Skip to content

Commit 0593d3b

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
Enable Renovate (#1908)
This PR adds a workflows (`renovate.yml` and `renovate-config-validator.yml`) and configuration renovate.json5 to run Renovate as a GitHub Action. Workflow `renovate.yml` will run daily and open PRs with suggested security upgrades and version upgrades (weekly and montly). Instead of using a Personal Access Token (PAT) that is tied to a particular user / faceless account this workflow uses private GitHub App with tuned permissions. `renovate-config-validator.yml` workflow will validate changes in renovate.json5. PR from Dependabot will be disabled. Expected behavior: PRs: https://github.com/AlexanderBarabanov/datumaro/pulls Dashboard: AlexanderBarabanov#10 ### Checklist <!-- Put an 'x' in all the boxes that apply --> - [ ] I have added tests to cover my changes or documented any manual tests. - [ ] I have updated the [documentation](https://github.com/open-edge-platform/datumaro/tree/develop/docs) accordingly --------- Signed-off-by: Barabanov <[email protected]>
1 parent d19fe1d commit 0593d3b

File tree

3 files changed

+221
-0
lines changed

3 files changed

+221
-0
lines changed

‎.github/renovate.json5‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// Dependency Update Configuration
2+
//
3+
// See https://docs.renovatebot.com/configuration-options/
4+
// See https://json5.org/ for JSON5 syntax
5+
6+
// [!] While updating the Renovate config, test changes on your own fork.
7+
// 1. Modify the Renovate configuration, which is located in .github/renovate.json5 and push your changes to the default branch of your fork.
8+
// 2. Enable the Renovate GitHub app in your GitHub account.
9+
// Verify that Renovate is activated in the repository settings within the Renovate Dashboard.
10+
// To enable the dashboard set `dependencyDashboard` to true
11+
// 3. Trigger the Renovate app from the dashboard, or push a new commit to your fork’s default branch to re-trigger Renovate.
12+
// 4. Use the dashboard to initiate Renovate and create a PR on your fork, then check that the proposed PRs are modifying the correct parts.
13+
// 5. Once you’ve validated that the Renovate configuration works on your fork, submit a PR,
14+
// and include links in the description to share details about the testing you've conducted.
15+
16+
{
17+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
18+
19+
// regenerate lock weekly https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
20+
lockFileMaintenance: {
21+
enabled: true,
22+
schedule: ["* * * * 0"], // weekly
23+
},
24+
25+
extends: ["config:base", ":gitSignOff", "helpers:pinGitHubActionDigests"],
26+
// https://docs.renovatebot.com/presets-default/#gitsignoff
27+
// https://docs.renovatebot.com/presets-helpers/#helperspingithubactiondigests
28+
29+
// if necessary, add supported releases branches here
30+
// it is possible to enable/disable specific upgrades per branch with
31+
// `matchBaseBranches` in specific rule
32+
baseBranches: ["develop"],
33+
34+
enabledManagers: ["github-actions", "pep621", "cargo", "pip_requirements"],
35+
36+
// Set limit to 5
37+
ignorePresets: [":prHourlyLimit2"],
38+
prHourlyLimit: 5,
39+
40+
packageRules: [
41+
{
42+
enabled: true,
43+
matchManagers: ["pep621"],
44+
schedule: ["* * * * 0"], // weekly
45+
},
46+
47+
// Disable non-security upgrades for docs/requirements.txt
48+
{
49+
enabled: false,
50+
matchManagers: ["pip_requirements"],
51+
},
52+
53+
// Disable derive_more major upgrades to prevent regressions
54+
// Will be enabled in a next step
55+
{
56+
enabled: false,
57+
matchDatasources: ["crate"],
58+
matchPackageNames: ["derive_more"],
59+
matchUpdateTypes: ["major"],
60+
},
61+
62+
// Group GitHub Actions updates
63+
{
64+
enabled: true,
65+
separateMajorMinor: false,
66+
groupName: "GitHub Actions",
67+
matchManagers: ["github-actions"],
68+
matchPackagePatterns: ["*"],
69+
schedule: ["* * 1 * *"], // every month
70+
},
71+
72+
// uv version used in GitHub Actions is updated manually
73+
{
74+
enabled: false,
75+
matchDatasources: ["github-releases"],
76+
matchDepNames: ["astral-sh/uv"],
77+
matchDepTypes: ["uses-with"],
78+
},
79+
80+
// python version used in GitHub Actions is updated manually
81+
{
82+
enabled: false,
83+
matchDatasources: ["github-releases"],
84+
matchDepNames: ["python"],
85+
matchDepTypes: ["uses-with"],
86+
},
87+
],
88+
89+
// Enable security upgrades
90+
vulnerabilityAlerts: {
91+
enabled: true,
92+
},
93+
osvVulnerabilityAlerts: true,
94+
dependencyDashboard: true,
95+
}

