Skip to content

Commit 5cdf3a0

Browse files
cgwalterscgwalters
authored
Merge pull request #11 from p5/fancy-readme
feat(renovate): add a shared configuration file
2 parents c49e3d6 + b3d8c96 commit 5cdf3a0

File tree

5 files changed

+191
-33
lines changed

5 files changed

+191
-33
lines changed

‎.github/workflows/renovate.yml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,18 @@
11
name: Renovate
22
on:
33
workflow_dispatch:
4+
inputs:
5+
log-level:
6+
description: "Set the Renovate log level (default: info)"
7+
required: false
8+
default: info
9+
type: choice
10+
options:
11+
- info
12+
- debug
13+
pull_request:
14+
branches:
15+
- main
416
schedule:
517
- cron: '3 * * * *'
618
jobs:
@@ -20,6 +32,9 @@ jobs:
2032

2133
- name: Self-hosted Renovate
2234
uses: renovatebot/[email protected]
35+
env:
36+
RENOVATE_DRY_RUN: ${{ github.event_name == 'pull_request' && 'full' }}
37+
LOG_LEVEL: ${{ github.event.inputs.log-level || 'info' }}
2338
with:
2439
configurationFile: renovate-config.js
25-
token: '${{ steps.token.outputs.token }}'
40+
token: '${{ steps.token.outputs.token }}'

‎README.md‎

Lines changed: 87 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,88 @@
1-
# CI infra
1+
# CI Infrastructure
22

3-
This repository currently just has a self-hosted Renovate instance
4-
via <https://github.com/renovatebot/github-action>.
3+
This repository provides centralised configuration and automation for the [bootc-dev](https://github.com/bootc-dev) organisation. It is designed to simplify and standardise infrastructure, with Renovate as one part of the overall setup. The repository will grow to support additional infrastructure and automation purposes in the future as needed.
4+
5+
6+
## Table of Contents
7+
8+
- [Purpose](#purpose)
9+
- [Renovate](#renovate)
10+
- [Getting Started](#getting-started)
11+
- [Support & Contributions](#support--contributions)
12+
- [License](#license)
13+
14+
---
15+
16+
## Purpose
17+
18+
The main goal of this repository is to:
19+
20+
- **Centralise configuration** for CI and automation tools across the organisation.
21+
- **Simplify onboarding** for new repositories and maintainers.
22+
- **Enable strict configuration inheritance** for consistency, with flexibility for overrides.
23+
- **Group and manage dependencies and automation** for easier review and maintenance.
24+
25+
---
26+
27+
28+
## Renovate
29+
30+
This section describes how Renovate Bot is configured and used in this repository to manage dependency updates across multiple repositories in the organisation.
31+
32+
### How It Works
33+
34+
1. **Autodiscovery**: Renovate is configured to automatically find all repositories the GitHub App token has access to.
35+
1. **Shared Configuration**: The `renovate-shared-config.json` file defines base rules, grouping strategies, and custom package rules. All repositories inherit these settings unless they opt out.
36+
1. **No Onboarding PRs**: Onboarding PRs are disabled, so repositories start using the shared config immediately.
37+
1. **Branch Naming**: All Renovate branches are prefixed for easy identification.
38+
1. **Platform Support**: The configuration is tailored for GitHub, with support for forked repositories and platform-specific features.
39+
40+
#### For Repository Maintainers
41+
42+
If your repository is part of the bootc-dev GitHub organisation:
43+
44+
1. **Inherit the central config**: By default, your repository will use the shared configuration from this repo. No additional setup is required unless you want to override specific settings.
45+
1. **Customise if needed**: You can add your own `renovate.json` or similar config file in your repository to override or extend the shared settings.
46+
1. **Review dependency PRs**: Renovate will create PRs for dependency updates according to the shared rules, grouping, and strategies defined here.
47+
48+
#### For Organisation Admins
49+
50+
- **Update shared config**: To change organisation-wide Renovate behaviour, edit the configuration files in this repository. Changes will propagate to all inheriting repositories.
51+
- **Monitor and audit**: Use the central config to ensure compliance and best practices across all projects.
52+
53+
### Manually Running Renovate
54+
55+
You can manually trigger the Renovate workflow from the GitHub Actions tab:
56+
57+
1. Go to the **Actions** tab in this repository.
58+
2. Select the **Renovate** workflow.
59+
3. Click **Run workflow**.
60+
4. Optionally, set the log level (`info` or `debug`) before starting.
61+
62+
This is useful for testing configuration changes or running Renovate outside the scheduled times.
63+
64+
#### Key Features
65+
66+
- **Best-practices base config**: Extends Renovate's recommended settings for reliability and security.
67+
- **Commit sign-off**: Ensures all dependency update commits are signed off for traceability.
68+
- **Dependency grouping**: Groups updates for GitHub Actions, Rust, Docker, and more for easier review.
69+
- **Custom rules**: Includes rules for disabling certain updates (e.g., Fedora OCI images) and controlling digest pinning.
70+
71+
---
72+
73+
## Getting Started
74+
75+
1. Ensure your repository is part of the organisation and Renovate is installed.
76+
1. Review the [Renovate documentation](https://docs.renovatebot.com/) for advanced usage and customisation options.
77+
78+
---
79+
80+
## Support & Contributions
81+
82+
For questions or improvements, open an issue or pull request in this repository. Contributions to the shared configuration are welcome and help improve dependency management for all projects in the organisation.
83+
84+
---
85+
86+
## License
87+
88+
MIT OR Apache-2.0

