feat(ci): add Renovate for gap-filling beyond Dependabot - #777
Draft
ajalon1 wants to merge 4 commits into
Draft
Conversation
Add Renovate configuration to handle version pins that Dependabot cannot see: the Go toolchain directive in go.mod and tool versions pinned in Taskfile.yaml (golangci-lint, lefthook, goreleaser, jscpd). Renovate runs via the Mend Renovate GitHub App (free, zero CI). Only custom.regex manager is enabled to avoid duplicate PRs with Dependabot, which continues handling gomod dependencies and github-actions refs. Taskfile tool versions are grouped into a single PR; Go toolchain updates get their own PR. Refs: CFX-7610 See: https://datarobot.atlassian.net/wiki/spaces/CFX/pages/7950729316 Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Add a scheduled Harness CI pipeline that runs the Renovate Docker image daily to create PRs for the version pins configured in renovate.json (Go toolchain directive, Taskfile tool versions). This complements Dependabot, which cannot see those non-manifest pins. The pipeline uses the renovate/renovate:latest image with a GitHub token secret for PR creation. Renovate's built-in managers remain disabled in renovate.json so there is no overlap with Dependabot's gomod and github-actions coverage. Prerequisites: - RENOVATE_GITHUB_TOKEN Harness secret (GitHub PAT with repo scope) - DOCKER_HUB_CONNECTOR Harness Docker connector Refs: CFX-7610 See: https://datarobot.atlassian.net/wiki/spaces/CFX/pages/7950729316 Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
…instead The Harness pipeline was added contrary to the approved spec, which called for the Mend Renovate GitHub App (free, zero CI). The app is already installed on the repo and auto-discovers renovate.json on main. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Run Renovate via the official Docker image on a daily schedule (and manual trigger) instead of the Mend hosted GitHub App. This avoids the need for a Mend account and keeps all automation within GitHub Actions, which is free for public repos. The workflow uses the built-in GITHUB_TOKEN with contents:write and pull-requests:write permissions. PRs created by GITHUB_TOKEN will not trigger downstream CI workflows — switch to a PAT if that is needed later. renovate.json is runner-agnostic and needs no changes. Refs: CFX-7610 Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RATIONALE
Dependabot handles
gomoddependencies andgithub-actionsrefs, but cannot see version pins embedded in non-manifest files — specifically thegodirective ingo.modand tool versions inTaskfile.yaml. Renovate'scustom.regexmanager fills this gap.Decision context: Renovate vs. Dependabot: Choosing a Dependency Update Tool
Jira: CFX-7610
CHANGES
renovate.jsonat repo root — runner-agnostic per-repo config.github/workflows/renovate.yaml— self-hosted Renovate via GitHub Actionsrenovate.json
custom.regexmanager (all built-in managers disabled to avoid duplicate PRs with Dependabot)godirective ingo.mod(datasource:golang-version)GOLANGCI_LINT_VERSIONinTaskfile.yaml(datasource:github-releases)LEFTHOOK_VERSIONinTaskfile.yaml(datasource:github-releases)GORELEASER_VERSIONinTaskfile.yaml(datasource:github-releases)JSCPD_VERSIONinTaskfile.yaml(datasource:github-releases)dependencies,renovaterenovate.yaml workflow
workflow_dispatchtriggerrenovate/renovateDocker image (no third-party action)GITHUB_TOKENwithcontents:writeandpull-requests:writeNOTES
GITHUB_TOKENdo not trigger downstream CI workflows. Switch to a PAT or GitHub App token if CI on Renovate PRs is needed.RELATED