‎.github/workflows/renovate-config-validator.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Renovate configuration validator
2+
#
3+
# This workflow validates changes proposed into Renovate configuration file
4+
# (.github/renovate.json5) and prevents non-valid configuration to be used by Renovate.
5+
#
6+
# Required Secrets:
7+
# - None
8+
#
9+
# Automatically triggered on:
10+
# - Pull requests to .github/renovate.json5.
11+
#
12+
13+
name: Validate Renovate configuration
14+
15+
on:
16+
pull_request:
17+
paths:
18+
- ".github/renovate.json5"
19+
20+
permissions:
21+
contents: read
22+
23+
concurrency:
24+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
25+
cancel-in-progress: true
26+
27+
jobs:
28+
validate:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: Checkout configuration
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
with:
34+
persist-credentials: false
35+
36+
- name: Validate configuration
37+
run: |
38+
# renovate: datasource=docker
39+
export RENOVATE_IMAGE=ghcr.io/renovatebot/renovate:40.11
40+
docker run --rm --entrypoint "renovate-config-validator" \
41+
-v "${{ github.workspace }}/.github/renovate.json5":"/renovate.json5" \
42+
${RENOVATE_IMAGE} "/renovate.json5"

‎.github/workflows/renovate.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Dependencies Management Workflow
2+
#
3+
# This workflow automates the dependence management based on self-hosed Renovate
4+
# ensure the project's dependencies remains up-to-date and security fixes are delivered regularly.
5+
#
6+
# Key Features:
7+
# - Automated PR creation into pyproject.toml and uv.lock regeneration
8+
# - Dry-run for debug purposes
9+
# - Dependency dashboard (is available in GitHub issues) maintenance
10+
#
11+
# Process Stages:
12+
#
13+
# 1. Dependencies Management:
14+
# - Runs on a daily schedule.
15+
# - Identifies dependencies that may be updated based on .github/renovate.json5 configuration.
16+
# - Opens corresponding PRs with respect to schedule defined in Renovate config file.
17+
# - Updates Renovate Dependency dashboard that is available in GitHub issues.
18+
#
19+
# Required Secrets:
20+
# - RENOVATE_APP_ID: application ID
21+
# - RENOVATE_APP_PEM: application private key
22+
#
23+
# Example Usage:
24+
# 1. Scheduled Run:
25+
# Automatically runs, daily
26+
#
27+
# 2. Manual Trigger:
28+
# workflow_dispatch:
29+
# inputs:
30+
# dry-run:
31+
# description: "Run Renovate in dry-run mode (no PR)"
32+
# required: false
33+
# default: false
34+
# type: boolean
35+
#
36+
# Note: Renovate maintains and updates Dependency dashboard that is available in GitHub issues.
37+
38+
name: Renovate
39+
on:
40+
schedule:
41+
# daily
42+
- cron: "0 2 * * *"
43+
44+
# allow to manually trigger this workflow
45+
workflow_dispatch:
46+
inputs:
47+
dry-run:
48+
description: "Run Renovate in dry-run mode (no PR)"
49+
required: false
50+
default: false
51+
type: boolean
52+
53+
permissions: {}
54+
55+
jobs:
56+
renovate:
57+
permissions:
58+
contents: read
59+
runs-on: ubuntu-latest
60+
61+
steps:
62+
- name: Checkout
63+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
64+
with:
65+
persist-credentials: false
66+
67+
- name: Get token
68+
id: get-github-app-token
69+
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
70+
with:
71+
app-id: ${{ secrets.RENOVATE_APP_ID }}
72+
private-key: ${{ secrets.RENOVATE_APP_PEM }}
73+
74+
- name: Self-hosted Renovate
75+
uses: renovatebot/github-action@2d941ef4e268e53affdc1f11365c69a73e544f50 # v43.0.14
76+
with:
77+
configurationFile: .github/renovate.json5
78+
token: "${{ steps.get-github-app-token.outputs.token }}"
79+
env:
80+
LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && 'debug' || 'info' }}
81+
# Dry run if the event is workflow_dispatch AND the dry-run input is true
82+
RENOVATE_DRY_RUN: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true') && 'full' || null }}
83+
RENOVATE_PLATFORM: github
84+
RENOVATE_REPOSITORIES: ${{ github.repository }}

0 commit comments

Comments
 (0)