Full migration to Renovate with support from Octo STS

.github/renovate.json5

@@ -28,23 +28,7 @@
       ],
     },
   ],
-  baseBranchPatterns: [
-    'main',
-    'octo-sts-poc',
-  ],
   packageRules: [
-    {
-      matchBaseBranches: [
-        'octo-sts-poc',
-      ],
-      enabled: false, // Disable upgrades in general for the octo-sts-poc branch.
-    },
-    {
-      matchManagers: [
-        'github-actions',
-      ],
-      enabled: false, // Disable the github-actions in general to enable it for more specific configuration.
-    },
     {
       groupName: 'Tools',
       matchManagers: [
@@ -62,10 +46,6 @@
       matchManagers: [
         'github-actions',
       ],
-      enabled: true,
-      matchBaseBranches: [
-        'octo-sts-poc',
-      ],
     },
     {
       groupName: 'Misc Go deps',

modules/repository-base/base-dependabot/.github/renovate.json5

@@ -7,6 +7,7 @@
   gitAuthor: 'Renovate Bot <renovate-bot@users.noreply.github.com>',
   recreateWhen: 'always', // TODO: Remove; temporary fix to force Renovate to ignore "foreign" commits
   enabledManagers: [
+    'github-actions',
     'gomod',
   ],
   extends: [
@@ -24,14 +25,25 @@
     'ok-to-test',
     'release-note-none',
   ],
-  postUpgradeTasks: {
-    commands: [
-      'make generate',
-    ],
-    executionMode: 'branch',
-  },
   // packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**.
   packageRules: [
+    {
+      groupName: 'Misc GitHub actions',
+      matchManagers: [
+        'github-actions',
+      ],
+    },
+    {
+      matchManagers: [
+        'gomod',
+      ],
+      postUpgradeTasks: {
+        commands: [
+          'make vendor-go generate',
+        ],
+        executionMode: 'branch',
+      }
+    },
     {
       groupName: 'Misc Go deps',
       matchManagers: [
@@ -125,5 +137,10 @@
   ],
   ignorePaths: [
     '**/vendor/**',
+    // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules.
+    'make/_shared/**',
+    '.github/workflows/govulncheck.yaml',
+    '.github/workflows/make-self-upgrade.yaml',
+    '.github/workflows/renovate.yaml',
   ],
 }

modules/repository-base/base-dependabot/.github/workflows/renovate.yaml

@@ -17,10 +17,7 @@ jobs:
     if: github.repository == '{{REPLACE:GH-REPOSITORY}}'
 
     permissions:
-      contents: write
-      issues: write
-      statuses: write
-      pull-requests: write
+      id-token: write
 
     steps:
       - name: Fail if branch is not head of branch.
@@ -29,11 +26,20 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
+      - name: Octo STS Token Exchange
+        uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main
+        id: octo-sts
+        with:
+          scope: '{{REPLACE:GH-REPOSITORY}}'
+          identity: renovate
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
-        with: { fetch-depth: 0 }
+        with:
+          fetch-depth: 0
+          token: ${{ steps.octo-sts.outputs.token }}
 
       - id: go-version
         run: |
@@ -47,7 +53,7 @@ jobs:
         uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9
         with:
           configurationFile: .github/renovate.json5
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
         env:
           RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'
           RENOVATE_ONBOARDING: "false"

modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml

@@ -0,0 +1,10 @@
+# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
+# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead.
+
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$
+
+permissions:
+  contents: write
+  pull_requests: write
+  workflows: write

modules/repository-base/base/.github/chainguard/renovate.sts.yaml

@@ -0,0 +1,14 @@
+# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
+# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/renovate.sts.yaml instead.
+
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$
+
+permissions:
+  administration: read
+  contents: write
+  issues: write
+  pull_requests: write
+  security_events: read
+  statuses: write
+  workflows: write

modules/repository-base/base/.github/workflows/make-self-upgrade.yaml

@@ -18,8 +18,7 @@ jobs:
     if: github.repository == '{{REPLACE:GH-REPOSITORY}}'
 
     permissions:
-      contents: write
-      pull-requests: write
+      id-token: write
 
     env:
       SOURCE_BRANCH: "${{ github.ref_name }}"
@@ -32,11 +31,20 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
+      - name: Octo STS Token Exchange
+        uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main
+        id: octo-sts
+        with:
+          scope: '{{REPLACE:GH-REPOSITORY}}'
+          identity: make-self-upgrade
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
-        with: { fetch-depth: 0 }
+        with:
+          fetch-depth: 0
+          token: ${{ steps.octo-sts.outputs.token }}
 
       - id: go-version
         run: |
@@ -75,6 +83,7 @@ jobs:
       - if: ${{ steps.is-up-to-date.outputs.result != 'true' }}
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
+          github-token: ${{ steps.octo-sts.outputs.token }}
           script: |
             const { repo, owner } = context.repo;
             const pulls = await github.rest.pulls.list({