‎renovate-config.js‎

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,29 @@
11
module.exports = {
2+
// Find all repositories the GitHub App token has permissions to
23
autodiscover: true,
3-
branchPrefix: 'test-renovate/',
4+
5+
// Don't create the onboarding PRs
6+
//
7+
// All repositories in the organisation will inherit the shared configuration
8+
// (./renovate-shared-config.json) by default unless they opt-out.
9+
onboarding: false,
10+
11+
// Centralise all Renovate configuration into this repository
12+
//
13+
// This allows for easier management of Renovate settings across multiple
14+
// repositories. Each individual repository can still contain their own
15+
// configuration.
16+
inheritConfig: true,
17+
inheritConfigRepoName: '{{parentOrg}}/infra',
18+
inheritConfigFileName: "renovate-shared-config.json",
19+
inheritConfigStrict: true,
20+
21+
// Prefix all branches created by Renovate with "bootc-renovate/"
22+
branchPrefix: 'bootc-renovate/',
23+
24+
// Configure Renovate to use GitHub-specific API calls
425
platform: 'github',
26+
27+
// Enable dependency updates on forked repositories in the organisation
528
forkProcessing: 'enabled',
6-
packageRules: [
7-
{
8-
description: 'lockFileMaintenance',
9-
matchUpdateTypes: [
10-
'pin',
11-
'digest',
12-
'patch',
13-
'minor',
14-
'major',
15-
'lockFileMaintenance',
16-
],
17-
dependencyDashboardApproval: false,
18-
minimumReleaseAge: '0 days',
19-
},
20-
],
2129
};

‎renovate-shared-config.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
// Base configuration
5+
"config:best-practices",
6+
7+
// Add "Signed-off-by" footer to commit messages
8+
":gitSignOff",
9+
10+
// Catch-all for grouping dependencies not caught by other groups
11+
"group:all"
12+
],
13+
14+
// Rebase when there are merge conflicts
15+
//
16+
// The "conflicted" option is typically the ideal choice for most situations
17+
// where you don't want to burn CI credits, while still keeping your branch
18+
// in a mergeable state at all times.
19+
"rebaseWhen": "conflicted",
20+
21+
"packageRules": [
22+
// Group GitHub Actions dependencies
23+
{
24+
"description": "GitHub Actions dependencies",
25+
"matchManagers": ["github-actions"],
26+
"groupName": "GitHub Actions",
27+
"enabled": true
28+
},
29+
30+
// Group Rust dependencies
31+
{
32+
"description": "Rust dependencies",
33+
"matchManagers": ["cargo"],
34+
"groupName": "Rust",
35+
"enabled": true
36+
},
37+
38+
// Group Docker dependencies
39+
{
40+
"description": "Docker dependencies",
41+
"matchManagers": ["dockerfile"],
42+
"groupName": "Docker",
43+
"enabled": true
44+
},
45+
46+
// Disable Containerfile digest pinning
47+
{
48+
"description": "Containerfile digest pinning",
49+
"matchManagers": ["dockerfile"],
50+
"pinDigests": false
51+
},
52+
53+
// Disable Fedora OCI updates
54+
//
55+
// This is due to there not being an easy way to tell Renovate which
56+
// Fedora version is "stable" and which has not been released yet.
57+
{
58+
"description": "Disable Fedora OCI updates",
59+
"matchManagers": ["dockerfile"],
60+
"matchDepNames": ["quay.io/fedora/fedora"],
61+
"enabled": false
62+
}
63+
]
64+
}

‎renovate.json‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)