Skip to content

Commit b9441dd

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
chore(ci): enable Renovate (#4642)
Signed-off-by: Barabanov <[email protected]>
1 parent f993eb2 commit b9441dd

File tree

4 files changed

+297
-57
lines changed

4 files changed

+297
-57
lines changed

‎.github/dependabot.yaml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎.github/renovate.json5‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
// Dependency Update Configuration
2+
//
3+
// See https://docs.renovatebot.com/configuration-options/
4+
// See https://json5.org/ for JSON5 syntax
5+
6+
// [!] While updating the Renovate config, test changes on your own fork.
7+
// 1. Modify the Renovate configuration, which is located in .github/renovate.json5 and push your changes to the default branch of your fork.
8+
// 2. Enable the Renovate GitHub app in your GitHub account.
9+
// Verify that Renovate is activated in the repository settings within the Renovate Dashboard.
10+
// To enable the dashboard set `dependencyDashboard` to true
11+
// 3. Trigger the Renovate app from the dashboard, or push a new commit to your fork’s default branch to re-trigger Renovate.
12+
// 4. Use the dashboard to initiate Renovate and create a PR on your fork, then check that the proposed PRs are modifying the correct parts.
13+
// 5. Once you’ve validated that the Renovate configuration works on your fork, submit a PR,
14+
// and include links in the description to share details about the testing you've conducted.
15+
16+
{
17+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
18+
19+
// regenerate lock weekly https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
20+
lockFileMaintenance: {
21+
enabled: true,
22+
schedule: ["* * * * 0"], // weekly
23+
},
24+
25+
extends: ["config:base", ":gitSignOff", "helpers:pinGitHubActionDigests"],
26+
// https://docs.renovatebot.com/presets-default/#gitsignoff
27+
// https://docs.renovatebot.com/presets-helpers/#helperspingithubactiondigests
28+
29+
// if necessary, add supported releases branches here
30+
// it is possible to enable/disable specific upgrades per branch with
31+
// `matchBaseBranches` in specific rule
32+
baseBranches: ["develop"],
33+
34+
// https://docs.renovatebot.com/modules/manager/#disabling-managers
35+
pip_requirements: {
36+
// Prevent renovate from trying to update demo code
37+
enabled: false,
38+
managerFilePatterns: [
39+
"lib/src/otx/backend/native/exporter/exportable_code/demo/requirements.txt",
40+
],
41+
},
42+
43+
// Set limit to 5
44+
ignorePresets: [":prHourlyLimit2"],
45+
prHourlyLimit: 5,
46+
47+
packageRules: [
48+
// Enable pinning for container images
49+
// https://docs.renovatebot.com/presets-docker/#dockerpindigests
50+
{
51+
enabled: true,
52+
matchDatasources: ["docker"],
53+
pinDigests: true,
54+
groupName: "Pin images",
55+
groupSlug: "pin-images",
56+
schedule: ["* * * * 0"], // weekly
57+
},
58+
59+
// Disable python base image upgrades, except patch and digital pinning
60+
{
61+
enabled: false,
62+
matchDatasources: ["docker"],
63+
matchPackageNames: ["python"],
64+
matchUpdateTypes: ["major", "minor"],
65+
},
66+
67+
// Disable node image upgrades, except patch and digital pinning
68+
{
69+
enabled: false,
70+
matchDatasources: ["docker"],
71+
matchPackageNames: ["node"],
72+
matchUpdateTypes: ["major", "minor"],
73+
},
74+
75+
// Disable eclipse-mosquitto image upgrades, except patch and digital pinning
76+
{
77+
enabled: false,
78+
matchDatasources: ["docker"],
79+
matchPackageNames: ["eclipse-mosquitto"],
80+
matchUpdateTypes: ["major", "minor"],
81+
},
82+
83+
// Disable emqx/mqttx-web image upgrades, except patch and digital pinning
84+
{
85+
enabled: false,
86+
matchDatasources: ["docker"],
87+
matchPackageNames: ["emqx/mqttx-web"],
88+
matchUpdateTypes: ["major", "minor"],
89+
},
90+
91+
// Disable nvidia/cuda image upgrades, except patch and digital pinning
92+
{
93+
enabled: false,
94+
matchDatasources: ["docker"],
95+
matchPackageNames: ["nvidia/cuda"],
96+
matchUpdateTypes: ["major", "minor"],
97+
},
98+
99+
// Disable pytorch/pytorch image upgrades, except patch and digital pinning
100+
{
101+
enabled: false,
102+
matchDatasources: ["docker"],
103+
matchPackageNames: ["pytorch/pytorch"],
104+
matchUpdateTypes: ["major", "minor"],
105+
},
106+
107+
// Disable non-security upgrades for pypi, npm and crate, except lock file update
108+
// node is upgraded manually
109+
{
110+
enabled: false,
111+
matchDatasources: ["pypi", "node-version", "crate", "npm"],
112+
},
113+
114+
// Python version in TOML is updated manually
115+
{
116+
enabled: false,
117+
matchDatasources: ["python-version"],
118+
matchDepTypes: ["requires-python"],
119+
matchDepNames: ["python"],
120+
},
121+
122+
// Disable upgrades for Dockerfile syntax (docker/dockerfile)
123+
{
124+
enabled: false,
125+
matchDatasources: ["docker"],
126+
matchDepNames: ["docker/dockerfile"],
127+
},
128+
129+
// Group GitHub Actions updates
130+
{
131+
enabled: true,
132+
separateMajorMinor: false,
133+
groupName: "GitHub Actions",
134+
matchManagers: ["github-actions"],
135+
matchPackagePatterns: ["*"],
136+
schedule: ["* * 1,15 * *"], // twice a month
137+
},
138+
139+
// uv version used in GitHub Actions is updated manually
140+
{
141+
enabled: false,
142+
matchDatasources: ["github-releases"],
143+
matchDepNames: ["astral-sh/uv"],
144+
matchDepTypes: ["uses-with"],
145+
},
146+
147+
// python version used in GitHub Actions is updated manually
148+
{
149+
enabled: false,
150+
matchDatasources: ["github-releases"],
151+
matchDepNames: ["python"],
152+
matchDepTypes: ["uses-with"],
153+
},
154+
155+
// Disable mcr.microsoft.com/playwright image upgrades, except digital pinning,
156+
{
157+
enabled: false,
158+
matchManagers: ["github-actions"],
159+
matchDepTypes: ["container"],
160+
matchDepNames: ["mcr.microsoft.com/playwright"],
161+
matchUpdateTypes: ["major", "minor", "patch"],
162+
},
163+
],
164+
165+
// Enable security upgrades
166+
vulnerabilityAlerts: {
167+
enabled: true,
168+
},
169+
osvVulnerabilityAlerts: true,
170+
dependencyDashboard: true,
171+
}

