From b5efa36c28ea73740979eaf2d962843f04dd6421 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 31 Aug 2025 19:28:33 +0200 Subject: [PATCH] Full migration to Renovate with support from Octo STS Signed-off-by: Erik Godding Boye --- .github/dependabot.yaml | 11 ------- .github/renovate.json5 | 20 ------------- .../base-dependabot/.github/dependabot.yaml | 22 -------------- .../base-dependabot/.github/renovate.json5 | 29 +++++++++++++++---- .../.github/workflows/renovate.yaml | 18 ++++++++---- .../chainguard/make-self-upgrade.sts.yaml | 10 +++++++ .../base/.github/chainguard/renovate.sts.yaml | 14 +++++++++ .../.github/workflows/make-self-upgrade.yaml | 15 ++++++++-- 8 files changed, 71 insertions(+), 68 deletions(-) delete mode 100644 .github/dependabot.yaml delete mode 100644 modules/repository-base/base-dependabot/.github/dependabot.yaml create mode 100644 modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml create mode 100644 modules/repository-base/base/.github/chainguard/renovate.sts.yaml diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml deleted file mode 100644 index 2c01ff87..00000000 --- a/.github/dependabot.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# Update GitHub Actions dependencies weekly. -version: 2 -updates: -- package-ecosystem: github-actions - directories: - - "/" - schedule: - interval: weekly - groups: - all-gh-actions: - patterns: ["*"] diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 5416f8ef..b2579c89 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -28,23 +28,7 @@ ], }, ], - baseBranchPatterns: [ - 'main', - 'octo-sts-poc', - ], packageRules: [ - { - matchBaseBranches: [ - 'octo-sts-poc', - ], - enabled: false, // Disable upgrades in general for the octo-sts-poc branch. - }, - { - matchManagers: [ - 'github-actions', - ], - enabled: false, // Disable the github-actions in general to enable it for more specific configuration. - }, { groupName: 'Tools', matchManagers: [ @@ -62,10 +46,6 @@ matchManagers: [ 'github-actions', ], - enabled: true, - matchBaseBranches: [ - 'octo-sts-poc', - ], }, { groupName: 'Misc Go deps', diff --git a/modules/repository-base/base-dependabot/.github/dependabot.yaml b/modules/repository-base/base-dependabot/.github/dependabot.yaml deleted file mode 100644 index 4714195f..00000000 --- a/modules/repository-base/base-dependabot/.github/dependabot.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base-dependabot/.github/dependabot.yaml instead. - -# Update Go dependencies and GitHub Actions dependencies daily. -version: 2 -updates: -- package-ecosystem: github-actions - directory: / - schedule: - interval: daily - exclude-paths: # Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. - - .github/workflows/govulncheck.yaml - - .github/workflows/make-self-upgrade.yaml - - .github/workflows/renovate.yaml - groups: - all-gh-actions: - patterns: ["*"] - labels: - - dependencies - - kind/cleanup - - release-note-none - - ok-to-test diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5 index 4477854a..5dc62bcc 100644 --- a/modules/repository-base/base-dependabot/.github/renovate.json5 +++ b/modules/repository-base/base-dependabot/.github/renovate.json5 @@ -7,6 +7,7 @@ gitAuthor: 'Renovate Bot ', recreateWhen: 'always', // TODO: Remove; temporary fix to force Renovate to ignore "foreign" commits enabledManagers: [ + 'github-actions', 'gomod', ], extends: [ @@ -24,14 +25,25 @@ 'ok-to-test', 'release-note-none', ], - postUpgradeTasks: { - commands: [ - 'make generate', - ], - executionMode: 'branch', - }, // packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**. packageRules: [ + { + groupName: 'Misc GitHub actions', + matchManagers: [ + 'github-actions', + ], + }, + { + matchManagers: [ + 'gomod', + ], + postUpgradeTasks: { + commands: [ + 'make vendor-go generate', + ], + executionMode: 'branch', + } + }, { groupName: 'Misc Go deps', matchManagers: [ @@ -125,5 +137,10 @@ ], ignorePaths: [ '**/vendor/**', + // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. + 'make/_shared/**', + '.github/workflows/govulncheck.yaml', + '.github/workflows/make-self-upgrade.yaml', + '.github/workflows/renovate.yaml', ], } diff --git a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml index 462bd9b7..e9074196 100644 --- a/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml +++ b/modules/repository-base/base-dependabot/.github/workflows/renovate.yaml @@ -17,10 +17,7 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: write - issues: write - statuses: write - pull-requests: write + id-token: write steps: - name: Fail if branch is not head of branch. @@ -29,11 +26,20 @@ jobs: echo "This workflow should not be run on a non-branch-head." exit 1 + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: renovate + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Adding `fetch-depth: 0` makes sure tags are also fetched. We need # the tags so `git describe` returns a valid version. # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: { fetch-depth: 0 } + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} - id: go-version run: | @@ -47,7 +53,7 @@ jobs: uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9 with: configurationFile: .github/renovate.json5 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.octo-sts.outputs.token }} env: RENOVATE_REPOSITORIES: '["${{ github.repository }}"]' RENOVATE_ONBOARDING: "false" diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml new file mode 100644 index 00000000..310ca5ca --- /dev/null +++ b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml @@ -0,0 +1,10 @@ +# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead. + +issuer: https://token.actions.githubusercontent.com +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ + +permissions: + contents: write + pull_requests: write + workflows: write diff --git a/modules/repository-base/base/.github/chainguard/renovate.sts.yaml b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml new file mode 100644 index 00000000..cb082a2c --- /dev/null +++ b/modules/repository-base/base/.github/chainguard/renovate.sts.yaml @@ -0,0 +1,14 @@ +# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/renovate.sts.yaml instead. + +issuer: https://token.actions.githubusercontent.com +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ + +permissions: + administration: read + contents: write + issues: write + pull_requests: write + security_events: read + statuses: write + workflows: write diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml index c4ff6957..b1a1aa3b 100644 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -18,8 +18,7 @@ jobs: if: github.repository == '{{REPLACE:GH-REPOSITORY}}' permissions: - contents: write - pull-requests: write + id-token: write env: SOURCE_BRANCH: "${{ github.ref_name }}" @@ -32,11 +31,20 @@ jobs: echo "This workflow should not be run on a non-branch-head." exit 1 + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: make-self-upgrade + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # Adding `fetch-depth: 0` makes sure tags are also fetched. We need # the tags so `git describe` returns a valid version. # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: { fetch-depth: 0 } + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} - id: go-version run: | @@ -75,6 +83,7 @@ jobs: - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: + github-token: ${{ steps.octo-sts.outputs.token }} script: | const { repo, owner } = context.repo; const pulls = await github.rest.pulls.list({