2.3 KiB
Maintaining the Renovate runner
The self-hosted runner version is pinned in .github/workflows/renovate.yml. Renovate updates this pin and automerges passing updates according to .github/renovate.json.
The Renovate smoke test workflow tests the candidate image on branch pushes and fork pull requests. It validates configuration and starts the real Renovate runtime to extract dependencies from the checked-out repository. It requires results from all eight managers currently used here, including the custom managers that update role versions, Molecule helper images, and Renovate itself, and rejects errors or missing completion logs. The containers have no network access, receive no credentials, and mount the checkout read-only.
Run the same check locally with Docker, Bash, and jq installed:
bin/renovate-smoke-test.sh
# Reproduce the broken image without changing the workflow pin:
bin/renovate-smoke-test.sh 44.64.0
Version 44.64.0 is deliberately excluded from runner updates: its APK datasource imports tar, which was only declared as a development dependency and is missing from the production image. It passed configuration validation and --version, then crashed at startup with exit code 0 (incident log). The runner was reverted to 44.61.6. Both production and the smoke test set NODE_OPTIONS=--unhandled-rejections=strict so unhandled startup failures return a failing exit code.
Upstream corrected the packaging in Renovate PR #45699. A runner that crashes before processing the repository cannot discover its own replacement, so recovery requires manually changing the pin to a working version.
This smoke test would have blocked that upgrade. It does not exercise registry lookups, GitHub authentication, or branch/PR writes. For live integration checks, manually dispatch the Renovate workflow on master with dry_run enabled and log_level set to debug. That tests the pin already on master; it is not a pre-merge test of a candidate branch. Check the smoke-test result when manually merging runner upgrades too.