From 31db4c8eb69b0707d8297605b45e5747285def00 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 30 Aug 2025 13:05:52 +0200 Subject: [PATCH 01/14] feat: enable Octo STS for downstream automation Signed-off-by: Erik Godding Boye --- .../base-dependabot/.github/dependabot.yaml | 22 ------------------- .../base-dependabot/.github/renovate.json5 | 15 +++++++++++++ .../.github/workflows/renovate.yaml | 21 +++++++++++++----- .../chainguard/make-self-upgrade.sts.yaml | 6 +++++ .../base/.github/chainguard/renovate.sts.yaml | 11 ++++++++++ .../.github/workflows/make-self-upgrade.yaml | 16 ++++++++++++-- 6 files changed, 61 insertions(+), 30 deletions(-) delete mode 100644 modules/repository-base/base-dependabot/.github/dependabot.yaml create mode 100644 modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml create mode 100644 modules/repository-base/base/.github/chainguard/renovate.sts.yaml diff --git a/modules/repository-base/base-dependabot/.github/dependabot.yaml b/modules/repository-base/base-dependabot/.github/dependabot.yaml deleted file mode 100644 index 4714195f..00000000 --- a/modules/repository-base/base-dependabot/.github/dependabot.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base-dependabot/.github/dependabot.yaml instead. - -# Update Go dependencies and GitHub Actions dependencies daily. -version: 2 -updates: -- package-ecosystem: github-actions - directory: / - schedule: - interval: daily - exclude-paths: # Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. - - .github/workflows/govulncheck.yaml - - .github/workflows/make-self-upgrade.yaml - - .github/workflows/renovate.yaml - groups: - all-gh-actions: - patterns: ["*"] - labels: - - dependencies - - kind/cleanup - - release-note-none - - ok-to-test diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5 index be21f990..9214f58d 100644 --- a/modules/repository-base/base-dependabot/.github/renovate.json5 +++ b/modules/repository-base/base-dependabot/.github/renovate.json5 @@ -5,6 +5,7 @@ $schema: 'https://docs.renovatebot.com/renovate-schema.json', enabled: true, enabledManagers: [ + 'github-actions', 'gomod', ], extends: [ @@ -28,6 +29,15 @@ executionMode: 'branch', }, packageRules: [ + { + groupName: 'Misc GitHub actions', + matchManagers: [ + 'github-actions', + ], + matchPackageNames: [ + '*', + ], + }, { groupName: 'Misc Go deps', matchManagers: [ @@ -88,5 +98,10 @@ ], ignorePaths: [ '**/vendor/**', + + // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. + '.github/workflows/govulncheck.yaml', + '.github/workflows/make-self-upgrade.yaml', + '.github/workflows/renovate.yaml', ], } diff --git a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml index 462bd9b7..ba024a73 100644 --- a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml +++ b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml @@ -3,9 +3,13 @@ name: Renovate on: + push: + branches: + - main + - master workflow_dispatch: {} schedule: - - cron: '0 2 * * *' + - cron: '0/30 * * * *' permissions: contents: read @@ -17,10 +21,8 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: write - issues: write - statuses: write - pull-requests: write + contents: read + id-token: write steps: - name: Fail if branch is not head of branch. @@ -43,11 +45,18 @@ jobs: with: go-version: ${{ steps.go-version.outputs.result }} + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: renovate + - name: Self-hosted Renovate uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9 with: configurationFile: .github/renovate.json5 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.octo-sts.outputs.token }} env: RENOVATE_REPOSITORIES: '["${{ github.repository }}"]' RENOVATE_ONBOARDING: "false" diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml new file mode 100644 index 00000000..b440da38 --- /dev/null +++ b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml @@ -0,0 +1,6 @@ +issuer: https://token.actions.githubusercontent.com +subject_pattern: repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master) + +permissions: + contents: write + pull_requests: write diff --git a/modules/repository-base/base/.github/chainguard/renovate.sts.yaml b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml new file mode 100644 index 00000000..38a07fe8 --- /dev/null +++ b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml @@ -0,0 +1,11 @@ +issuer: https://token.actions.githubusercontent.com +subject_pattern: repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master) + +permissions: + administration: read + contents: write + issues: write + pull_requests: write + security_events: read + statuses: