Renovate #55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependencies Management Workflow | |
| # | |
| # This workflow automates the dependency management based on self-hosed Renovate | |
| # ensure the project's dependencies remains up-to-date and security fixes are delivered regularly. | |
| # | |
| # Key Features: | |
| # - Automated PR creation into pyproject.toml and uv.lock regeneration | |
| # - Dry-run for debug purposes | |
| # - Dependency dashboard (is available in GitHub issues) maintenance | |
| # | |
| # Process Stages: | |
| # | |
| # 1. Dependencies Management: | |
| # - Runs on a daily schedule. | |
| # - Identifies dependencies that may be updated based on .github/renovate.json5 configuration. | |
| # - Opens corresponding PRs with respect to schedule defined in Renovate config file. | |
| # - Updates Renovate Dependency dashboard that is available in GitHub issues. | |
| # | |
| # Required Secrets: | |
| # - RENOVATE_APP_ID: application ID | |
| # - RENOVATE_APP_PEM: application private key | |
| # | |
| # Example Usage: | |
| # 1. Scheduled Run: | |
| # Automatically runs, daily | |
| # | |
| # 2. Manual Trigger: | |
| # workflow_dispatch: | |
| # inputs: | |
| # dry-run: | |
| # description: "Run Renovate in dry-run mode (no PR)" | |
| # required: false | |
| # default: false | |
| # type: boolean | |
| # | |
| # Note: Renovate maintains and updates Dependency dashboard that is available in GitHub issues. | |
| name: Renovate | |
| on: | |
| schedule: | |
| - cron: "0 2 * * *" | |
| workflow_dispatch: | |
| inputs: | |
| dry-run: | |
| description: "Run Renovate in dry-run mode (no PR)" | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: {} | |
| jobs: | |
| renovate: | |
| permissions: | |
| contents: read | |
| runs-on: ${{ github.repository_owner == 'open-edge-platform' && 'overflow' || 'ubuntu-latest' }} | |
| steps: | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| disable-sudo: true | |
| disable-telemetry: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| auth.docker.io:443 | |
| *.data.mcr.microsoft.com:443 | |
| endoflife.date:443 | |
| ghcr.io:443 | |
| github.com:443 | |
| hub.docker.com:443 | |
| index.crates.io:443 | |
| index.docker.io:443 | |
| mcr.microsoft.com:443 | |
| pkg-containers.githubusercontent.com:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| static.rust-lang.org:443 | |
| download-r2.pytorch.org:443 | |
| download.pytorch.org:443 | |
| files.pythonhosted.org:443 | |
| pypi.org:443 | |
| registry.npmjs.org:443 | |
| release-assets.githubusercontent.com:443 | |
| www.python.org:443 | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Get token | |
| id: get-github-app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.RENOVATE_APP_ID }} | |
| private-key: ${{ secrets.RENOVATE_APP_PEM }} | |
| - name: Self-hosted Renovate | |
| uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16 | |
| with: | |
| # renovate: datasource=github-releases depName=renovatebot/renovate | |
| renovate-version: 43.241.5 | |
| configurationFile: .github/renovate.json5 | |
| token: "${{ steps.get-github-app-token.outputs.token }}" | |
| env: | |
| LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && 'debug' || 'info' }} | |
| # Dry run if the event is workflow_dispatch AND the dry-run input is true | |
| RENOVATE_DRY_RUN: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true') && 'full' || null }} | |
| RENOVATE_PLATFORM: github | |
| RENOVATE_REPOSITORIES: ${{ github.repository }} |