From eed42a69bc591802ff2bc0041a1cd7d624180771 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 30 Aug 2026 15:17:49 +0300 Subject: [PATCH] Run Renovate from GitHub Actions --- .github/renovate.json | 23 +++++ .github/workflows/renovate.yml | 155 +++++++++++++++++++++++++++++++++ 2 files changed, 178 insertions(+) create mode 100644 .github/workflows/renovate.yml diff --git a/.github/renovate.json b/.github/renovate.json index 32a2b860d..c1b3ad44b 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -7,6 +7,7 @@ "labels": [ "dependencies" ], + "branchConcurrentLimit": 3, "hostRules": [ { "matchHost": "https://mau.dev", @@ -38,6 +39,16 @@ "matchStrings": [ "# renovate: datasource=(?[a-z-.]+?) depName=(?[^\\s]+?)\\s+[A-Za-z0-9_]+?\\s*:\\s*[\"'][^:]+:(?[^\"']+)[\"']" ] + }, + { + "customType": "regex", + "description": "Update the self-hosted Renovate runner version", + "managerFilePatterns": [ + "/^\\.github\\/workflows\\/renovate\\.yml$/" + ], + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+) packageName=(?\\S+)\\s+MATRIX_RENOVATE_VERSION: '(?[^']+)'" + ] } ], "packageRules": [ @@ -75,6 +86,7 @@ ".github/workflows/i18n.yml", ".github/workflows/lock-threads.yml", ".github/workflows/matrix.yml", + ".github/workflows/renovate.yml", ".github/workflows/update-translations.yml", "flake.lock", "i18n/requirements.txt", @@ -83,6 +95,17 @@ "automerge": true, "automergeType": "branch" }, + { + "description": "Automerge updates of the self-hosted Renovate runner (via branch push - no PR)", + "matchManagers": [ + "custom.regex" + ], + "matchDepNames": [ + "matrix-renovate-runner" + ], + "automerge": true, + "automergeType": "branch" + }, { "description": "Molecule's own dependencies merge via branch push (no PR, no email). Anything under molecule-shared/ - the helper container images, Postgres, and the Python pins - triggers the Molecule workflow, and a change to a shared file makes it run every scenario, so an update only merges once the whole suite has passed on it. A failure surfaces as a PR instead. This is how a new Postgres major reaches us: the bump runs every scenario against it before anything is merged.", "matchFileNames": [ diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 000000000..306f195de --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,155 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +name: Renovate + +on: # yamllint disable-line rule:truthy + schedule: + # Discover new updates hourly. Reactive runs below drain active updates. + - cron: '17 * * * *' + workflow_dispatch: + inputs: + dry_run: + description: 'Run without making changes' + required: false + default: true + type: boolean + log_level: + description: 'Renovate log level' + required: false + default: 'info' + type: choice + options: + - info + - debug + - trace + push: + branches: ['master'] + workflow_run: + workflows: ['Matrix CI', 'Matrix i18n', 'Molecule'] + types: [completed] + branches: ['renovate/**'] + issues: + types: [edited] + +permissions: + contents: read + +env: + # Mend-hosted Renovate must remain disabled while this automation is enabled. + # A manual dry-run remains available if this switch is disabled during migration. + MATRIX_RENOVATE_AUTOMATION_ENABLED: 'true' + + # renovate: datasource=docker depName=matrix-renovate-runner packageName=ghcr.io/renovatebot/renovate + MATRIX_RENOVATE_VERSION: '44.51.2' + +jobs: + preflight: + name: Decide whether to run Renovate + runs-on: ubuntu-latest + outputs: + should_run: ${{ steps.decision.outputs.should_run }} + + steps: + - name: Evaluate trigger + id: decision + shell: bash + env: + GH_TOKEN: ${{ github.token }} + EVENT_NAME: ${{ github.event_name }} + EVENT_REF: ${{ github.ref }} + MANUAL_DRY_RUN: ${{ inputs.dry_run }} + WORKFLOW_RUN_CONCLUSION: ${{ github.event.workflow_run.conclusion }} + WORKFLOW_RUN_EVENT: ${{ github.event.workflow_run.event }} + ISSUE_TITLE: ${{ github.event.issue.title }} + SENDER_TYPE: ${{ github.event.sender.type }} + run: | + set -euo pipefail + + should_run=false + reason='Automatic Renovate processing is disabled during migration' + + if [[ "$EVENT_NAME" == 'workflow_dispatch' ]]; then + if [[ "$EVENT_REF" != 'refs/heads/master' ]]; then + reason='Manual runs must use the master branch' + elif [[ "$MANUAL_DRY_RUN" == 'true' || "$MATRIX_RENOVATE_AUTOMATION_ENABLED" == 'true' ]]; then + should_run=true + reason='Running manually requested Renovate job' + else + reason='Enable automatic processing before requesting a write run' + fi + elif [[ "$MATRIX_RENOVATE_AUTOMATION_ENABLED" == 'true' ]]; then + case "$EVENT_NAME" in + schedule) + should_run=true + reason='Running scheduled update discovery' + ;; + workflow_run) + if [[ "$WORKFLOW_RUN_CONCLUSION" == 'success' && "$WORKFLOW_RUN_EVENT" == 'push' ]]; then + should_run=true + reason='A Renovate branch passed one of its status-check workflows' + else + reason='The completed check was not a successful Renovate branch push' + fi + ;; + issues) + if [[ "$ISSUE_TITLE" == 'Dependency Dashboard' && "$SENDER_TYPE" == 'User' ]]; then + should_run=true + reason='A user edited the Dependency Dashboard' + else + reason='The issue edit was not a user editing the Dependency Dashboard' + fi + ;; + push) + renovate_branch_count="$( + gh api \ + "repos/$GITHUB_REPOSITORY/git/matching-refs/heads/renovate" \ + --jq 'length' + )" + if (( renovate_branch_count > 0 )); then + should_run=true + reason="master changed while ${renovate_branch_count} Renovate branch(es) exist" + else + reason='master changed, but there are no Renovate branches to process' + fi + ;; + esac + fi + + echo "should_run=$should_run" >> "$GITHUB_OUTPUT" + echo "$reason" + + renovate: + name: Renovate + needs: preflight + if: needs.preflight.outputs.should_run == 'true' + runs-on: ubuntu-latest + environment: main + concurrency: + group: renovate + cancel-in-progress: false + + steps: + - name: Create Renovate App token + id: renovate_token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_RENOVATE_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_RENOVATE_PRIVATE_KEY }} + + - name: Run Renovate + uses: renovatebot/github-action@5402b206248e5a8c8427a15102702eb9c1793efc # v46.2.4 + with: + token: ${{ steps.renovate_token.outputs.token }} + renovate-version: ${{ env.MATRIX_RENOVATE_VERSION }} + env: + LOG_LEVEL: ${{ inputs.log_level || 'info' }} + RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && 'full' || '' }} + # Permit the self-hosted App to adopt branches created by the Mend-hosted App. + RENOVATE_GIT_IGNORED_AUTHORS: '["29139614+renovate[bot]@users.noreply.github.com"]' + RENOVATE_IGNORE_PR_AUTHOR: 'true' + RENOVATE_PLATFORM: github + RENOVATE_PLATFORM_COMMIT: enabled + RENOVATE_REPOSITORIES: ${{ github.repository }}