write + workflows: write diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index af80a67c..90b7f8aa 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -18,8 +18,8 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: write - pull-requests: write + contents: read + id-token: write env: SOURCE_BRANCH: "${{ github.ref_name }}" @@ -66,6 +66,16 @@ jobs: echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} + name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: make-self-upgrade + + - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} + env: + GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} run: | git config --global user.name "cert-manager-bot" git config --global user.email "cert-manager-bot@users.noreply.github.com" @@ -74,6 +84,8 @@ jobs: - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + env: + GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} with: script: | const { repo, owner } = context.repo; From b976d408b477d0a06dc2474a66aa0c7a9ddc9ae0 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 30 Aug 2025 14:58:23 +0200 Subject: [PATCH 02/14] Add ok-to-test label to downstream Renovate PRs Signed-off-by: Erik Godding Boye --- modules/repository-base/base-dependabot/.github/renovate.json5 | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5 index 9214f58d..4744d606 100644 --- a/modules/repository-base/base-dependabot/.github/renovate.json5 +++ b/modules/repository-base/base-dependabot/.github/renovate.json5 @@ -20,6 +20,7 @@ labels: [ 'dependencies', 'kind/cleanup', + 'ok-to-test', 'release-note-none', ], postUpgradeTasks: { From 1db59afd47a6ea39a6dd4e809426985222eac225 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 30 Aug 2025 15:25:35 +0200 Subject: [PATCH 03/14] Use token obtained from Octo STS for Git operations Signed-off-by: Erik Godding Boye --- .../base/.github/workflows/make-self-upgrade.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index 90b7f8aa..fd4d4db0 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -77,6 +77,7 @@ jobs: env: GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} run: | + git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/{{REPLACE:GH-REPOSITORY}}.git" git config --global user.name "cert-manager-bot" git config --global user.email "cert-manager-bot@users.noreply.github.com" git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff From 2093e7d6ac5eec3aa7d44b6e7894012426a9e6f7 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 30 Aug 2025 15:40:47 +0200 Subject: [PATCH 04/14] Add vendor-go target to Renovate postUpgradeTasks Signed-off-by: Erik Godding Boye --- modules/repository-base/base-dependabot/.github/renovate.json5 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5 index 4744d606..b7044e73 100644 --- a/modules/repository-base/base-dependabot/.github/renovate.json5 +++ b/modules/repository-base/base-dependabot/.github/renovate.json5 @@ -25,7 +25,7 @@ ], postUpgradeTasks: { commands: [ - 'make generate', + 'make vendor-go generate', ], executionMode: 'branch', }, From 1fd41025051eeac53706f976de9b2fd15025cb05 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 30 Aug 2025 15:58:13 +0200 Subject: [PATCH 05/14] Simplify use of Octo STS token in self-upgrade workflow Signed-off-by: Erik Godding Boye --- .../.github/workflows/make-self-upgrade.yaml | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index fd4d4db0..d80451c4 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -32,11 +32,20 @@ jobs: echo "This workflow should not be run on a non-branch-head." exit 1 + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: make-self-upgrade + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Adding `fetch-depth: 0` makes sure tags are also fetched. We need # the tags so `git describe` returns a valid version. # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: { fetch-depth: 0 } + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} - id: go-version run: | @@ -66,18 +75,7 @@ jobs: echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - name: Octo STS Token Exchange - uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main - id: octo-sts - with: - scope: '{{REPLACE:GH-REPOSITORY}}' - identity: make-self-upgrade - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - env: - GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} run: | - git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/{{REPLACE:GH-REPOSITORY}}.git" git config --global user.name "cert-manager-bot" git config --global user.email "cert-manager-bot@users.noreply.github.com" git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff @@ -85,8 +83,6 @@ jobs: - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 - env: - GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} with: script: | const { repo, owner } = context.repo; From f61bbc8618e346ad39a57308bb575b8197ceef0f Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 10:15:21 +0200 Subject: [PATCH 06/14] Grant make-self-upgrade write access to workflows Signed-off-by: Erik Godding Boye --- .../base/.github/chainguard/make-self-upgrade.sts.