Renovate (tuppr) #10119
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| name: Renovate | |
| run-name: Renovate (${{ (inputs.autodiscoverFilter == '*' && 'all repos') || inputs.autodiscoverFilter || 'all repos' }}) | |
| on: | |
| schedule: | |
| - cron: "20 * * * *" | |
| workflow_dispatch: | |
| inputs: | |
| dryRun: | |
| description: Dry Run | |
| default: false | |
| required: false | |
| type: boolean | |
| autodiscoverFilter: | |
| description: Autodiscover Filter | |
| default: "*" | |
| required: false | |
| logLevel: | |
| description: Log Level | |
| type: choice | |
| default: debug | |
| options: | |
| - debug | |
| - info | |
| repoCache: | |
| description: Repository cache | |
| type: choice | |
| default: enabled | |
| options: | |
| - enabled | |
| - disabled | |
| - reset | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: renovate | |
| cancel-in-progress: false | |
| jobs: | |
| renovate: | |
| name: Renovate | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Generate Token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: app-token | |
| with: | |
| client-id: ${{ secrets.BOT_CLIENT_ID }} | |
| private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| permission-checks: write | |
| permission-contents: write | |
| permission-issues: write | |
| permission-members: read | |
| permission-pull-requests: write | |
| permission-statuses: write | |
| permission-vulnerability-alerts: read | |
| permission-workflows: write | |
| - name: Restore Renovate repository cache | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /tmp/renovate/cache/renovate/repository | |
| key: renovate-repository-cache-${{ github.run_id }}-${{ github.run_attempt }} | |
| restore-keys: renovate-repository-cache- | |
| - name: Align cache ownership for the Renovate container | |
| run: | | |
| sudo mkdir -p /tmp/renovate/cache/renovate/repository | |
| # Renovate runs in its container as uid 12021; give it ownership so it | |
| # can read and rewrite the restored cache. | |
| sudo chown -R 12021:0 /tmp/renovate | |
| - name: Renovate | |
| uses: renovatebot/github-action@973d3e5a68e735a444e8c03432b66eedb343c302 # v46.2.0 | |
| env: | |
| LOG_LEVEL: ${{ inputs.logLevel || 'debug' }} | |
| RENOVATE_DRY_RUN: ${{ inputs.dryRun == true }} | |
| RENOVATE_AUTODISCOVER: true | |
| RENOVATE_AUTODISCOVER_FILTER: ${{ github.repository_owner }}/${{ inputs.autodiscoverFilter || '*' }} | |
| RENOVATE_INTERNAL_CHECKS_FILTER: strict | |
| RENOVATE_PLATFORM: github | |
| RENOVATE_PLATFORM_COMMIT: true | |
| RENOVATE_CUSTOM_ENV_VARIABLES: '{"MISE_TRUSTED_CONFIG_PATHS":"/tmp/renovate/repos"}' | |
| RENOVATE_ALLOWED_UNSAFE_EXECUTIONS: '["goGenerate", "mise"]' | |
| RENOVATE_ALLOWED_COMMANDS: '["^helm-docs ", "^helm-schema ", "^npm "]' | |
| RENOVATE_REPOSITORY_CACHE: ${{ inputs.repoCache || 'enabled' }} | |
| RENOVATE_PRESET_CACHE_PERSISTENCE: "true" | |
| with: | |
| docker-cmd-file: .github/renovate-entrypoint.sh | |
| docker-user: root | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Save Renovate repository cache | |
| if: always() | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /tmp/renovate/cache/renovate/repository | |
| key: renovate-repository-cache-${{ github.run_id }}-${{ github.run_attempt }} |