From b89fe0aee778669f651fc5cbe667de3fc32a7d44 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 6 Sep 2025 18:56:03 +0200 Subject: [PATCH 1/5] Migrate to Renovate shared preset Signed-off-by: Erik Godding Boye --- .../chainguard/make-self-upgrade.sts.yaml | 10 -- .../base/.github/renovate.json5 | 166 ------------------ .../.github/workflows/make-self-upgrade.yaml | 114 ------------ 3 files changed, 290 deletions(-) delete mode 100644 modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml delete mode 100644 modules/repository-base/base/.github/renovate.json5 delete mode 100644 modules/repository-base/base/.github/workflows/make-self-upgrade.yaml diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml deleted file mode 100644 index 310ca5ca..00000000 --- a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml +++ /dev/null @@ -1,10 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead. - -issuer: https://token.actions.githubusercontent.com -subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ - -permissions: - contents: write - pull_requests: write - workflows: write diff --git a/modules/repository-base/base/.github/renovate.json5 b/modules/repository-base/base/.github/renovate.json5 deleted file mode 100644 index d0dc1c0c..00000000 --- a/modules/repository-base/base/.github/renovate.json5 +++ /dev/null @@ -1,166 +0,0 @@ -// THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -// Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/renovate.json5 instead. - -{ - $schema: 'https://docs.renovatebot.com/renovate-schema.json', - enabled: true, - gitAuthor: 'Renovate Bot ', - gitIgnoredAuthors: [ - 'Renovate Bot ', - 'cert-manager-bot ', - ], - enabledManagers: [ - 'github-actions', - 'gomod', - ], - extends: [ - 'config:best-practices', - ':gitSignOff', - ':semanticCommits', - ':disableVulnerabilityAlerts', - ':rebaseStalePrs', - ':prConcurrentLimit10', // Set a limit to avoid too many PRs, at least on the first run - ':prHourlyLimitNone', - ], - timezone: 'Europe/London', - labels: [ - 'dependencies', - 'kind/cleanup', - 'ok-to-test', - 'release-note-none', - ], - // packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**. - packageRules: [ - { - groupName: 'Misc GitHub actions', - matchManagers: [ - 'github-actions', - ], - }, - { - matchManagers: [ - 'gomod', - ], - postUpgradeTasks: { - commands: [ - 'make vendor-go generate', - ], - executionMode: 'branch', - } - }, - { - groupName: 'Misc Go deps', - matchManagers: [ - 'gomod', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ], - }, - { - groupName: 'Testing Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/onsi/ginkgo/**', - 'github.com/onsi/gomega', - 'github.com/stretchr/testify', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Cloud Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/akamai/**', - 'github.com/aws/**', - 'github.com/Azure/**', - 'github.com/AzureAD/**', - 'github.com/cloudflare/**', - 'github.com/digitalocean/**', - 'google.golang.org/api', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Kubernetes Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'sigs.k8s.io/**', - 'k8s.io/**', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Kubernetes Go patches', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'k8s.io/**', - ], - matchUpdateTypes: [ - 'patch', - ], - addLabels: [ - 'skip-review', // Adding label to allow PRs to automerge - ] - }, - { - groupName: 'golang.org/x deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'golang.org/x/**', - ], - addLabels: [ - 'skip-review', // Adding label to allow PRs to automerge - ], - }, - { - matchManagers: [ - 'gomod', - ], - matchUpdateTypes: [ - 'major', - 'digest', - ], - dependencyDashboardApproval: true - }, - { - description: 'Disable (internal) cert-manager pseudo-version updates', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/cert-manager/**', - ], - matchCurrentValue: 'v0.0.0*', - enabled: false, - }, - ], - ignorePaths: [ - '**/vendor/**', - // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. - 'make/_shared/**', - '.github/workflows/govulncheck.yaml', - '.github/workflows/make-self-upgrade.yaml', - '.github/workflows/renovate.yaml', - ], -} diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml deleted file mode 100644 index 3be95541..00000000 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ /dev/null @@ -1,114 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml instead. - -name: make-self-upgrade -concurrency: make-self-upgrade -on: - workflow_dispatch: {} - schedule: - - cron: '0 0 * * *' - -permissions: - contents: read - -jobs: - self_upgrade: - runs-on: ubuntu-latest - - if: github.repository == '{{REPLACE:GH-REPOSITORY}}' - - permissions: - id-token: write - - env: - SOURCE_BRANCH: "${{ github.ref_name }}" - SELF_UPGRADE_BRANCH: "self-upgrade-${{ github.ref_name }}" - - steps: - - name: Fail if branch is not head of branch. - if: ${{ !startsWith(github.ref, 'refs/heads/') && env.SOURCE_BRANCH != '' && env.SELF_UPGRADE_BRANCH != '' }} - run: | - echo "This workflow should not be run on a non-branch-head." - exit 1 - - - name: Octo STS Token Exchange - uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # v1.0.1 - id: octo-sts - with: - scope: '{{REPLACE:GH-REPOSITORY}}' - identity: make-self-upgrade - - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - # Adding `fetch-depth: 0` makes sure tags are also fetched. We need - # the tags so `git describe` returns a valid version. - # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: - fetch-depth: 0 - token: ${{ steps.octo-sts.outputs.token }} - - - id: go-version - run: | - make print-go-version >> "$GITHUB_OUTPUT" - - - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 - with: - go-version: ${{ steps.go-version.outputs.result }} - - - run: | - git checkout -B "$SELF_UPGRADE_BRANCH" - - - run: | - make -j upgrade-klone - make -j generate - - - id: is-up-to-date - shell: bash - run: | - git_status=$(git status -s) - is_up_to_date="true" - if [ -n "$git_status" ]; then - is_up_to_date="false" - echo "The following changes will be committed:" - echo "$git_status" - fi - echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - run: | - git config --global user.name "cert-manager-bot" - git config --global user.email "cert-manager-bot@users.noreply.github.com" - git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff - git push -f origin "$SELF_UPGRADE_BRANCH" - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - github-token: ${{ steps.octo-sts.outputs.token }} - script: | - const { repo, owner } = context.repo; - const pulls = await github.rest.pulls.list({ - owner: owner, - repo: repo, - head: owner + ':' + process.env.SELF_UPGRADE_BRANCH, - base: process.env.SOURCE_BRANCH, - state: 'open', - }); - - if (pulls.data.length < 1) { - const result = await github.rest.pulls.create({ - title: '[CI] Merge ' + process.env.SELF_UPGRADE_BRANCH + ' into ' + process.env.SOURCE_BRANCH, - owner: owner, - repo: repo, - head: process.env.SELF_UPGRADE_BRANCH, - base: process.env.SOURCE_BRANCH, - body: [ - 'This PR is auto-generated to bump the Makefile modules.', - ].join('\n'), - }); - await github.rest.issues.addLabels({ - owner, - repo, - issue_number: result.data.number, - labels: ['ok-to-test', 'skip-review', 'release-note-none', 'kind/cleanup'] - }); - } From 4eece1458eb870f95cc1c81bb826be8a8191181e Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 6 Sep 2025 19:38:45 +0200 Subject: [PATCH 2/5] Try using rsync to conditionally copy Renovate config Signed-off-by: Erik Godding Boye --- modules/repository-base/01_mod.