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml index b440da38..1781e0e0 100644 --- a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml +++ b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml @@ -4,3 +4,4 @@ subject_pattern: repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master) permissions: contents: write pull_requests: write + workflows: write From c935f5dd834d61fb133c8efef625cfe7689b72ca Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 10:37:25 +0200 Subject: [PATCH 07/14] Remove Renovate push trigger Signed-off-by: Erik Godding Boye --- .../base-dependabot/.github/workflows/renovate.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml index ba024a73..e7dbd097 100644 --- a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml +++ b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml @@ -3,10 +3,6 @@ name: Renovate on: - push: - branches: - - main - - master workflow_dispatch: {} schedule: - cron: '0/30 * * * *' From 8df7c3f00cd32bcbd41feeff756487694dfbfc53 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 10:51:36 +0200 Subject: [PATCH 08/14] Anchor Octo STS subject patterns Signed-off-by: Erik Godding Boye --- .../base/.github/chainguard/make-self-upgrade.sts.yaml | 2 +- .../repository-base/base/.github/chainguard/renovate.sts.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml index b440da38..5303d6b5 100644 --- a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml +++ b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml @@ -1,5 +1,5 @@ issuer: https://token.actions.githubusercontent.com -subject_pattern: repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master) +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ permissions: contents: write diff --git a/modules/repository-base/base/.github/chainguard/renovate.sts.yaml b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml index 38a07fe8..d1ac8908 100644 --- a/modules/repository-base/base/.github/chainguard/renovate.sts.yaml +++ b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml @@ -1,5 +1,5 @@ issuer: https://token.actions.githubusercontent.com -subject_pattern: repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master) +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ permissions: administration: read From c4795769e8c7595da7402c21fe24045ddddfce4e Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 11:28:36 +0200 Subject: [PATCH 09/14] Align make-self-upgrade and renovate workflows Signed-off-by: Erik Godding Boye --- .../.github/workflows/renovate.yaml | 19 ++++++++++--------- .../.github/workflows/make-self-upgrade.yaml | 1 - 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml index ba024a73..23c9433c 100644 --- a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml +++ b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml @@ -21,7 +21,6 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: read id-token: write steps: @@ -31,11 +30,20 @@ jobs: echo "This workflow should not be run on a non-branch-head." exit 1 + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: renovate + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Adding `fetch-depth: 0` makes sure tags are also fetched. We need # the tags so `git describe` returns a valid version. # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: { fetch-depth: 0 } + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} - id: go-version run: | @@ -45,13 +53,6 @@ jobs: with: go-version: ${{ steps.go-version.outputs.result }} - - name: Octo STS Token Exchange - uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main - id: octo-sts - with: - scope: '{{REPLACE:GH-REPOSITORY}}' - identity: renovate - - name: Self-hosted Renovate uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9 with: diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index d80451c4..3d459d1d 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -18,7 +18,6 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: read id-token: write env: From db123f4550c339084b8cac971273ba42d3e1d4f4 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 12:56:43 +0200 Subject: [PATCH 10/14] Add concurrency control to Renovate workflow Signed-off-by: Erik Godding Boye --- .../base-dependabot/.github/workflows/renovate.