From a0d1de15ff013efefbf8be16b35b848a19576c65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bendeg=C3=BAz=20Csirmaz?= Date: Fri, 17 Apr 2026 15:15:03 +0200 Subject: [PATCH] feat(dir-sdk-python): migrate Renovate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Bendegúz Csirmaz --- .github/workflows/dependencies.yaml | 50 ++++++++++++ Taskfile.deps.yml | 28 +++++++ Taskfile.vars.yml | 1 + renovate.json | 114 ++++++++++++++++++++++++++++ 4 files changed, 193 insertions(+) create mode 100644 .github/workflows/dependencies.yaml create mode 100644 renovate.json diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml new file mode 100644 index 0000000..5836f6c --- /dev/null +++ b/.github/workflows/dependencies.yaml @@ -0,0 +1,50 @@ +name: Dependencies + +on: + workflow_dispatch: + schedule: + - cron: "0 */6 * * *" + +jobs: + renovate: + name: Renovate Sync + runs-on: ubuntu-latest + steps: + - name: Authenticate with GitHub App Bot + id: app-token + uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + with: + app-id: ${{ secrets.PROJECT_APP_ID }} + private-key: ${{ secrets.PROJECT_APP_KEY }} + + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + token: ${{ steps.app-token.outputs.token }} + ref: ${{ github.head_ref }} + # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config + persist-credentials: false + + - name: Install Task + uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 #v2.0.0 + + - name: Setup Node + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + with: + node-version: "24.x" + + - name: Run Renovate + run: task deps:renovate:sync + env: + ## Discovery + RENOVATE_AUTODISCOVER: "true" + RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}" + ## Project sync + RENOVATE_PLATFORM: "github" + RENOVATE_PLATFORM_COMMIT: "enabled" + RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }} + GITHUB_COM_TOKEN: ${{ steps.app-token.outputs.token }} + # Remove unused fields from PR description + RENOVATE_PR_BODY_TEMPLATE: "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}" + RENOVATE_DEPENDENCY_DASHBOARD_HEADER: "" + RENOVATE_DEPENDENCY_DASHBOARD_O_S_V_VULNERABILITY_SUMMARY: "all" diff --git a/Taskfile.deps.yml b/Taskfile.deps.yml index 602de86..fad0101 100644 --- a/Taskfile.deps.yml +++ b/Taskfile.deps.yml @@ -93,3 +93,31 @@ tasks: - which docker cmds: - docker image pull ghcr.io/agntcy/dir-ctl:{{ .DIRCTL_IMAGE_TAG }} + + deps:renovate: + desc: Install Renovate + internal: true + cmd: npm install -g renovate@{{ .RENOVATE_VERSION }} + status: + - npm list -g renovate + + deps:renovate:sync: + desc: Sync dependencies with Renovate + summary: | + For extra CLI flags pass RENOVATE_OPTS (e.g. task deps:renovate:sync RENOVATE_OPTS='--dry-run'). + Default platform is local so local runs do not touch remote project data. + Github Action CI sets RENOVATE_PLATFORM to github. + This step is only analytical without GITHUB TOKEN and will not update PRs or project data. + deps: + - deps:renovate + dir: "{{ .ROOT_DIR }}" + vars: + RENOVATE_OPTS_DEFAULT: >- + --persist-repo-data 'true' + --allowed-post-upgrade-commands '[".