‎.github/workflows/renovate-config-validator.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Renovate configuration validator
2+
#
3+
# This workflow validates changes proposed into Renovate configuration file
4+
# (.github/renovate.json5) and prevents non-valid configuration to be used by Renovate.
5+
#
6+
# Required Secrets:
7+
# - None
8+
#
9+
# Automatically triggered on:
10+
# - Pull requests to .github/renovate.json5.
11+
#
12+
13+
name: Validate Renovate configuration
14+
15+
on:
16+
pull_request:
17+
paths:
18+
- ".github/renovate.json5"
19+
20+
permissions:
21+
contents: read
22+
23+
concurrency:
24+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
25+
cancel-in-progress: true
26+
27+
jobs:
28+
validate:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: Checkout configuration
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
with:
34+
persist-credentials: false
35+
36+
- name: Validate configuration
37+
run: |
38+
# renovate: datasource=docker
39+
export RENOVATE_IMAGE=ghcr.io/renovatebot/renovate:40.11
40+
docker run --rm --entrypoint "renovate-config-validator" \
41+
-v "${{ github.workspace }}/.github/renovate.json5":"/renovate.json5" \
42+
${RENOVATE_IMAGE} "/renovate.json5"

‎.github/workflows/renovate.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Dependencies Management Workflow
2+
#
3+
# This workflow automates the dependence management based on self-hosed Renovate
4+
# ensure the project's dependencies remains up-to-date and security fixes are delivered regularly.
5+
#
6+
# Key Features:
7+
# - Automated PR creation into pyproject.toml and uv.lock regeneration
8+
# - Dry-run for debug purposes
9+
# - Dependency dashboard (is available in GitHub issues) maintenance
10+
#
11+
# Process Stages:
12+
#
13+
# 1. Dependencies Management:
14+
# - Runs on a daily schedule.
15+
# - Identifies dependencies that may be updated based on .github/renovate.json5 configuration.
16+
# - Opens corresponding PRs with respect to schedule defined in Renovate config file.
17+
# - Updates Renovate Dependency dashboard that is available in GitHub issues.
18+
#
19+
# Required Secrets:
20+
# - RENOVATE_APP_ID: application ID
21+
# - RENOVATE_APP_PEM: application private key
22+
#
23+
# Example Usage:
24+
# 1. Scheduled Run:
25+
# Automatically runs, daily
26+
#
27+
# 2. Manual Trigger:
28+
# workflow_dispatch:
29+
# inputs:
30+
# dry-run:
31+
# description: "Run Renovate in dry-run mode (no PR)"
32+
# required: false
33+
# default: false
34+
# type: boolean
35+
#
36+
# Note: Renovate maintains and updates Dependency dashboard that is available in GitHub issues.
37+
38+
name: Renovate
39+
on:
40+
schedule:
41+
# daily
42+
- cron: "0 2 * * *"
43+
44+
# allow to manually trigger this workflow
45+
workflow_dispatch:
46+
inputs:
47+
dry-run:
48+
description: "Run Renovate in dry-run mode (no PR)"
49+
required: false
50+
default: false
51+
type: boolean
52+
53+
permissions: {}
54+
55+
jobs:
56+
renovate:
57+
permissions:
58+
contents: read
59+
runs-on: ubuntu-latest
60+
61+
steps:
62+
- name: Checkout
63+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
64+
with:
65+
persist-credentials: false
66+
67+
- name: Get token
68+
id: get-github-app-token
69+
uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
70+
with:
71+
app-id: ${{ secrets.RENOVATE_APP_ID }}
72+
private-key: ${{ secrets.RENOVATE_APP_PEM }}
73+
74+
- name: Self-hosted Renovate
75+
uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9
76+
with:
77+
configurationFile: .github/renovate.json5
78+
token: "${{ steps.get-github-app-token.outputs.token }}"
79+
env:
80+
LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && 'debug' || 'info' }}
81+
# Dry run if the event is workflow_dispatch AND the dry-run input is true
82+
RENOVATE_DRY_RUN: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true') && 'full' || null }}
83+
RENOVATE_PLATFORM: github
84+
RENOVATE_REPOSITORIES: ${{ github.repository }}

0 commit comments

Comments
 (0)