feat(dir-sdk-python): migrate Renovate

.github/workflows/dependencies.yaml

@@ -0,0 +1,50 @@
+name: Dependencies
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 */6 * * *"
+
+jobs:
+  renovate:
+    name: Renovate Sync
+    runs-on: ubuntu-latest
+    steps:
+      - name: Authenticate with GitHub App Bot
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.PROJECT_APP_ID }}
+          private-key: ${{ secrets.PROJECT_APP_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          ref: ${{ github.head_ref }}
+          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
+          persist-credentials: false
+
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 #v2.0.0
+
+      - name: Setup Node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: "24.x"
+
+      - name: Run Renovate
+        run: task deps:renovate:sync
+        env:
+          ## Discovery
+          RENOVATE_AUTODISCOVER: "true"
+          RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
+          ## Project sync
+          RENOVATE_PLATFORM: "github"
+          RENOVATE_PLATFORM_COMMIT: "enabled"
+          RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
+          GITHUB_COM_TOKEN: ${{ steps.app-token.outputs.token }}
+          # Remove unused fields from PR description
+          RENOVATE_PR_BODY_TEMPLATE: "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}"
+          RENOVATE_DEPENDENCY_DASHBOARD_HEADER: ""
+          RENOVATE_DEPENDENCY_DASHBOARD_O_S_V_VULNERABILITY_SUMMARY: "all"

Taskfile.deps.yml

@@ -93,3 +93,31 @@ tasks:
       - which docker
     cmds:
       - docker image pull ghcr.io/agntcy/dir-ctl:{{ .DIRCTL_IMAGE_TAG }}
+
+  deps:renovate:
+    desc: Install Renovate
+    internal: true
+    cmd: npm install -g renovate@{{ .RENOVATE_VERSION }}
+    status:
+      - npm list -g renovate
+
+  deps:renovate:sync:
+    desc: Sync dependencies with Renovate
+    summary: |
+      For extra CLI flags pass RENOVATE_OPTS (e.g. task deps:renovate:sync RENOVATE_OPTS='--dry-run').
+      Default platform is local so local runs do not touch remote project data.
+      Github Action CI sets RENOVATE_PLATFORM to github.
+      This step is only analytical without GITHUB TOKEN and will not update PRs or project data.
+    deps:
+      - deps:renovate
+    dir: "{{ .ROOT_DIR }}"
+    vars:
+      RENOVATE_OPTS_DEFAULT: >-
+        --persist-repo-data 'true'
+        --allowed-post-upgrade-commands '[".*"]'
+        --post-upgrade-tasks '{"commands": ["task helm:gen", "task deps:tidy", "task sdk:tidy"], "executionMode": "branch"}'
+      RENOVATE_OPTS: "{{ .RENOVATE_OPTS | default .RENOVATE_OPTS_DEFAULT }}"
+      RENOVATE_PLATFORM_EFFECTIVE:
+        sh: printf '%s' "${RENOVATE_PLATFORM:-local}"
+    cmds:
+      - renovate {{ .RENOVATE_OPTS }} --platform "{{ .RENOVATE_PLATFORM_EFFECTIVE }}"

Taskfile.vars.yml

@@ -6,6 +6,7 @@ version: "3"
 vars:
   DIR_CHART_VERSION: '{{ .DIR_CHART_VERSION | default "0.0.0-latest" }}'
   DIRCTL_IMAGE_TAG: '{{ .DIRCTL_IMAGE_TAG | default "latest" }}'
+  RENOVATE_VERSION: "43.89.5"
   BIN_DIR: "{{ .ROOT_DIR }}/.bin"
   HELM_VERSION: "4.1.3"
   HELM_BIN: "{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}"

renovate.json

@@ -0,0 +1,114 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigestsToSemver",
+    ":semanticCommitTypeAll(chore)",
+    ":dependencyDashboard"
+  ],
+  "configMigration": true,
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"],
+      "matchStrings": [
+        "(?m)^\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\r?\\n\\s*(?<varName>[A-Z0-9_]+)_VERSION:\\s+\"?(?<currentValue>[^\"@\\s]+)\"?\\s*$"
+      ],
+      "currentValueTemplate": "{{currentValue}}",
+      "description": [
+        "Custom dependency manager for updating tool version defined in Taskfile."
+      ]
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)Taskfile[^/]*\\.yml$/"],
+      "matchStrings": [
+        "(?m)^\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\r?\\n\\s*(?<varName>[A-Z0-9_]+)_VERSION:\\s+\"?(?:(?<currentValue>[^@\"\\s]+)@)?(?<currentDigest>sha256:[a-f0-9]+)\"?\\s*$"
+      ],
+      "currentValueTemplate": "{{currentValue}}",
+      "description": [
+        "Custom dependency manager for updating image tag@digest defined in Taskfile."
+      ]
+    }
+  ],
+  "dependencyDashboardAutoclose": true,
+  "dependencyDashboardLabels": ["dependencies"],
+  "dependencyDashboardOSVVulnerabilitySummary": "all",
+  "enabled": true,
+  "minimumReleaseAge": "3 days",
+  "schedule": ["before 6am on Monday"],
+  "enabledManagers": [
+    "custom.regex",
+    "github-actions",
+    "pyenv",
+    "pip_setup",
+    "pip_requirements",
+    "pep621"
+  ],
+  "labels": ["dependencies"],
+  "ignoreDeps": [],
+  "osvVulnerabilityAlerts": true,
+  "lockFileMaintenance": {
+    "enabled": true
+  },
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["major"],
+      "enabled": false,
+      "description": ["Ignore major dependency updates."]
+    },
+    {
+      "groupName": "Python",
+      "groupSlug": "python",
+      "matchCategories": ["python"],
+      "addLabels": ["python"],
+      "description": [
+        "Add python label to PRs which bumps python dependencies.",
+        "Group Python dependency updates in single PR."
+      ]
+    },
+    {
+      "groupName": "Taskfile",
+      "groupSlug": "taskfile",
+      "matchFileNames": ["Taskfile.*"],
+      "addLabels": ["build"],
+      "description": [
+        "Add build label to PRs which are related to build tools defined in Taskfile.",
+        "Group Taskfile dependency updates in single PR."
+      ]
+    },
+    {
+      "groupName": "Github Actions",
+      "groupSlug": "github-actions",
+      "matchDatasources": ["github-tags"],
+      "addLabels": ["ci"],
+      "description": [
+        "Add ci label to PRs which are related to Github Actions.",
+        "Group CI dependency updates in single PR."
+      ]
+    },
+    {
+      "matchJsonata": [
+        "$exists(vulnerabilityFixVersion) or isVulnerabilityAlert = true"
+      ],
+      "enabled": true,
+      "description": [
+        "Always allow vulnerability/security fixes, even when other rules disable majors or specific dependencies."
+      ]
+    }
+  ],
+  "postUpdateOptions": [],
+  "prConcurrentLimit": 20,
+  "prHourlyLimit": 10,
+  "printConfig": false,
+  "rebaseWhen": "behind-base-branch",
+  "reviewersFromCodeOwners": true,
+  "semanticCommits": "enabled",
+  "timezone": "Etc/UTC",
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security"],
+    "minimumReleaseAge": null,
+    "schedule": ["at any time"]
+  }
+}