*"]' + --post-upgrade-tasks '{"commands": ["task helm:gen", "task deps:tidy", "task sdk:tidy"], "executionMode": "branch"}' + RENOVATE_OPTS: "{{ .RENOVATE_OPTS | default .RENOVATE_OPTS_DEFAULT }}" + RENOVATE_PLATFORM_EFFECTIVE: + sh: printf '%s' "${RENOVATE_PLATFORM:-local}" + cmds: + - renovate {{ .RENOVATE_OPTS }} --platform "{{ .RENOVATE_PLATFORM_EFFECTIVE }}" diff --git a/Taskfile.vars.yml b/Taskfile.vars.yml index 3a2ec92..ec061b3 100644 --- a/Taskfile.vars.yml +++ b/Taskfile.vars.yml @@ -6,6 +6,7 @@ version: "3" vars: DIR_CHART_VERSION: '{{ .DIR_CHART_VERSION | default "0.0.0-latest" }}' DIRCTL_IMAGE_TAG: '{{ .DIRCTL_IMAGE_TAG | default "latest" }}' + RENOVATE_VERSION: "43.89.5" BIN_DIR: "{{ .ROOT_DIR }}/.bin" HELM_VERSION: "4.1.3" HELM_BIN: "{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}" diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..5e3bde2 --- /dev/null +++ b/renovate.json @@ -0,0 +1,114 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended", + "helpers:pinGitHubActionDigestsToSemver", + ":semanticCommitTypeAll(chore)", + ":dependencyDashboard" + ], + "configMigration": true, + "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"], + "matchStrings": [ + "(?m)^\\s*#\\s*renovate:\\s*datasource=(?\\S+)\\s+depName=(?\\S+)(?:\\s+versioning=(?\\S+))?(?:\\s+registryUrl=(?\\S+))?\\s*\\r?\\n\\s*(?[A-Z0-9_]+)_VERSION:\\s+\"?(?[^\"@\\s]+)\"?\\s*$" + ], + "currentValueTemplate": "{{currentValue}}", + "description": [ + "Custom dependency manager for updating tool version defined in Taskfile." + ] + }, + { + "customType": "regex", + "managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"], + "matchStrings": [ + "(?m)^\\s*#\\s*renovate:\\s*datasource=(?\\S+)\\s+depName=(?\\S+)(?:\\s+versioning=(?\\S+))?(?:\\s+registryUrl=(?\\S+))?\\s*\\r?\\n\\s*(?[A-Z0-9_]+)_VERSION:\\s+\"?(?:(?[^@\"\\s]+)@)?(?sha256:[a-f0-9]+)\"?\\s*$" + ], + "currentValueTemplate": "{{currentValue}}", + "description": [ + "Custom dependency manager for updating image tag@digest defined in Taskfile." + ] + } + ], + "dependencyDashboardAutoclose": true, + "dependencyDashboardLabels": ["dependencies"], + "dependencyDashboardOSVVulnerabilitySummary": "all", + "enabled": true, + "minimumReleaseAge": "3 days", + "schedule": ["before 6am on Monday"], + "enabledManagers": [ + "custom.regex", + "github-actions", + "pyenv", + "pip_setup", + "pip_requirements", + "pep621" + ], + "labels": ["dependencies"], + "ignoreDeps": [], + "osvVulnerabilityAlerts": true, + "lockFileMaintenance": { + "enabled": true + }, + "packageRules": [ + { + "matchUpdateTypes": ["major"], + "enabled": false, + "description": ["Ignore major dependency updates."] + }, + { + "groupName": "Python", + "groupSlug": "python", + "matchCategories": ["python"], + "addLabels": ["python"], + "description": [ + "Add python label to PRs which bumps python dependencies.", + "Group Python dependency updates in single PR." + ] + }, + { + "groupName": "Taskfile", + "groupSlug": "taskfile", + "matchFileNames": ["Taskfile.*"], + "addLabels": ["build"], + "description": [ + "Add build label to PRs which are related to build tools defined in Taskfile.", + "Group Taskfile dependency updates in single PR." + ] + }, + { + "groupName": "Github Actions", + "groupSlug": "github-actions", + "matchDatasources": ["github-tags"], + "addLabels": ["ci"], + "description": [ + "Add ci label to PRs which are related to Github Actions.", + "Group CI dependency updates in single PR." + ] + }, + { + "matchJsonata": [ + "$exists(vulnerabilityFixVersion) or isVulnerabilityAlert = true" + ], + "enabled": true, + "description": [ + "Always allow vulnerability/security fixes, even when other rules disable majors or specific dependencies." + ] + } + ], + "postUpdateOptions": [], + "prConcurrentLimit": 20, + "prHourlyLimit": 10, + "printConfig": false, + "rebaseWhen": "behind-base-branch", + "reviewersFromCodeOwners": true, + "semanticCommits": "enabled", + "timezone": "Etc/UTC", + "vulnerabilityAlerts": { + "enabled": true, + "labels": ["security"], + "minimumReleaseAge": null, + "schedule": ["at any time"] + } +}