse_proxy_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/spaceapiccc.*
+  - path_regex: "inventories/chaosknoten/host_vars/spaceapiccc\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_spaceapiccc_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/mjolnir.*
+  - path_regex: "inventories/chaosknoten/host_vars/mjolnir\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_mjolnir_ansible_pull_age_key
   # external hosts
-  - path_regex: inventories/external/host_vars/status.*
+  - path_regex: "inventories/external/host_vars/status\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_status_ansible_pull_age_key
   # z9 hosts
-  - path_regex: inventories/z9/host_vars/dooris.*
+  - path_regex: "inventories/z9/host_vars/dooris\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
-  - path_regex: inventories/z9/host_vars/yate.*
+  - path_regex: "inventories/z9/host_vars/yate\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
   # general
-  - key_groups:
+  - path_regex: ".+\\.sops\\..+"
-      - pgp:
+    key_groups:
-          *admin_gpg_keys
+      - pgp: *admin_gpg_keys
 
 stores:
   yaml:

renovate.json

@@ -30,19 +30,19 @@
       "matchUpdateTypes": [
         "minor",
         "patch"
-      ],
+      ]
-      "matchJsonata": ["isBreaking != true"]
     },
     {
       "matchDatasources": ["docker"],
       "matchPackageNames": ["docker.io/pretix/standalone"],
-      "versioning": "regex:^(?<major>\\d+\\.\\d+)(?:\\.(?<minor>\\d+))$"
+      "matchUpdateTypes": ["minor"],
+      "groupName": null
     },
     {
       "matchDatasources": ["docker"],
       "matchPackageNames": ["docker.io/pretalx/standalone"],
       "matchUpdateTypes": ["minor"],
-      "isBreaking": true
+      "groupName": null
     }
   ],
   "customManagers": [