Skip to content

Commit 23f3d4c

Browse files
TerrorSquadTerrorSquad
authored
Merge pull request #13 from TerrorSquad/copilot/implement-renovate-feature
feat: implement Renovate bot integration for automated dependency updates
2 parents b68432a + 3d73c16 commit 23f3d4c

File tree

3 files changed

+323
-0
lines changed

3 files changed

+323
-0
lines changed

‎booster/integrate_booster.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,15 @@ function copy_files() {
604604
warn "validate-branch-name.config.cjs missing in booster."
605605
fi
606606

607+
# Copy renovate config (for automated dependency updates)
608+
local renovate_cfg="${BOOSTER_INTERNAL_PATH}/renovate.json"
609+
if [ -f "$renovate_cfg" ]; then
610+
cp "$renovate_cfg" . || warn "Failed to copy renovate.json"
611+
log " Copied renovate.json for automated dependency management"
612+
else
613+
log " renovate.json not found in booster. Skipping (optional)."
614+
fi
615+
607616
success "Common files copied (tools filtered to runtime essentials)."
608617
}
609618

‎booster/renovate.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:base"
5+
],
6+
"packageRules": [
7+
{
8+
"matchUpdateTypes": ["minor", "patch"],
9+
"matchCurrentVersion": "!/^0/",
10+
"automerge": true
11+
},
12+
{
13+
"matchDepTypes": ["devDependencies"],
14+
"groupName": "dev dependencies",
15+
"schedule": ["every weekend"]
16+
},
17+
{
18+
"matchPackagePatterns": ["phpunit/", "phpstan/", "psalm/", "symfony/", "doctrine/", "guzzlehttp/"],
19+
"groupName": "PHP dependencies"
20+
}
21+
],
22+
"timezone": "Europe/Paris",
23+
"schedule": ["every weekend"],
24+
"labels": ["dependencies", "renovate"],
25+
"branchPrefix": "deps/"
26+
}

