From 997213f704197c9c525c327e15e9f7e0422961d9 Mon Sep 17 00:00:00 2001 From: James Cameron Date: Thu, 15 Oct 2026 16:02:58 +1000 Subject: [PATCH 1/3] chore: adopt shared Renovate config and workflows --- .github/workflows/renovate-approve.yml | 9 +++++ .../renovate-pull-request-automation.yml | 26 ------------ .github/workflows/renovate.yml | 11 +++++ .github/workflows/update-dependencies.yml | 28 ------------- renovate-config.js | 40 ++----------------- 5 files changed, 24 insertions(+), 90 deletions(-) create mode 100644 .github/workflows/renovate-approve.yml delete mode 100644 .github/workflows/renovate-pull-request-automation.yml create mode 100644 .github/workflows/renovate.yml delete mode 100644 .github/workflows/update-dependencies.yml diff --git a/.github/workflows/renovate-approve.yml b/.github/workflows/renovate-approve.yml new file mode 100644 index 00000000..cd428143 --- /dev/null +++ b/.github/workflows/renovate-approve.yml @@ -0,0 +1,9 @@ +name: Renovate approve +on: + pull_request: + types: [labeled, synchronize] +jobs: + renovate-approve: + uses: OctopusDeploy/team-bmbb-renovate-config/.github/workflows/renovate-approve.yml@main + permissions: + pull-requests: write diff --git a/.github/workflows/renovate-pull-request-automation.yml b/.github/workflows/renovate-pull-request-automation.yml deleted file mode 100644 index 86c33e20..00000000 --- a/.github/workflows/renovate-pull-request-automation.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: Renovate Pull Request Approval - -on: - pull_request: - branches: [main] - -# Increase the access for the GITHUB_TOKEN -permissions: - # This Allows the GITHUB_TOKEN to approve pull requests - pull-requests: write - # This Allows the GITHUB_TOKEN to auto merge pull requests - contents: write - -env: - PR_URL: ${{github.event.pull_request.html_url}} - # By default, GitHub Actions workflows triggered by renovate get a GITHUB_TOKEN with read-only permissions. - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} - -jobs: - approve_renovate_pull_requests: - runs-on: ubuntu-latest - name: Approve renovate pull request - if: ${{ (github.actor == 'Octobob') && (contains(github.head_ref, 'renovate')) }} - steps: - - name: Approve a renovate created PR - run: gh pr review --approve "$PR_URL" diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 00000000..d26f2552 --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,11 @@ +name: Renovate +on: + schedule: + - cron: "0 0 * * *" + timezone: Australia/Brisbane + workflow_dispatch: +jobs: + renovate: + uses: OctopusDeploy/team-bmbb-renovate-config/.github/workflows/renovate.yml@main + secrets: + RENOVATE_GITHUB_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }} diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml deleted file mode 100644 index c6db7a53..00000000 --- a/.github/workflows/update-dependencies.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: Renovate -on: - schedule: - - cron: "0 0 * * *" - - workflow_dispatch: - inputs: - dryRun: - type: boolean - required: false - default: false - description: Dry run (don't create PRs) - -jobs: - renovate: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - - - name: Self-hosted Renovate - uses: renovatebot/github-action@f9c81dddc9b589e4e6ae0326d1e36f6bc415d230 # v39.2.4 - with: - configurationFile: renovate-config.js - token: ${{ secrets.RENOVATE_GITHUB_TOKEN }} - env: - LOG_LEVEL: debug - RENOVATE_DRY_RUN: ${{ inputs.dryRun && 'full' || null }} diff --git a/renovate-config.js b/renovate-config.js index 49cbfbaa..cc64eb09 100644 --- a/renovate-config.js +++ b/renovate-config.js @@ -1,39 +1,7 @@ module.exports = { - extends: [ - "config:base", - ":disableMajorUpdates", - ":ignoreModulesAndTests", - ":pinVersions", - ":rebaseStalePrs", - // Automatic merging is temporarily disabled. - // ":automergeDigest", - // ":automergePatch", - ":automergePr", - ":automergeRequireAllStatusChecks", - // ":automergeLinters", - // ":automergeTesters", - // ":automergeTypes", - "packages:eslint", - "workarounds:typesNodeVersioning", - "github>whitesource/merge-confidence:beta", - ], - branchPrefix: "renovate/", - platform: "github", - repositories: ["OctopusDeploy/login"], - packageRules: [ - { - matchDatasources: ['npm'], - minimumReleaseAge: '2 days' - } - ], - timezone: "Australia/Brisbane", - onboarding: false, - requireConfig: false, - allowedPostUpgradeCommands: [".*"], + extends: ["github>OctopusDeploy/team-bmbb-renovate-config:github-action.json5"], + + // The github-action preset rebuilds dist/ after each update, but presets can't allow commands, so allow it here. allowShellExecutorForPostUpgradeCommands: true, - postUpgradeTasks: { - commands: ["npm install && npm run build"], - fileFilters: ["**/index.js"], - executionMode: "update", - }, + allowedCommands: ["^npm ci --ignore-scripts && npm run build$"], }; From 9c2838a737eaa00c7fb16250f672411ad88dea25 Mon Sep 17 00:00:00 2001 From: James Cameron Date: Thu, 15 Oct 2026 16:08:26 +1000 Subject: [PATCH 2/3] chore: limit Renovate workflow token permissions --- .github/workflows/renovate.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index d26f2552..4853f956 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -7,5 +7,7 @@ on: jobs: renovate: uses: OctopusDeploy/team-bmbb-renovate-config/.github/workflows/renovate.yml@main + permissions: + contents: read secrets: RENOVATE_GITHUB_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }} From 7c7c4347ada1c096502e7bc0297a07fbd4372b92 Mon Sep 17 00:00:00 2001 From: James Cameron Date: Tue, 20 Oct 2026 12:44:45 +1000 Subject: [PATCH 3/3] chore: standardise Renovate triggers and schedule --- .github/workflows/renovate-approve.yml | 2 +- .github/workflows/renovate.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/renovate-approve.yml b/.github/workflows/renovate-approve.yml index cd428143..fbc4b21a 100644 --- a/.github/workflows/renovate-approve.yml +++ b/.github/workflows/renovate-approve.yml @@ -1,7 +1,7 @@ name: Renovate approve on: pull_request: - types: [labeled, synchronize] + types: [synchronize, auto_merge_enabled] jobs: renovate-approve: uses: OctopusDeploy/team-bmbb-renovate-config/.github/workflows/renovate-approve.yml@main diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 4853f956..63f77e91 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -1,7 +1,7 @@ name: Renovate on: schedule: - - cron: "0 0 * * *" + - cron: "0 3 * * *" timezone: Australia/Brisbane workflow_dispatch: jobs: