diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 22cdfe8a..52bdd49f 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -1,6 +1,7 @@ { $schema: 'https://docs.renovatebot.com/renovate-schema.json', enabled: true, + gitAuthor: 'cert-manager-bot ', enabledManagers: [ 'custom.regex', 'gomod', diff --git a/.github/workflows/base-images-upgrade.yaml b/.github/workflows/base-images-upgrade.yaml index 525d95e7..285976e0 100644 --- a/.github/workflows/base-images-upgrade.yaml +++ b/.github/workflows/base-images-upgrade.yaml @@ -34,7 +34,7 @@ jobs: run: | make print-go-version >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: go-version: ${{ steps.go-version.outputs.result }} diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml index 4c282bcc..e9f7eff6 100644 --- a/.github/workflows/e2e-test.yaml +++ b/.github/workflows/e2e-test.yaml @@ -23,7 +23,7 @@ jobs: run: | make print-go-version >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@v5 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5 with: go-version: ${{ steps.go-version.outputs.result }} diff --git a/.github/workflows/kind-images-upgrade.yaml b/.github/workflows/kind-images-upgrade.yaml index 60d489dc..f1eef9ce 100644 --- a/.github/workflows/kind-images-upgrade.yaml +++ b/.github/workflows/kind-images-upgrade.yaml @@ -34,7 +34,7 @@ jobs: run: | make print-go-version >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: go-version: ${{ steps.go-version.outputs.result }} diff --git a/modules/repository-base/base-dependabot/.github/dependabot.yaml b/modules/repository-base/base-dependabot/.github/dependabot.yaml deleted file mode 100644 index 4714195f..00000000 --- a/modules/repository-base/base-dependabot/.github/dependabot.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base-dependabot/.github/dependabot.yaml instead. - -# Update Go dependencies and GitHub Actions dependencies daily. -version: 2 -updates: -- package-ecosystem: github-actions - directory: / - schedule: - interval: daily - exclude-paths: # Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. - - .github/workflows/govulncheck.yaml - - .github/workflows/make-self-upgrade.yaml - - .github/workflows/renovate.yaml - groups: - all-gh-actions: - patterns: ["*"] - labels: - - dependencies - - kind/cleanup - - release-note-none - - ok-to-test diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5 index be21f990..c89c08fa 100644 --- a/modules/repository-base/base-dependabot/.github/renovate.json5 +++ b/modules/repository-base/base-dependabot/.github/renovate.json5 @@ -4,7 +4,9 @@ { $schema: 'https://docs.renovatebot.com/renovate-schema.json', enabled: true, + gitAuthor: 'cert-manager-bot ', enabledManagers: [ + 'github-actions', 'gomod', ], extends: [ @@ -19,15 +21,25 @@ labels: [ 'dependencies', 'kind/cleanup', + 'ok-to-test', 'release-note-none', ], postUpgradeTasks: { commands: [ - 'make generate', + 'make vendor-go generate', ], executionMode: 'branch', }, packageRules: [ + { + groupName: 'Misc GitHub actions', + matchManagers: [ + 'github-actions', + ], + matchPackageNames: [ + '*', + ], + }, { groupName: 'Misc Go deps', matchManagers: [ @@ -88,5 +100,10 @@ ], ignorePaths: [ '**/vendor/**', + + // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. + '.github/workflows/govulncheck.yaml', + '.github/workflows/make-self-upgrade.yaml', + '.github/workflows/renovate.yaml', ], } diff --git a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml index 462bd9b7..16e6e5c7 100644 --- a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml +++ b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml @@ -5,7 +5,7 @@ name: Renovate on: workflow_dispatch: {} schedule: - - cron: '0 2 * * *' + - cron: '0/30 * * * *' permissions: contents: read @@ -13,14 +13,17 @@ permissions: jobs: renovate: runs-on: ubuntu-latest + # This concurrency control is added to allow a quite aggressive cron schedule (see above), + # while at the same time avoid multiple Renovate runs at the same time. + # In some of our projects, e.g. cert-manager, the Renovate run can take some time. + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false # Must allow the longest running job to finish. if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: write - issues: write - statuses: write - pull-requests: write + id-token: write steps: - name: Fail if branch is not head of branch. @@ -29,11 +32,20 @@ jobs: echo "This workflow should not be run on a non-branch-head." exit 1 + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: renovate + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Adding `fetch-depth: 0` makes sure tags are also fetched. We need # the tags so `git describe` returns a valid version. # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: { fetch-depth: 0 } + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} - id: go-version run: | @@ -47,7 +59,7 @@ jobs: uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9 with: configurationFile: .github/renovate.json5 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.octo-sts.outputs.token }} env: RENOVATE_REPOSITORIES: '["${{ github.repository }}"]' RENOVATE_ONBOARDING: "false" diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml new file mode 100644 index 00000000..2288f4e2 --- /dev/null +++ b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml @@ -0,0 +1,7 @@ +issuer: https://token.actions.githubusercontent.com +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ + +permissions: + contents: write + pull_requests: write + workflows: write diff --git a/modules/repository-base/base/.github/chainguard/renovate.sts.yaml b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml new file mode 100644 index 00000000..d1ac8908 --- /dev/null +++ b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml @@ -0,0 +1,11 @@ +issuer: https://token.actions.githubusercontent.com +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ + +permissions: + administration: read + contents: write + issues: write + pull_requests: write + security_events: read + statuses: write + workflows: write diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index af80a67c..b1a1aa3b 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -18,8 +18,7 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: write - pull-requests: write + id-token: write env: SOURCE_BRANCH: "${{ github.ref_name }}" @@ -32,11 +31,20 @@ jobs: echo "This workflow should not be run on a non-branch-head." exit 1 + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: make-self-upgrade + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Adding `fetch-depth: 0` makes sure tags are also fetched. We need # the tags so `git describe` returns a valid version. # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: { fetch-depth: 0 } + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} - id: go-version run: | @@ -75,6 +83,7 @@ jobs: - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: + github-token: ${{ steps.octo-sts.outputs.token }} script: | const { repo, owner } = context.repo; const pulls = await github.rest.pulls.list({ @@ -100,6 +109,6 @@ jobs: owner, repo, issue_number: result.data.number, - labels: ['skip-review'] + labels: ['ok-to-test', 'skip-review'] }); }