.github/workflows/renovate.yml
1
---
2
name: renovate
4
on:
5
schedule:
6
- cron: "18 4 * * *"
7
workflow_dispatch:
8
inputs:
9
dryRun:
10
description: Resolve everything and open nothing
11
type: boolean
12
default: false
13
logLevel:
14
description: Log level
15
type: choice
16
default: info
17
options: [info, debug]
18
push:
19
branches: [main]
20
paths:
21
- .renovaterc.json5
22
- .github/workflows/renovate.yml
24
permissions:
25
contents: read
27
concurrency:
28
group: renovate
29
cancel-in-progress: false
31
jobs:
32
renovate:
33
name: renovate
34
runs-on: ubuntu-24.04
35
timeout-minutes: 30
36
permissions:
37
contents: read
38
env:
39
RENOVATE_BOT_APP_ID: ${{ vars.RENOVATE_BOT_APP_ID }}
40
steps:
41
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
42
with:
43
persist-credentials: false
45
- name: report that renovate is not configured
46
if: env.RENOVATE_BOT_APP_ID == ''
47
run: |
48
echo "::notice::renovate is inert: set the RENOVATE_BOT_APP_ID variable and the"\
49
"RENOVATE_BOT_PRIVATE_KEY secret to a GitHub App installed on this repository."\
50
"See docs/development.md."
52
- name: generate a token for the renovate app
53
id: app-token
54
if: env.RENOVATE_BOT_APP_ID != ''
55
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
56
with:
57
app-id: ${{ vars.RENOVATE_BOT_APP_ID }}
58
private-key: ${{ secrets.RENOVATE_BOT_PRIVATE_KEY }}
59
owner: ${{ github.repository_owner }}
60
repositories: ${{ github.event.repository.name }}
61
permission-checks: write
62
permission-contents: write
63
permission-issues: write
64
permission-pull-requests: write
65
permission-statuses: write
66
permission-vulnerability-alerts: read
67
permission-workflows: write
69
- name: restore the renovate repository cache
70
if: env.RENOVATE_BOT_APP_ID != ''
71
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
72
with:
73
path: /tmp/renovate/cache/renovate/repository
74
key: renovate-cache-${{ github.run_id }}-${{ github.run_attempt }}
75
restore-keys: renovate-cache-
77
- name: give the renovate container its cache
78
if: env.RENOVATE_BOT_APP_ID != ''
79
run: |
80
set -euo pipefail
81
sudo mkdir -p /tmp/renovate/cache/renovate/repository
82
sudo chown -R 12021:0 /tmp/renovate
84
- name: renovate
85
if: env.RENOVATE_BOT_APP_ID != ''
86
uses: renovatebot/github-action@316d7cd859606d6039a2182b7d69199e9b036835 # v46.2.1
87
env:
88
LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
89
RENOVATE_DRY_RUN: ${{ inputs.dryRun == true && 'full' || 'null' }}
90
RENOVATE_PLATFORM: github
91
RENOVATE_PLATFORM_COMMIT: enabled
92
RENOVATE_REPOSITORIES: ${{ github.repository }}
93
RENOVATE_INTERNAL_CHECKS_FILTER: strict
94
RENOVATE_REPOSITORY_CACHE: enabled
95
RENOVATE_PRESET_CACHE_PERSISTENCE: "true"
96
RENOVATE_ALLOWED_COMMANDS: '["^helm-docs "]'
97
with:
98
docker-cmd-file: .github/renovate-entrypoint.sh
99
docker-user: root
100
token: ${{ steps.app-token.outputs.token }}
102
- name: save the renovate repository cache
103
if: always() && env.RENOVATE_BOT_APP_ID != ''
104
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
105
with:
106
path: /tmp/renovate/cache/renovate/repository
107
key: renovate-cache-${{ github.run_id }}-${{ github.run_attempt }}