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml index 2e721727..16e6e5c7 100644 --- a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml +++ b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml @@ -13,6 +13,12 @@ permissions: jobs: renovate: runs-on: ubuntu-latest + # This concurrency control is added to allow a quite aggressive cron schedule (see above), + # while at the same time avoid multiple Renovate runs at the same time. + # In some of our projects, e.g. cert-manager, the Renovate run can take some time. + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false # Must allow the longest running job to finish. if: github.repository == '{{REPLACE:GH-REPOSITORY}}' From a3254b976d53edfcb2b18666633b17df7c5244ca Mon Sep 17 00:00:00 2001 From: "octo-sts[bot]" <157150467+octo-sts[bot]@users.noreply.github.com> Date: Sun, 31 Aug 2025 11:59:56 +0000 Subject: [PATCH 11/14] chore(deps): update misc github actions Signed-off-by: octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com> --- .github/workflows/base-images-upgrade.yaml | 2 +- .github/workflows/e2e-test.yaml | 2 +- .github/workflows/kind-images-upgrade.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/base-images-upgrade.yaml b/.github/workflows/base-images-upgrade.yaml index 525d95e7..285976e0 100644 --- a/.github/workflows/base-images-upgrade.yaml +++ b/.github/workflows/base-images-upgrade.yaml @@ -34,7 +34,7 @@ jobs: run: | make print-go-version >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: go-version: ${{ steps.go-version.outputs.result }} diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml index 4c282bcc..e9f7eff6 100644 --- a/.github/workflows/e2e-test.yaml +++ b/.github/workflows/e2e-test.yaml @@ -23,7 +23,7 @@ jobs: run: | make print-go-version >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@v5 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5 with: go-version: ${{ steps.go-version.outputs.result }} diff --git a/.github/workflows/kind-images-upgrade.yaml b/.github/workflows/kind-images-upgrade.yaml index 60d489dc..f1eef9ce 100644 --- a/.github/workflows/kind-images-upgrade.yaml +++ b/.github/workflows/kind-images-upgrade.yaml @@ -34,7 +34,7 @@ jobs: run: | make print-go-version >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: go-version: ${{ steps.go-version.outputs.result }} From 0378b84645296156784e2b8e7abf0a1d912a4c75 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 14:14:08 +0200 Subject: [PATCH 12/14] Use Octo STS token to create self-upgrade PR Signed-off-by: Erik Godding Boye --- .../base/.github/workflows/make-self-upgrade.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index 3d459d1d..1e7d3d99 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -83,6 +83,7 @@ jobs: - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: + github-token: ${{ steps.octo-sts.outputs.token }} script: | const { repo, owner } = context.repo; const pulls = await github.rest.pulls.list({ From c6eaf4b4f159b3ab1da1f6fd408bf51a1fd7def2 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 14:35:33 +0200 Subject: [PATCH 13/14] Add ok-to-test label to self-upgrade PRs Signed-off-by: Erik Godding Boye --- .../base/.github/workflows/make-self-upgrade.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index 1e7d3d99..b1a1aa3b 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -109,6 +109,6 @@ jobs: owner, repo, issue_number: result.data.number, - labels: ['skip-review'] + labels: ['ok-to-test', 'skip-review'] }); } From 91a88b9f88a3876b8bd77021a313114da89cbe4e Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 14:53:04 +0200 Subject: [PATCH 14/14] Set cert-manager-bot as Git author of Renovate PRs Signed-off-by: Erik Godding Boye --- .github/renovate.json5 | 1 + modules/repository-base/base-dependabot/.github/renovate.json5 | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 22cdfe8a..52bdd49f 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -1,6 +1,7 @@ { $schema: 'https://docs.renovatebot.com/renovate-schema.json', enabled: true, + gitAuthor: 'cert-manager-bot ', enabledManagers: [ 'custom.regex', 'gomod', diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5 index b7044e73..c89c08fa 100644 --- a/modules/repository-base/base-dependabot/.github/renovate.json5 +++ b/modules/repository-base/base-dependabot/.github/renovate.json5 @@ -4,6 +4,7 @@ { $schema: 'https://docs.renovatebot.com/renovate-schema.json', enabled: true, + gitAuthor: 'cert-manager-bot ', enabledManagers: [ 'github-actions', 'gomod',