Skip to content

Commit 4e95e08

Browse files
alexbass01alexbass01
authored
chore: Add renovate checks to this repo (#108)
<!-- markdownlint-disable MD041 --> #### What this PR does / why we need it - Adds a nightly sweep to this repo - Adds renovate config for this repo - Renames central renovate config. #### Which issue(s) this PR is related to <!-- Usage: `Related to #<issue number>`, or `Related to (paste link of issue)`. --> --------- Signed-off-by: Alexander Bassmanow (AlexBass01) <alexander.bassmanow@sap.com>
1 parent 41c2401 commit 4e95e08

6 files changed

Lines changed: 86 additions & 34 deletions

File tree

‎.github/renovate-central.json5‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Central renovate configuration for runs orchestrated by
2+
// .github/workflows/renovate-schedule.yml. This file is the global config for
3+
// every target repository listed in .github/renovate-repositories.json;
4+
// repository-local configs (renovate.json[5], .github/renovate.json[5], ...)
5+
// still apply per repository on top.
6+
{
7+
$schema: 'https://docs.renovatebot.com/renovate-schema.json',
8+
// Commit author: intentionally NOT set via gitAuthor. The workflows run
9+
// with platformCommit enabled and GitHub App tokens, so GitHub itself sets
10+
// the commit author and renovate auto-discovers its own identity from
11+
// whichever App's token the run uses — regardless of whether the run comes
12+
// from the central sweeper or a repository-local workflow.
13+
//
14+
// gitIgnoredAuthors: commits with these author emails count as renovate's
15+
// own when checking whether a branch was edited externally (otherwise the
16+
// branch is skipped as "pr-edited"). List every GitHub App that may run
17+
// renovate against the swept repositories, so branches written by one App's
18+
// runs are accepted by another App's runs (e.g. central sweeper vs.
19+
// repo-local runs with different credentials). A repository-level
20+
// gitIgnoredAuthors REPLACES this list (non-mergeable) — repeat entries you
21+
// still need. Keep the list tight: noreply author emails are spoofable.
22+
// Derive an email: curl -s https://api.github.com/users/odgbot%5Bbot%5D | grep '"id"' -> <id>+<slug>[bot]@users.noreply.github.com
23+
gitIgnoredAuthors: [
24+
// (bare email only: renovate compares gitIgnoredAuthors against %ae/%ce
25+
// author/committer emails, never against 'Name <email>')
26+
// odgbot - production central sweeper for ODG (https://github.com/apps/odgbot)
27+
'319464553+odgbot[bot]@users.noreply.github.com',
28+
// ocmbot - will be used later again when we expand beyond ODG
29+
'125909804+ocmbot[bot]@users.noreply.github.com',
30+
],
31+
// Add org-wide defaults here, e.g.:
32+
// labels: ['dependencies'],
33+
// timezone: 'Europe/Berlin',
34+
// schedule: ['at any time'],
35+
}

‎.github/renovate-repositories.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
[
2-
"open-component-model/odg-ui"
2+
"open-component-model/.github"
33
]

