Skip to content

Commit 3bc5eae

Browse files
csirmazbendeguzcsirmazbendeguz
committed
feat(dir-sdk-python): migrate Renovate
1 parent 460d7b6 commit 3bc5eae

4 files changed

Lines changed: 193 additions & 0 deletions

File tree

‎.github/workflows/dependencies.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Dependencies
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 */6 * * *"
7+
8+
jobs:
9+
renovate:
10+
name: Renovate Sync
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Authenticate with GitHub App Bot
14+
id: app-token
15+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
16+
with:
17+
app-id: ${{ secrets.PROJECT_APP_ID }}
18+
private-key: ${{ secrets.PROJECT_APP_KEY }}
19+
20+
- name: Checkout
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
token: ${{ steps.app-token.outputs.token }}
24+
ref: ${{ github.head_ref }}
25+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
26+
persist-credentials: false
27+
28+
- name: Install Task
29+
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 #v2.0.0
30+
31+
- name: Setup Node
32+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
33+
with:
34+
node-version: "24.x"
35+
36+
- name: Run Renovate
37+
run: task deps:renovate:sync
38+
env:
39+
## Discovery
40+
RENOVATE_AUTODISCOVER: "true"
41+
RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
42+
## Project sync
43+
RENOVATE_PLATFORM: "github"
44+
RENOVATE_PLATFORM_COMMIT: "enabled"
45+
RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
46+
GITHUB_COM_TOKEN: ${{ steps.app-token.outputs.token }}
47+
# Remove unused fields from PR description
48+
RENOVATE_PR_BODY_TEMPLATE: "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}"
49+
RENOVATE_DEPENDENCY_DASHBOARD_HEADER: ""
50+
RENOVATE_DEPENDENCY_DASHBOARD_O_S_V_VULNERABILITY_SUMMARY: "all"

‎Taskfile.deps.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,31 @@ tasks:
9393
- which docker
9494
cmds:
9595
- docker image pull ghcr.io/agntcy/dir-ctl:{{ .DIRCTL_IMAGE_TAG }}
96+
97+
deps:renovate:
98+
desc: Install Renovate
99+
internal: true
100+
cmd: npm install -g renovate@{{ .RENOVATE_VERSION }}
101+
status:
102+
- npm list -g renovate
103+
104+
deps:renovate:sync:
105+
desc: Sync dependencies with Renovate
106+
summary: |
107+
For extra CLI flags pass RENOVATE_OPTS (e.g. task deps:renovate:sync RENOVATE_OPTS='--dry-run').
108+
Default platform is local so local runs do not touch remote project data.
109+
Github Action CI sets RENOVATE_PLATFORM to github.
110+
This step is only analytical without GITHUB TOKEN and will not update PRs or project data.
111+
deps:
112+
- deps:renovate
113+
dir: "{{ .ROOT_DIR }}"
114+
vars:
115+
RENOVATE_OPTS_DEFAULT: >-
116+
--persist-repo-data 'true'
117+
--allowed-post-upgrade-commands '[".*"]'
118+
--post-upgrade-tasks '{"commands": ["task helm:gen", "task deps:tidy", "task sdk:tidy"], "executionMode": "branch"}'
119+
RENOVATE_OPTS: "{{ .RENOVATE_OPTS | default .RENOVATE_OPTS_DEFAULT }}"
120+
RENOVATE_PLATFORM_EFFECTIVE:
121+
sh: printf '%s' "${RENOVATE_PLATFORM:-local}"
122+
cmds:
123+
- renovate {{ .RENOVATE_OPTS }} --platform "{{ .RENOVATE_PLATFORM_EFFECTIVE }}"

‎Taskfile.vars.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ version: "3"
66
vars:
77
DIR_CHART_VERSION: '{{ .DIR_CHART_VERSION | default "0.0.0-latest" }}'
88
DIRCTL_IMAGE_TAG: '{{ .DIRCTL_IMAGE_TAG | default "latest" }}'
9+
RENOVATE_VERSION: "43.89.5"
910
BIN_DIR: "{{ .ROOT_DIR }}/.bin"
1011
HELM_VERSION: "4.1.3"
1112
HELM_BIN: "{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}"

‎renovate.json‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:recommended",
5+
"helpers:pinGitHubActionDigestsToSemver",
6+
":semanticCommitTypeAll(chore)",
7+
":dependencyDashboard"
8+
],
9+
"configMigration": true,
10+
"customManagers": [
11+
{
12+
"customType": "regex",
13+
"managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"],
14+
"matchStrings": [
15+
"(?m)^\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\r?\\n\\s*(?<varName>[A-Z0-9_]+)_VERSION:\\s+\"?(?<currentValue>[^\"@\\s]+)\"?\\s*$"
16+
],
17+
"currentValueTemplate": "{{currentValue}}",
18+
"description": [
19+
"Custom dependency manager for updating tool version defined in Taskfile."
20+
]
21+
},
22+
{
23+
"customType": "regex",
24+
"managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"],
25+
"matchStrings": [
26+
"(?m)^\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\r?\\n\\s*(?<varName>[A-Z0-9_]+)_VERSION:\\s+\"?(?:(?<currentValue>[^@\"\\s]+)@)?(?<currentDigest>sha256:[a-f0-9]+)\"?\\s*$"
27+
],
28+
"currentValueTemplate": "{{currentValue}}",
29+
"description": [
30+
"Custom dependency manager for updating image tag@digest defined in Taskfile."
31+
]
32+
}
33+
],
34+
"dependencyDashboardAutoclose": true,
35+
"dependencyDashboardLabels": ["dependencies"],
36+
"dependencyDashboardOSVVulnerabilitySummary": "all",
37+
"enabled": true,
38+
"minimumReleaseAge": "3 days",
39+
"schedule": ["before 6am on Monday"],
40+
"enabledManagers": [
41+
"custom.regex",
42+
"github-actions",
43+
"pyenv",
44+
"pip_setup",
45+
"pip_requirements",
46+
"pep621"
47+
],
48+
"labels": ["dependencies"],
49+
"ignoreDeps": [],
50+
"osvVulnerabilityAlerts": true,
51+
"lockFileMaintenance": {
52+
"enabled": true
53+
},
54+
"packageRules": [
55+
{
56+
"matchUpdateTypes": ["major"],
57+
"enabled": false,
58+
"description": ["Ignore major dependency updates."]
59+
},
60+
{
61+
"groupName": "Python",
62+
"groupSlug": "python",
63+
"matchCategories": ["python"],
64+
"addLabels": ["python"],
65+
"description": [
66+
"Add python label to PRs which bumps python dependencies.",
67+
"Group Python dependency updates in single PR."
68+
]
69+
},
70+
{
71+
"groupName": "Taskfile",
72+
"groupSlug": "taskfile",
73+
"matchFileNames": ["Taskfile.*"],
74+
"addLabels": ["build"],
75+
"description": [
76+
"Add build label to PRs which are related to build tools defined in Taskfile.",
77+
"Group Taskfile dependency updates in single PR."
78+
]
79+
},
80+
{
81+
"groupName": "Github Actions",
82+
"groupSlug": "github-actions",
83+
"matchDatasources": ["github-tags"],
84+
"addLabels": ["ci"],
85+
"description": [
86+
"Add ci label to PRs which are related to Github Actions.",
87+
"Group CI dependency updates in single PR."
88+
]
89+
},
90+
{
91+
"matchJsonata": [
92+
"$exists(vulnerabilityFixVersion) or isVulnerabilityAlert = true"
93+
],
94+
"enabled": true,
95+
"description": [
96+
"Always allow vulnerability/security fixes, even when other rules disable majors or specific dependencies."
97+
]
98+
}
99+
],
100+
"postUpdateOptions": [],
101+
"prConcurrentLimit": 20,
102+
"prHourlyLimit": 10,
103+
"printConfig": false,
104+
"rebaseWhen": "behind-base-branch",
105+
"reviewersFromCodeOwners": true,
106+
"semanticCommits": "enabled",
107+
"timezone": "Etc/UTC",
108+
"vulnerabilityAlerts": {
109+
"enabled": true,
110+
"labels": ["security"],
111+
"minimumReleaseAge": null,
112+
"schedule": ["at any time"]
113+
}
114+
}

0 commit comments

Comments
 (0)