jklein
d3e6b9250f
Validate Helm Charts / Detect changed charts (pull_request) Successful in 2s
Validate Helm Charts / Resource quantities (pull_request) Successful in 7s
Validate Helm Charts / Build ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} (pull_request) Successful in 4s
Validate Helm Charts / Trivy config ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }} (pull_request) Successful in 10s
Validate Helm Charts / Install-test ${{ fromJSON(needs.detect-changed-charts.outputs.install-charts) }} (pull_request) Failing after 15s
109 lines
5.5 KiB
YAML
109 lines
5.5 KiB
YAML
# Renovate, self-hosted (issue #225).
|
|
#
|
|
# On github.com Renovate arrived as the `jlab-renovate` GitHub App and this
|
|
# repo only ever carried renovate.json5. Gitea has no app model and no hosted
|
|
# Renovate, so after the move the bot has to be *run* by this repo: a scheduled
|
|
# job with its own token. That is the only change to how dependencies are
|
|
# updated - renovate.json5 stays the single source of what gets updated, and
|
|
# everything in it works unchanged on the Gitea platform.
|
|
#
|
|
# What the maintainer has to create once on the instance (the token this
|
|
# workflow cannot create for itself):
|
|
#
|
|
# RENOVATE_TOKEN Gitea access token of the bot account, scopes
|
|
# read:user, write:issue, write:repository. Renovate opens
|
|
# the PRs and the dependency dashboard issue with it, so
|
|
# the PRs will be authored by whoever owns the token.
|
|
# GITHUB_COM_TOKEN Read-only github.com PAT (public_repo / no scopes at all
|
|
# is enough). NOT optional here: every `github-releases` and
|
|
# `github-tags` lookup in renovate.json5 - and the whole
|
|
# built-in github-actions manager, which resolves
|
|
# actions/checkout and friends on github.com - hits
|
|
# github.com's unauthenticated rate limit within one run
|
|
# otherwise. On the App this came for free; here it does not.
|
|
# README already names this for the `no-result` symptom.
|
|
#
|
|
# There is deliberately no `allowedCommands` to set up by hand any more: the
|
|
# postUpgradeTasks hook renovate.json5 needs (ci/renovate-bump-chart.sh, which
|
|
# recomputes `version:` after an appVersion change) is allow-listed by the
|
|
# RENOVATE_ALLOWED_COMMANDS env below, because this workflow *is* the instance
|
|
# config now. Without it Renovate skips the task silently and every chart PR
|
|
# stays red on the version-bump check - see README, "The version-bump hook".
|
|
name: Renovate
|
|
|
|
on:
|
|
schedule:
|
|
# 03:40 UTC, once a day. Renovate's own `timezone` in renovate.json5
|
|
# (Europe/Berlin) governs the PR schedules; this cron is plain UTC.
|
|
- cron: "40 3 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
dryRun:
|
|
description: "Dry run: 'full' looks up and renders everything but writes nothing"
|
|
type: choice
|
|
default: "full"
|
|
options: ["full", "lookup", "extract", "disabled"]
|
|
logLevel:
|
|
description: "Renovate log level"
|
|
type: choice
|
|
default: "info"
|
|
options: ["info", "debug"]
|
|
|
|
jobs:
|
|
renovate:
|
|
name: Renovate
|
|
# The guard that keeps this workflow inert on github.com. The file reaches
|
|
# GitHub as well (that is where the migration PR is merged), and a
|
|
# scheduled run there would authenticate a *Gitea* token against a Gitea
|
|
# endpoint from a runner that has neither - failing nightly for a reason
|
|
# nobody is watching for. GITHUB_SERVER_URL is the one context value that
|
|
# differs between the two platforms without naming our instance: Gitea
|
|
# sets it to its own base URL. Delete this line once github.com is a
|
|
# push mirror without Actions.
|
|
if: github.server_url != 'https://github.com'
|
|
# No Docker socket needed: the Gitea runner starts every job in a container
|
|
# itself, and `container:` is the runner's job to create, not the job's.
|
|
# Measured on the probe PR of #225 - the same distinction that puts
|
|
# install-test on ubuntu-docker leaves this job on ubuntu-latest.
|
|
runs-on: ubuntu-latest
|
|
# The official image rather than `npx renovate`: it ships the git, node and
|
|
# package-manager versions Renovate expects, and pulling ~200 MB from npm
|
|
# on every scheduled run is the alternative. Renovate's built-in
|
|
# github-actions manager keeps this tag current (proved by dry run, see the
|
|
# migration PR) - it reads `container:` images, not only `uses:`.
|
|
container: ghcr.io/renovatebot/renovate:44.87.1
|
|
steps:
|
|
- name: "Checkout Repository"
|
|
uses: actions/checkout@v7
|
|
|
|
- name: "Run Renovate"
|
|
env:
|
|
# Platform. The endpoint is derived from the run itself so the
|
|
# instance address stays out of this repository, the same rule the
|
|
# publish workflow follows for the registry URL.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
|
|
|
# Exactly this repository. Autodiscovery would enrol every repo the
|
|
# token can see, and the token is an account token, not an app
|
|
# installation scoped to one repo.
|
|
RENOVATE_AUTODISCOVER: "false"
|
|
RENOVATE_REPOSITORIES: ${{ github.repository }}
|
|
|
|
# Who the commits are by. The e-mail must not be a real address of a
|
|
# person - Gitea attributes a commit to the account whose verified
|
|
# address matches, and these commits are the bot's.
|
|
RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.invalid>"
|
|
|
|
# The instance-level half of renovate.json5's postUpgradeTasks. A
|
|
# command not listed here is skipped WITHOUT an error message.
|
|
RENOVATE_ALLOWED_COMMANDS: '["^ci/renovate-bump-chart\\.sh"]'
|
|
|
|
# Manual runs default to a dry run; the schedule is the only thing
|
|
# that writes on its own.
|
|
RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dryRun || 'null' }}
|
|
LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.logLevel || 'info' }}
|
|
run: renovate
|