‎.github/renovate.json5‎

Lines changed: 46 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,50 @@
1-
// Central renovate configuration for runs orchestrated by
2-
// .github/workflows/renovate-schedule.yml. This file is the global config for
3-
// every target repository listed in .github/renovate-repositories.json;
4-
// repository-local configs (renovate.json[5], .github/renovate.json[5], ...)
5-
// still apply per repository on top.
61
{
72
$schema: 'https://docs.renovatebot.com/renovate-schema.json',
8-
// Commit author: intentionally NOT set via gitAuthor. The workflows run
9-
// with platformCommit enabled and GitHub App tokens, so GitHub itself sets
10-
// the commit author and renovate auto-discovers its own identity from
11-
// whichever App's token the run uses — regardless of whether the run comes
12-
// from the central sweeper or a repository-local workflow.
13-
//
14-
// gitIgnoredAuthors: commits with these author emails count as renovate's
15-
// own when checking whether a branch was edited externally (otherwise the
16-
// branch is skipped as "pr-edited"). List every GitHub App that may run
17-
// renovate against the swept repositories, so branches written by one App's
18-
// runs are accepted by another App's runs (e.g. central sweeper vs.
19-
// repo-local runs with different credentials). A repository-level
20-
// gitIgnoredAuthors REPLACES this list (non-mergeable) — repeat entries you
21-
// still need. Keep the list tight: noreply author emails are spoofable.
22-
// Derive an email: curl -s https://api.github.com/users/odgbot%5Bbot%5D | grep '"id"' -> <id>+<slug>[bot]@users.noreply.github.com
23-
gitIgnoredAuthors: [
24-
// (bare email only: renovate compares gitIgnoredAuthors against %ae/%ce
25-
// author/committer emails, never against 'Name <email>')
26-
// odgbot - production central sweeper for ODG (https://github.com/apps/odgbot)
27-
'319464553+odgbot[bot]@users.noreply.github.com',
28-
// ocmbot - will be used later again when we expand beyond ODG
29-
'125909804+ocmbot[bot]@users.noreply.github.com',
3+
extends: [
4+
'config:recommended',
5+
'config:best-practices',
6+
'helpers:pinGitHubActionDigests',
7+
'docker:pinDigests',
8+
'security:openssf-scorecard',
9+
':dependencyDashboard',
10+
':rebaseStalePrs',
11+
],
12+
'internalChecksFilter': 'strict',
13+
'minimumReleaseAge': '7 days',
14+
'branchPrefix': 'renovate/',
15+
prConcurrentLimit: 5,
16+
prHourlyLimit: 0,
17+
automerge: false,
18+
automergeType: 'pr',
19+
vulnerabilityAlerts: {
20+
minimumReleaseAge: null,
21+
automerge: false,
22+
},
23+
packageRules: [
24+
{
25+
// Majors wait as checkboxes in the dependency dashboard ("Pending
26+
// Approval") instead of occupying prConcurrentLimit slots - tick one
27+
// there to have its PR created when you're ready to work on it.
28+
matchUpdateTypes: ['major'],
29+
dependencyDashboardApproval: true,
30+
},
31+
{
32+
matchUpdateTypes: ['patch'],
33+
automerge: true,
34+
},
35+
{
36+
matchManagers: ['github-actions'],
37+
automerge: true,
38+
},
39+
],
40+
customManagers: [
41+
{
42+
// Track the Renovate version used in the reusable workflow
43+
customType: 'regex',
44+
managerFilePatterns: ['.github/workflows/renovate.yml'],
45+
matchStrings: ["renovate-version:\\s*'(?<currentValue>[^'@]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?'"],
46+
depNameTemplate: 'ghcr.io/renovatebot/renovate',
47+
datasourceTemplate: 'docker',
48+
},
3049
],
31-
// Add org-wide defaults here, e.g.:
32-
// labels: ['dependencies'],
33-
// timezone: 'Europe/Berlin',
34-
// schedule: ['at any time'],
3550
}

‎.github/workflows/release-please.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ on:
2121
paths:
2222
- '.github/workflows/renovate.yml'
2323
- '.github/workflows/renovate-schedule.yml'
24+
- '.github/renovate-central.json5'
2425
- '.github/renovate.json5'
2526
- '.github/renovate-repositories.json'
2627
- '.release-please-manifest.json'

‎.github/workflows/renovate-schedule.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ on:
4848
branches:
4949
- main
5050
paths:
51+
- .github/renovate-central.json5
5152
- .github/renovate.json5
5253
- .github/renovate-repositories.json
5354
- .github/workflows/renovate.yml

‎.github/workflows/renovate.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,8 @@ env:
8888
# Path of the central config inside the central repository (checked out
8989
# sparse into ./central below; RENOVATE_CONFIG_FILE points there for both
9090
# validation and the renovate run itself).
91-
central_config_file: .github/renovate.json5
92-
RENOVATE_CONFIG_FILE: ${{ github.workspace }}/central/.github/renovate.json5
91+
central_config_file: .github/renovate-central.json5
92+
RENOVATE_CONFIG_FILE: ${{ github.workspace }}/central/.github/renovate-central.json5
9393
# Central config location ("owner/repo@ref"), split into CENTRAL_REPO /
9494
# CENTRAL_REF per job by the "Resolve central config location" step below —
9595
# expression contexts cannot split strings. The default tracks the floating

0 commit comments

Comments
 (0)