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/repository-base/01_mod.mk b/modules/repository-base/01_mod.mk index 0d094c23..e649bc6b 100644 --- a/modules/repository-base/01_mod.mk +++ b/modules/repository-base/01_mod.mk @@ -22,7 +22,7 @@ repository_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/ ## Generate base files in the repository ## @category [shared] Generate/ Verify generate-base: - cp -r $(repository_base_dir)/. ./ + rsync -a --exclude='.github/renovate.json5' "$(repository_base_dir)/" ./ cd $(repository_base_dir) && \ find . -type f | while read file; do \ sed "s|{{REPLACE:GH-REPOSITORY}}|$(repo_name:github.com/%=%)|g" "$$file" > "$(CURDIR)/$$file"; \ From 97c8d84e1c858219e96b206b782ad0b24341d469 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 6 Sep 2025 19:45:22 +0200 Subject: [PATCH 3/5] Revert delete of renovate.json5 Signed-off-by: Erik Godding Boye --- .../base/.github/renovate.json5 | 166 ++++++++++++++++++ 1 file changed, 166 insertions(+) create mode 100644 modules/repository-base/base/.github/renovate.json5 diff --git a/modules/repository-base/base/.github/renovate.json5 b/modules/repository-base/base/.github/renovate.json5 new file mode 100644 index 00000000..d0dc1c0c --- /dev/null +++ b/modules/repository-base/base/.github/renovate.json5 @@ -0,0 +1,166 @@ +// THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +// Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/renovate.json5 instead. + +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + enabled: true, + gitAuthor: 'Renovate Bot ', + gitIgnoredAuthors: [ + 'Renovate Bot ', + 'cert-manager-bot ', + ], + enabledManagers: [ + 'github-actions', + 'gomod', + ], + extends: [ + 'config:best-practices', + ':gitSignOff', + ':semanticCommits', + ':disableVulnerabilityAlerts', + ':rebaseStalePrs', + ':prConcurrentLimit10', // Set a limit to avoid too many PRs, at least on the first run + ':prHourlyLimitNone', + ], + timezone: 'Europe/London', + labels: [ + 'dependencies', + 'kind/cleanup', + 'ok-to-test', + 'release-note-none', + ], + // packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**. + packageRules: [ + { + groupName: 'Misc GitHub actions', + matchManagers: [ + 'github-actions', + ], + }, + { + matchManagers: [ + 'gomod', + ], + postUpgradeTasks: { + commands: [ + 'make vendor-go generate', + ], + executionMode: 'branch', + } + }, + { + groupName: 'Misc Go deps', + matchManagers: [ + 'gomod', + ], + matchUpdateTypes: [ + 'minor', + 'patch', + ], + }, + { + groupName: 'Testing Go deps', + matchManagers: [ + 'gomod', + ], + matchPackageNames: [ + 'github.com/onsi/ginkgo/**', + 'github.com/onsi/gomega', + 'github.com/stretchr/testify', + ], + matchUpdateTypes: [ + 'minor', + 'patch', + ] + }, + { + groupName: 'Cloud Go deps', + matchManagers: [ + 'gomod', + ], + matchPackageNames: [ + 'github.com/akamai/**', + 'github.com/aws/**', + 'github.com/Azure/**', + 'github.com/AzureAD/**', + 'github.com/cloudflare/**', + 'github.com/digitalocean/**', + 'google.golang.org/api', + ], + matchUpdateTypes: [ + 'minor', + 'patch', + ] + }, + { + groupName: 'Kubernetes Go deps', + matchManagers: [ + 'gomod', + ], + matchPackageNames: [ + 'sigs.k8s.io/**', + 'k8s.io/**', + ], + matchUpdateTypes: [ + 'minor', + 'patch', + ] + }, + { + groupName: 'Kubernetes Go patches', + matchManagers: [ + 'gomod', + ], + matchPackageNames: [ + 'k8s.io/**', + ], + matchUpdateTypes: [ + 'patch', + ], + addLabels: [ + 'skip-review', // Adding label to allow PRs to automerge + ] + }, + { + groupName: 'golang.org/x deps', + matchManagers: [ + 'gomod', + ], + matchPackageNames: [ + 'golang.org/x/**', + ], + addLabels: [ + 'skip-review', // Adding label to allow PRs to automerge + ], + }, + { + matchManagers: [ + 'gomod', + ], + matchUpdateTypes: [ + 'major', + 'digest', + ], + dependencyDashboardApproval: true + }, + { + description: 'Disable (internal) cert-manager pseudo-version updates', + matchManagers: [ + 'gomod', + ], + matchPackageNames: [ + 'github.com/cert-manager/**', + ], + matchCurrentValue: 'v0.0.0*', + enabled: false, + }, + ], + ignorePaths: [ + '**/vendor/**', + // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. + 'make/_shared/**', + '.github/workflows/govulncheck.yaml', + '.github/workflows/make-self-upgrade.yaml', + '.github/workflows/renovate.yaml', + ], +} From d9db6be6eb6c54f8e8142e2ca78fc7c7510b0cad Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 6 Sep 2025 19:53:22 +0200 Subject: [PATCH 4/5] Revert "Revert delete of renovate.json5" This reverts commit 97c8d84e1c858219e96b206b782ad0b24341d469. --- .../base/.github/renovate.json5 | 166 ------------------ 1 file changed, 166 deletions(-) delete mode 100644 modules/repository-base/base/.github/renovate.json5 