open-component-model/.github/workflows/renovate.yml at d1e2e33ab0d32c2d1d98b90f97b40e0db975b6ea · morri-son/open-component-model · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: Renovate OCM
on:
  schedule:
    - cron: '0 0 * * *' # At 00:0, every day
  workflow_dispatch:
    inputs:
      repoCache:
        description: 'Reset or disable the cache?'
        type: choice
        default: enabled
        options: [ enabled, disabled, reset ]
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    paths:
      - .github/renovate.json5
      - .github/workflows/renovate.yml

permissions:
  contents: read

env:
  cache_archive: renovate_cache.tar.gz
  cache_dir: /tmp/renovate/cache/renovate/repository
  cache_key: renovate-cache
  RENOVATE_CONFIG_FILE: .github/renovate.json5

jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          sparse-checkout:
            ${{ env.RENOVATE_CONFIG_FILE }}

      # Restore previous cache artifact if enabled
      - name: Restore renovate cache artifact
        if: ${{ github.event_name != 'workflow_dispatch' || inputs.repoCache != 'disabled' }}
        uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 # v12
        continue-on-error: true
        with:
          name: ${{ env.cache_key }}
          path: cache-download

      - name: Extract renovate cache
        if: ${{ github.event_name != 'workflow_dispatch' || inputs.repoCache != 'disabled' }}
        run: |
          set -euxo pipefail
          if [ ! -d cache-download ]; then
            echo "No cache found."
            exit 0
          fi
          mkdir -p "$cache_dir"
          tar -xzf "cache-download/${cache_archive}" -C "$cache_dir"
          sudo chown -R 12021:0 /tmp/renovate/
          ls -R "$cache_dir" || true

      - if: ${{ github.event_name != 'pull_request' && github.repository_owner == 'open-component-model' }}
        id: generate_token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ secrets.OCMBOT_APP_ID }}
          private-key: ${{ secrets.OCMBOT_PRIV_KEY }}

      - name: Ensure Dry-Run on Pull Requests
        if: ${{ github.event_name == 'pull_request' }}
        run: echo "RENOVATE_DRY_RUN=extract" >> $GITHUB_ENV

      - name: Run
        uses: renovatebot/github-action@f7fad228a053c69a98e24f8e4f6cf40db8f61e08 # v44.2.1
        with:
          env-regex: |
            ^(?:RENOVATE_\w+|LOG_LEVEL|GITHUB_COM_TOKEN|GONOPROXY|GOPRIVATE|NODE_OPTIONS|(?:HTTPS?|NO)_PROXY|(?:https?|no)_proxy)$
          token: ${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}
        env:
          GONOPROXY: 'ocm.software/open-component-model/*'
          GOPRIVATE: 'ocm.software/open-component-model/*'
          RENOVATE_ONBOARDING: 'false'
          RENOVATE_USERNAME: 'ocmbot[bot]'
          RENOVATE_PLATFORM: 'github'
          RENOVATE_PLATFORM_COMMIT: 'true'
          RENOVATE_REPOSITORIES: "${{ github.repository }}"
          RENOVATE_REPOSITORY_CACHE: ${{ github.event_name == 'workflow_dispatch' && inputs.repoCache || 'enabled' }}
          RENOVATE_ALLOWED_ENV: 'GONOPROXY,GOPRIVATE'
          RENOVATE_ALLOWED_COMMANDS: |
            ^./.github/scripts/renovate-post-upgrade.sh$

      - name: Compress renovate cache
        if: ${{ env.RENOVATE_DRY_RUN == '' && (github.event_name != 'workflow_dispatch' || inputs.repoCache != 'disabled') }}
        run: |
          set -euxo pipefail
          ls "$cache_dir" || true
          tar -czvf "$cache_archive" -C "$cache_dir" .

      - name: Upload renovate cache artifact
        if: ${{ env.RENOVATE_DRY_RUN == '' && (github.event_name != 'workflow_dispatch' || inputs.repoCache != 'disabled') }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: ${{ env.cache_key }}
          path: ${{ env.cache_archive }}
          retention-days: 1