Skip to content

Commit 49bd72c

Browse files
csirmazbendeguzcsirmazbendeguz
committed
fix(dir-sdk-javascript): migrate Renovate
1 parent 2e8f81f commit 49bd72c

4 files changed

Lines changed: 182 additions & 0 deletions

File tree

‎.github/workflows/dependencies.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Dependencies
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 */6 * * *"
7+
8+
jobs:
9+
renovate:
10+
name: Renovate Sync
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Authenticate with GitHub App Bot
14+
id: app-token
15+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
16+
with:
17+
app-id: ${{ secrets.PROJECT_APP_ID }}
18+
private-key: ${{ secrets.PROJECT_APP_KEY }}
19+
20+
- name: Checkout
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
token: ${{ steps.app-token.outputs.token }}
24+
ref: ${{ github.head_ref }}
25+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
26+
persist-credentials: false
27+
28+
- name: Install Task
29+
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 #v2.0.0
30+
31+
- name: Setup Node
32+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
33+
with:
34+
node-version: "24.x"
35+
36+
- name: Run Renovate
37+
run: task deps:renovate:sync
38+
env:
39+
## Discovery
40+
RENOVATE_AUTODISCOVER: "true"
41+
RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
42+
## Project sync
43+
RENOVATE_PLATFORM: "github"
44+
RENOVATE_PLATFORM_COMMIT: "enabled"
45+
RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
46+
GITHUB_COM_TOKEN: ${{ steps.app-token.outputs.token }}
47+
# Remove unused fields from PR description
48+
RENOVATE_PR_BODY_TEMPLATE: "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}"
49+
RENOVATE_DEPENDENCY_DASHBOARD_HEADER: ""
50+
RENOVATE_DEPENDENCY_DASHBOARD_O_S_V_VULNERABILITY_SUMMARY: "all"

‎Taskfile.deps.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,3 +78,31 @@ tasks:
7878
- which docker
7979
cmds:
8080
- docker image pull ghcr.io/agntcy/dir-ctl:{{ .DIRCTL_IMAGE_TAG }}
81+
82+
deps:renovate:
83+
desc: Install Renovate
84+
internal: true
85+
cmd: npm install -g renovate@{{ .RENOVATE_VERSION }}
86+
status:
87+
- npm list -g renovate
88+
89+
deps:renovate:sync:
90+
desc: Sync dependencies with Renovate
91+
summary: |
92+
For extra CLI flags pass RENOVATE_OPTS (e.g. task deps:renovate:sync RENOVATE_OPTS='--dry-run').
93+
Default platform is local so local runs do not touch remote project data.
94+
Github Action CI sets RENOVATE_PLATFORM to github.
95+
This step is only analytical without GITHUB TOKEN and will not update PRs or project data.
96+
deps:
97+
- deps:renovate
98+
dir: "{{ .ROOT_DIR }}"
99+
vars:
100+
RENOVATE_OPTS_DEFAULT: >-
101+
--persist-repo-data 'true'
102+
--allowed-post-upgrade-commands '[".*"]'
103+
--post-upgrade-tasks '{"commands": ["task helm:gen", "task deps:tidy"], "executionMode": "branch"}'
104+
RENOVATE_OPTS: "{{ .RENOVATE_OPTS | default .RENOVATE_OPTS_DEFAULT }}"
105+
RENOVATE_PLATFORM_EFFECTIVE:
106+
sh: printf '%s' "${RENOVATE_PLATFORM:-local}"
107+
cmds:
108+
- renovate {{ .RENOVATE_OPTS }} --platform "{{ .RENOVATE_PLATFORM_EFFECTIVE }}"

‎Taskfile.vars.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ version: "3"
66
vars:
77
DIR_CHART_VERSION: '{{ .DIR_CHART_VERSION | default "0.0.0-latest" }}'
88
DIRCTL_IMAGE_TAG: '{{ .DIRCTL_IMAGE_TAG | default "latest" }}'
9+
RENOVATE_VERSION: "43.89.5"
910
BIN_DIR: "{{ .ROOT_DIR }}/.bin"
1011
HELM_VERSION: "4.1.3"
1112
HELM_BIN: "{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}"

