Renovate #1073
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Renovate | |
| # Self-hosted Renovate. Dependency updates land as conventional commits | |
| # (fix(deps)/feat(deps)/feat!), which release-please aggregates into per-chart | |
| # release PRs that own the version bump + CHANGELOG. Renovate no longer runs | |
| # postUpgradeTasks, so the Mend hosted app would work too — but keep a single | |
| # instance to avoid duplicate PRs. | |
| on: | |
| # Re-evaluate open PRs after every merge so stale branches get rebased quickly | |
| push: | |
| branches: | |
| - main | |
| # Also run on a schedule to catch new upstream releases | |
| schedule: | |
| - cron: "0 */6 * * *" # every 6 hours | |
| workflow_dispatch: {} | |
| concurrency: | |
| group: renovate | |
| cancel-in-progress: false # let a running job finish; queue the next | |
| jobs: | |
| renovate: | |
| name: renovate | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| - name: Generate GitHub App Token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| client-id: ${{ secrets.SLYBASE_APP_ID }} | |
| private-key: ${{ secrets.SLYBASE_APP_PRIVATE_KEY }} | |
| owner: SlyBase | |
| - name: Self-hosted Renovate | |
| uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| env: | |
| RENOVATE_REPOSITORIES: '["${{ github.repository }}"]' | |
| LOG_LEVEL: "info" | |
| # The App installation token above is scoped to this repo only, so it | |
| # can't look up tags/releases on unrelated public repos (e.g. GitHub | |
| # Actions referenced in workflows, like aquasecurity/trivy-action). | |
| # A separate, read-only token raises the public API rate limit for | |
| # those cross-repo datasource lookups. See: | |
| # https://docs.renovatebot.com/self-hosted-configuration/#githubcomtoken | |
| GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }} |