diff --git a/modules/repository-base/base/.github/renovate.json5 b/modules/repository-base/base/.github/renovate.json5 deleted file mode 100644 index d0dc1c0c..00000000 --- a/modules/repository-base/base/.github/renovate.json5 +++ /dev/null @@ -1,166 +0,0 @@ -// THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -// Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/renovate.json5 instead. - -{ - $schema: 'https://docs.renovatebot.com/renovate-schema.json', - enabled: true, - gitAuthor: 'Renovate Bot ', - gitIgnoredAuthors: [ - 'Renovate Bot ', - 'cert-manager-bot ', - ], - enabledManagers: [ - 'github-actions', - 'gomod', - ], - extends: [ - 'config:best-practices', - ':gitSignOff', - ':semanticCommits', - ':disableVulnerabilityAlerts', - ':rebaseStalePrs', - ':prConcurrentLimit10', // Set a limit to avoid too many PRs, at least on the first run - ':prHourlyLimitNone', - ], - timezone: 'Europe/London', - labels: [ - 'dependencies', - 'kind/cleanup', - 'ok-to-test', - 'release-note-none', - ], - // packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**. - packageRules: [ - { - groupName: 'Misc GitHub actions', - matchManagers: [ - 'github-actions', - ], - }, - { - matchManagers: [ - 'gomod', - ], - postUpgradeTasks: { - commands: [ - 'make vendor-go generate', - ], - executionMode: 'branch', - } - }, - { - groupName: 'Misc Go deps', - matchManagers: [ - 'gomod', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ], - }, - { - groupName: 'Testing Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/onsi/ginkgo/**', - 'github.com/onsi/gomega', - 'github.com/stretchr/testify', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Cloud Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/akamai/**', - 'github.com/aws/**', - 'github.com/Azure/**', - 'github.com/AzureAD/**', - 'github.com/cloudflare/**', - 'github.com/digitalocean/**', - 'google.golang.org/api', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Kubernetes Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'sigs.k8s.io/**', - 'k8s.io/**', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Kubernetes Go patches', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'k8s.io/**', - ], - matchUpdateTypes: [ - 'patch', - ], - addLabels: [ - 'skip-review', // Adding label to allow PRs to automerge - ] - }, - { - groupName: 'golang.org/x deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'golang.org/x/**', - ], - addLabels: [ - 'skip-review', // Adding label to allow PRs to automerge - ], - }, - { - matchManagers: [ - 'gomod', - ], - matchUpdateTypes: [ - 'major', - 'digest', - ], - dependencyDashboardApproval: true - }, - { - description: 'Disable (internal) cert-manager pseudo-version updates', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/cert-manager/**', - ], - matchCurrentValue: 'v0.0.0*', - enabled: false, - }, - ], - ignorePaths: [ - '**/vendor/**', - // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. - 'make/_shared/**', - '.github/workflows/govulncheck.yaml', - '.github/workflows/make-self-upgrade.yaml', - '.github/workflows/renovate.yaml', - ], -} From bf1fa3a37bec83cfb0ba7a7c8461b9afd163925c Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sat, 6 Sep 2025 19:53:22 +0200 Subject: [PATCH 5/5] Revert "Try using rsync to conditionally copy Renovate config" This reverts commit 4eece1458eb870f95cc1c81bb826be8a8191181e. --- modules/repository-base/01_mod.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/repository-base/01_mod.mk b/modules/repository-base/01_mod.mk index e649bc6b..0d094c23 100644 --- a/modules/repository-base/01_mod.mk +++ b/modules/repository-base/01_mod.mk @@ -22,7 +22,7 @@ repository_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/ ## Generate base files in the repository ## @category [shared] Generate/ Verify generate-base: - rsync -a --exclude='.github/renovate.json5' "$(repository_base_dir)/" ./ + cp -r $(repository_base_dir)/. ./ cd $(repository_base_dir) && \ find . -type f | while read file; do \ sed "s|{{REPLACE:GH-REPOSITORY}}|$(repo_name:github.com/%=%)|g" "$$file" > "$(CURDIR)/$$file"; \