‎renovate.json‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:recommended",
5+
"helpers:pinGitHubActionDigestsToSemver",
6+
":semanticCommitTypeAll(chore)",
7+
":dependencyDashboard"
8+
],
9+
"configMigration": true,
10+
"customManagers": [
11+
{
12+
"customType": "regex",
13+
"managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"],
14+
"matchStrings": [
15+
"(?m)^\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\r?\\n\\s*(?<varName>[A-Z0-9_]+)_VERSION:\\s+\"?(?<currentValue>[^\"@\\s]+)\"?\\s*$"
16+
],
17+
"currentValueTemplate": "{{currentValue}}",
18+
"description": [
19+
"Custom dependency manager for updating tool version defined in Taskfile."
20+
]
21+
},
22+
{
23+
"customType": "regex",
24+
"managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"],
25+
"matchStrings": [
26+
"(?m)^\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\r?\\n\\s*(?<varName>[A-Z0-9_]+)_VERSION:\\s+\"?(?:(?<currentValue>[^@\"\\s]+)@)?(?<currentDigest>sha256:[a-f0-9]+)\"?\\s*$"
27+
],
28+
"currentValueTemplate": "{{currentValue}}",
29+
"description": [
30+
"Custom dependency manager for updating image tag@digest defined in Taskfile."
31+
]
32+
}
33+
],
34+
"dependencyDashboardAutoclose": true,
35+
"dependencyDashboardLabels": ["dependencies"],
36+
"dependencyDashboardOSVVulnerabilitySummary": "all",
37+
"enabled": true,
38+
"minimumReleaseAge": "3 days",
39+
"schedule": ["before 6am on Monday"],
40+
"enabledManagers": [
41+
"custom.regex",
42+
"github-actions",
43+
"npm",
44+
"nvm",
45+
"nodenv"
46+
],
47+
"labels": ["dependencies"],
48+
"ignoreDeps": [],
49+
"osvVulnerabilityAlerts": true,
50+
"lockFileMaintenance": {
51+
"enabled": true
52+
},
53+
"packageRules": [
54+
{
55+
"matchUpdateTypes": ["major"],
56+
"enabled": false,
57+
"description": ["Ignore major dependency updates."]
58+
},
59+
{
60+
"groupName": "Taskfile",
61+
"groupSlug": "taskfile",
62+
"matchFileNames": ["Taskfile.*"],
63+
"addLabels": ["build"],
64+
"description": [
65+
"Add build label to PRs which are related to build tools defined in Taskfile.",
66+
"Group Taskfile dependency updates in single PR."
67+
]
68+
},
69+
{
70+
"groupName": "Github Actions",
71+
"groupSlug": "github-actions",
72+
"matchDatasources": ["github-tags"],
73+
"addLabels": ["ci"],
74+
"description": [
75+
"Add ci label to PRs which are related to Github Actions.",
76+
"Group CI dependency updates in single PR."
77+
]
78+
},
79+
{
80+
"matchJsonata": [
81+
"$exists(vulnerabilityFixVersion) or isVulnerabilityAlert = true"
82+
],
83+
"enabled": true,
84+
"description": [
85+
"Always allow vulnerability/security fixes, even when other rules disable majors or specific dependencies."
86+
]
87+
}
88+
],
89+
"postUpdateOptions": [],
90+
"prConcurrentLimit": 20,
91+
"prHourlyLimit": 10,
92+
"printConfig": false,
93+
"rebaseWhen": "behind-base-branch",
94+
"reviewersFromCodeOwners": true,
95+
"semanticCommits": "enabled",
96+
"timezone": "Etc/UTC",
97+
"vulnerabilityAlerts": {
98+
"enabled": true,
99+
"labels": ["security"],
100+
"minimumReleaseAge": null,
101+
"schedule": ["at any time"]
102+
}
103+
}

0 commit comments

Comments
 (0)