‎docs/content/3.tools/9.renovate.md‎

Lines changed: 288 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
# Renovate Bot Integration
2+
3+
The PHP Booster includes a pre-configured [Renovate](https://docs.renovatebot.com/) setup for automated dependency management. Renovate keeps your PHP and JavaScript dependencies up-to-date automatically, reducing security vulnerabilities and maintenance overhead.
4+
5+
## Overview
6+
7+
Renovate is a dependency update tool that automatically creates pull requests to update your project dependencies. The booster provides a sensible default configuration optimized for PHP projects.
8+
9+
## How It Works
10+
11+
```mermaid
12+
graph TD
13+
A[Renovate checks for updates] --> B[Finds outdated dependencies]
14+
B --> C{Update type?}
15+
C -->|Patch/Minor| D[Auto-merge if stable]
16+
C -->|Major| E[Create PR for review]
17+
D --> F[Dependencies updated]
18+
E --> G{Team approves?}
19+
G -->|Yes| F
20+
G -->|No| H[PR closed/rejected]
21+
```
22+
23+
## Features
24+
25+
### 🤖 Automated Updates
26+
- Automatically detects outdated dependencies
27+
- Creates pull requests with changelogs and release notes
28+
- Schedules updates to avoid disruption (weekends by default)
29+
30+
### 🔧 Smart Grouping
31+
- Groups related dependencies together
32+
- Separates dev dependencies from production
33+
- Groups PHP-specific packages for easier review
34+
35+
### ⚡ Intelligent Merging
36+
- Auto-merges stable patch and minor updates
37+
- Requires manual review for major version updates
38+
- Never auto-merges pre-release versions (0.x.x)
39+
40+
### 📝 Clear Communication
41+
- Labels PRs with `dependencies` and `renovate`
42+
- Uses `deps/` branch prefix for organization
43+
- Provides detailed information about each update
44+
45+
## Configuration
46+
47+
The default `renovate.json` configuration includes:
48+
49+
```json
50+
{
51+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
52+
"extends": [
53+
"config:base"
54+
],
55+
"packageRules": [
56+
{
57+
"matchUpdateTypes": ["minor", "patch"],
58+
"matchCurrentVersion": "!/^0/",
59+
"automerge": true
60+
},
61+
{
62+
"matchDepTypes": ["devDependencies"],
63+
"groupName": "dev dependencies",
64+
"schedule": ["every weekend"]
65+
},
66+
{
67+
"matchPackagePatterns": ["phpunit/", "phpstan/", "psalm/", "symfony/", "doctrine/", "guzzlehttp/"],
68+
"groupName": "PHP dependencies"
69+
}
70+
],
71+
"timezone": "Europe/Paris",
72+
"schedule": ["every weekend"],
73+
"labels": ["dependencies", "renovate"],
74+
"branchPrefix": "deps/"
75+
}
76+
```
77+
78+
### Key Settings
79+
80+
| Setting | Description | Default Value |
81+
|---------|-------------|---------------|
82+
| `extends` | Base configuration preset | `config:base` |
83+
| `schedule` | When to check for updates | `every weekend` |
84+
| `timezone` | Timezone for scheduling | `Europe/Paris` |
85+
| `labels` | PR labels | `dependencies`, `renovate` |
86+
| `branchPrefix` | Branch naming prefix | `deps/` |
87+
| `automerge` | Auto-merge stable updates | Enabled for patch/minor |
88+
89+
### Customization
90+
91+
You can customize the configuration after integration by editing `renovate.json` in your project root:
92+
93+
#### Change Update Schedule
94+
```json
95+
{
96+
"schedule": ["every weekday"]
97+
}
98+
```
99+
100+
#### Adjust Automerge Rules
101+
```json
102+
{
103+
"packageRules": [
104+
{
105+
"matchUpdateTypes": ["patch"],
106+
"automerge": true
107+
}
108+
]
109+
}
110+
```
111+
112+
#### Customize Grouping
113+
```json
114+
{
115+
"packageRules": [
116+
{
117+
"matchPackagePatterns": ["symfony"],
118+
"groupName": "Symfony packages"
119+
}
120+
]
121+
}
122+
```
123+
124+
## Enabling Renovate
125+
126+
### On GitHub
127+
128+
1. Install the [Renovate GitHub App](https://github.com/apps/renovate) on your repository
129+
2. Grant necessary permissions (read repo contents, create PRs)
130+
3. Renovate will automatically detect your `renovate.json` configuration
131+
4. Wait for the first pull request with dependency updates
132+
133+
### On GitLab
134+
135+
1. Go to your project's **Settings > Members**
136+
2. Add the Renovate bot user with at least **Developer** role (required for creating merge requests)
137+
3. Configure CI/CD variables if needed:
138+
- `RENOVATE_TOKEN`: Personal access token with API access (for private repos)
139+
- `RENOVATE_PLATFORM`: Set to `gitlab`
140+
4. Optional: Set up scheduled pipelines to run Renovate at regular intervals
141+
5. Renovate will start creating merge requests based on your `renovate.json` configuration
142+
143+
For more details, see [Renovate GitLab documentation](https://docs.renovatebot.com/modules/platform/gitlab/).
144+
145+
### Self-Hosted
146+
147+
For self-hosted Renovate installations:
148+
149+
1. Install Renovate following the [self-hosting guide](https://docs.renovatebot.com/self-hosting/)
150+
2. Configure your Renovate instance to scan repositories with `renovate.json` files
151+
3. Set up environment variables:
152+
- `RENOVATE_PLATFORM`: Your git platform (`github`, `gitlab`, `bitbucket`, etc.)
153+
- `RENOVATE_ENDPOINT`: Your platform's API endpoint
154+
- `RENOVATE_TOKEN`: Authentication token with repository access
155+
4. The provided `renovate.json` configuration works with self-hosted instances
156+
5. Consider customizing the schedule to match your team's workflow
157+
158+
**Example Docker command:**
159+
```bash
160+
docker run --rm \
161+
-e RENOVATE_PLATFORM=gitlab \
162+
-e RENOVATE_ENDPOINT=https://gitlab.example.com/api/v4 \
163+
-e RENOVATE_TOKEN=your-token \
164+
-v /path/to/config:/usr/src/app/config \
165+
renovate/renovate
166+
```
167+
168+
For more advanced setups, refer to the [official self-hosting documentation](https://docs.renovatebot.com/self-hosting/).
169+
170+
## Package Support
171+
172+
Renovate automatically detects and updates:
173+
174+
- **PHP** - Composer dependencies (`composer.json`)
175+
- **JavaScript** - npm/pnpm/yarn packages (`package.json`)
176+
- **Docker** - Base images in Dockerfiles
177+
- **GitHub Actions** - Action versions in workflows
178+
179+
## Best Practices
180+
181+
### Review Strategy
182+
- ✅ Auto-merge patch updates (bug fixes)
183+
- ✅ Auto-merge minor updates (new features, backward compatible)
184+
- ⚠️ Manually review major updates (breaking changes)
185+
- ⚠️ Always review updates for security-critical packages
186+
187+
### Repository Settings
188+
- Enable **branch protection** rules on your main branch
189+
- Require **status checks** to pass before merging
190+
- Consider requiring **code owner reviews** for major updates
191+
192+
### Testing
193+
- Ensure your **CI/CD pipeline** runs on Renovate PRs
194+
- Include **integration tests** to catch breaking changes
195+
- Use **semantic versioning** in your own packages
196+
197+
## Benefits
198+
199+
### For Developers
200+
- 🔒 **Improved security** through timely dependency updates
201+
- 📈 **Stay current** with latest package features
202+
- 🕐 **Time savings** from automated update management
203+
- 📊 **Clear visibility** of dependency health
204+
205+
### For Teams
206+
- 🛡️ **Reduced vulnerabilities** through faster patching
207+
- 🔄 **Consistent updates** across all projects
208+
- 📝 **Audit trail** with automated PR history
209+
- 🎯 **Focused reviews** on meaningful changes
210+
211+
## Troubleshooting
212+
213+
### Renovate Not Creating PRs
214+
- Verify the Renovate app is installed and has access
215+
- Check that `renovate.json` is valid JSON
216+
- Review Renovate logs in your repository settings
217+
- Ensure dependencies are not pinned or locked
218+
219+
### Too Many PRs
220+
- Adjust the schedule to less frequent checks
221+
- Enable more aggressive grouping rules
222+
- Increase the automerge criteria
223+
224+
### Failing Status Checks
225+
- Review your CI/CD pipeline configuration
226+
- Check if tests need updates for new package versions
227+
- Consider updating test fixtures or mocks
228+
229+
### Merge Conflicts
230+
- Keep your base branch up to date
231+
- Rebase Renovate branches regularly
232+
- Enable Renovate's rebase options
233+
234+
## Integration with Other Tools
235+
236+
Renovate works seamlessly with:
237+
238+
- **GitHub Actions** - Automatically triggers CI checks
239+
- **Composer Audit** - Security vulnerability scanning
240+
- **PHPStan/Psalm** - Static analysis on updated code
241+
- **Git Hooks** - Pre-commit validation still applies
242+
243+
## Advanced Configuration
244+
245+
### Extending Presets
246+
```json
247+
{
248+
"extends": [
249+
"config:base",
250+
":dependencyDashboard",
251+
":semanticCommits",
252+
":automergeDigest"
253+
]
254+
}
255+
```
256+
257+
### Custom Managers
258+
```json
259+
{
260+
"regexManagers": [
261+
{
262+
"fileMatch": ["^Dockerfile$"],
263+
"matchStrings": ["ENV PHP_VERSION=(?<currentValue>.*?)\\n"],
264+
"datasourceTemplate": "github-releases",
265+
"depNameTemplate": "php/php-src"
266+
}
267+
]
268+
}
269+
```
270+
271+
### Notifications
272+
```json
273+
{
274+
"vulnerabilityAlerts": {
275+
"enabled": true,
276+
"labels": ["security"]
277+
}
278+
}
279+
```
280+
281+
## Resources
282+
283+
- [Renovate Documentation](https://docs.renovatebot.com/)
284+
- [Configuration Options](https://docs.renovatebot.com/configuration-options/)
285+
- [Preset Configs](https://docs.renovatebot.com/presets-default/)
286+
- [GitHub App](https://github.com/apps/renovate)
287+
288+
The Renovate integration ensures your dependencies stay current, secure, and well-maintained with minimal manual effort.

0 commit comments

Comments
 (0)