From 74d07d4308104702f268fe88766a60ee96fd018a Mon Sep 17 00:00:00 2001 From: "Alexander Bassmanow (AlexBass01)" Date: Mon, 7 Sep 2026 11:49:19 +0200 Subject: [PATCH 1/4] chore: run renovate on onesel Signed-off-by: Alexander Bassmanow (AlexBass01) --- .github/renovate-central.json5 | 35 +++++++++ .github/renovate-repositories.json | 2 +- .github/renovate.json5 | 94 +++++++++++++++++-------- .github/workflows/release-please.yml | 2 + .github/workflows/renovate-schedule.yml | 1 + .github/workflows/renovate-self.yml | 52 ++++++++++++++ .github/workflows/renovate.yml | 4 +- 7 files changed, 156 insertions(+), 34 deletions(-) create mode 100644 .github/renovate-central.json5 create mode 100644 .github/workflows/renovate-self.yml diff --git a/.github/renovate-central.json5 b/.github/renovate-central.json5 new file mode 100644 index 0000000..e310997 --- /dev/null +++ b/.github/renovate-central.json5 @@ -0,0 +1,35 @@ +// Central renovate configuration for runs orchestrated by +// .github/workflows/renovate-schedule.yml. This file is the global config for +// every target repository listed in .github/renovate-repositories.json; +// repository-local configs (renovate.json[5], .github/renovate.json[5], ...) +// still apply per repository on top. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + // Commit author: intentionally NOT set via gitAuthor. The workflows run + // with platformCommit enabled and GitHub App tokens, so GitHub itself sets + // the commit author and renovate auto-discovers its own identity from + // whichever App's token the run uses — regardless of whether the run comes + // from the central sweeper or a repository-local workflow. + // + // gitIgnoredAuthors: commits with these author emails count as renovate's + // own when checking whether a branch was edited externally (otherwise the + // branch is skipped as "pr-edited"). List every GitHub App that may run + // renovate against the swept repositories, so branches written by one App's + // runs are accepted by another App's runs (e.g. central sweeper vs. + // repo-local runs with different credentials). A repository-level + // gitIgnoredAuthors REPLACES this list (non-mergeable) — repeat entries you + // still need. Keep the list tight: noreply author emails are spoofable. + // Derive an email: curl -s https://api.github.com/users/odgbot%5Bbot%5D | grep '"id"' -> +[bot]@users.noreply.github.com + gitIgnoredAuthors: [ + // (bare email only: renovate compares gitIgnoredAuthors against %ae/%ce + // author/committer emails, never against 'Name ') + // odgbot - production central sweeper for ODG (https://github.com/apps/odgbot) + '319464553+odgbot[bot]@users.noreply.github.com', + // ocmbot - will be used later again when we expand beyond ODG + '125909804+ocmbot[bot]@users.noreply.github.com', + ], + // Add org-wide defaults here, e.g.: + // labels: ['dependencies'], + // timezone: 'Europe/Berlin', + // schedule: ['at any time'], +} diff --git a/.github/renovate-repositories.json b/.github/renovate-repositories.json index 17f56dd..3d8bafb 100644 --- a/.github/renovate-repositories.json +++ b/.github/renovate-repositories.json @@ -1,3 +1,3 @@ [ - "open-component-model/odg-ui" + "open-component-model/.github" ] diff --git a/.github/renovate.json5 b/.github/renovate.json5 index e310997..88ac5f4 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -1,35 +1,67 @@ -// Central renovate configuration for runs orchestrated by -// .github/workflows/renovate-schedule.yml. This file is the global config for -// every target repository listed in .github/renovate-repositories.json; -// repository-local configs (renovate.json[5], .github/renovate.json[5], ...) -// still apply per repository on top. { $schema: 'https://docs.renovatebot.com/renovate-schema.json', - // Commit author: intentionally NOT set via gitAuthor. The workflows run - // with platformCommit enabled and GitHub App tokens, so GitHub itself sets - // the commit author and renovate auto-discovers its own identity from - // whichever App's token the run uses — regardless of whether the run comes - // from the central sweeper or a repository-local workflow. - // - // gitIgnoredAuthors: commits with these author emails count as renovate's - // own when checking whether a branch was edited externally (otherwise the - // branch is skipped as "pr-edited"). List every GitHub App that may run - // renovate against the swept repositories, so branches written by one App's - // runs are accepted by another App's runs (e.g. central sweeper vs. - // repo-local runs with different credentials). A repository-level - // gitIgnoredAuthors REPLACES this list (non-mergeable) — repeat entries you - // still need. Keep the list tight: noreply author emails are spoofable. - // Derive an email: curl -s https://api.github.com/users/odgbot%5Bbot%5D | grep '"id"' -> +[bot]@users.noreply.github.com - gitIgnoredAuthors: [ - // (bare email only: renovate compares gitIgnoredAuthors against %ae/%ce - // author/committer emails, never against 'Name ') - // odgbot - production central sweeper for ODG (https://github.com/apps/odgbot) - '319464553+odgbot[bot]@users.noreply.github.com', - // ocmbot - will be used later again when we expand beyond ODG - '125909804+ocmbot[bot]@users.noreply.github.com', + extends: [ + 'config:recommended', + 'config:best-practices', + 'helpers:pinGitHubActionDigests', + 'docker:pinDigests', + 'security:openssf-scorecard', + ':dependencyDashboard', + ':rebaseStalePrs', + ], + 'internalChecksFilter': 'strict', + 'minimumReleaseAge': '7 days', + 'branchPrefix': 'renovate/', + // Commit identity is intentionally unset: renovate runs with platformCommit + // and a GitHub App token, so GitHub sets the commit author and renovate + // auto-discovers it from the token. All fleet bots that may touch renovate + // branches are whitelisted via gitIgnoredAuthors in the central config. Add + // a repo-level gitIgnoredAuthors only if an app NOT listed centrally runs + // renovate here — it replaces (not extends) the central list, so repeat + // entries you still need. + // drip-feed PRs so the initial onboarding wave doesn't flood reviewers; + // renovate opens more as PRs get merged + prConcurrentLimit: 5, + prHourlyLimit: 0, + automerge: false, + automergeType: 'pr', + vulnerabilityAlerts: { + minimumReleaseAge: null, + automerge: false, + }, + packageRules: [ + { + // Majors wait as checkboxes in the dependency dashboard ("Pending + // Approval") instead of occupying prConcurrentLimit slots — tick one + // there to have its PR created when you're ready to work on it. + matchUpdateTypes: ['major'], + dependencyDashboardApproval: true, + }, + { + matchUpdateTypes: ['patch'], + automerge: true, + }, + { + matchManagers: ['github-actions'], + automerge: true, + }, + { + // gardener/cc-utils is intentionally pinned to @v1 as a floating major + // tag — frequent updates, deliberately unpinned. Disable to avoid + // constant SHA-bump PRs. + matchManagers: ['github-actions'], + matchDepNames: ['gardener/cc-utils'], + enabled: false, + }, + ], + customManagers: [ + { + // Track the Renovate version used in the reusable workflow + customType: 'regex', + managerFilePatterns: ['.github/workflows/renovate.yml'], + matchStrings: ["renovate-version:\\s*'(?[^'@]+)(?:@(?sha256:[a-f0-9]+))?'"], + depNameTemplate: 'ghcr.io/renovatebot/renovate', + datasourceTemplate: 'docker', + }, ], - // Add org-wide defaults here, e.g.: - // labels: ['dependencies'], - // timezone: 'Europe/Berlin', - // schedule: ['at any time'], } diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 4c84d44..09a7496 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -20,7 +20,9 @@ on: # exclusively when one of its files changes. paths: - '.github/workflows/renovate.yml' + - '.github/workflows/renovate-self.yml' - '.github/workflows/renovate-schedule.yml' + - '.github/renovate-central.json5' - '.github/renovate.json5' - '.github/renovate-repositories.json' - '.release-please-manifest.json' diff --git a/.github/workflows/renovate-schedule.yml b/.github/workflows/renovate-schedule.yml index 72b4d2c..d35dfb6 100644 --- a/.github/workflows/renovate-schedule.yml +++ b/.github/workflows/renovate-schedule.yml @@ -48,6 +48,7 @@ on: branches: - main paths: + - .github/renovate-central.json5 - .github/renovate.json5 - .github/renovate-repositories.json - .github/workflows/renovate.yml diff --git a/.github/workflows/renovate-self.yml b/.github/workflows/renovate-self.yml new file mode 100644 index 0000000..74277ed --- /dev/null +++ b/.github/workflows/renovate-self.yml @@ -0,0 +1,52 @@ +name: Renovate +on: + schedule: + - cron: '0 2 * * *' # nightly at 2am UTC + push: + branches: + - main + pull_request: + branches: + - main + paths: + - .github/workflows/renovate.yml + - .github/renovate.json5 + - .github/renovate-central.json5 + workflow_dispatch: + inputs: + repoCache: + description: 'Repository cache: enabled (use + update), disabled (skip), reset (discard old, start fresh)' + type: choice + default: enabled + options: [ enabled, disabled, reset ] + ignoreSchedule: + description: 'Ignore renovate schedule settings' + type: boolean + default: false + logLevel: + description: 'Log level' + type: choice + default: info + options: [ info, debug ] + useOdgbotCredentials: + description: 'Use GitHub App credentials if configured (else: GITHUB_TOKEN)' + type: boolean + default: true + +permissions: + contents: read + +jobs: + renovate: + uses: open-component-model/.github/.github/workflows/renovate.yml@v1 + secrets: inherit + with: + repository: ${{ github.repository }} + # use in forks for testing + # centralConfig: alexbass01/open-component-model-github@v1 + repoCache: ${{ inputs.repoCache || 'enabled' }} + ignoreSchedule: ${{ github.event_name == 'workflow_dispatch' && inputs.ignoreSchedule }} + logLevel: ${{ inputs.logLevel || 'info' }} + useOdgbotCredentials: ${{ github.event_name != 'workflow_dispatch' || inputs.useOdgbotCredentials }} + # Pull requests validate the config via a read-only dry-run. + dryRun: ${{ github.event_name == 'pull_request' }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 86dd5ef..f6b4d11 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -88,8 +88,8 @@ env: # Path of the central config inside the central repository (checked out # sparse into ./central below; RENOVATE_CONFIG_FILE points there for both # validation and the renovate run itself). - central_config_file: .github/renovate.json5 - RENOVATE_CONFIG_FILE: ${{ github.workspace }}/central/.github/renovate.json5 + central_config_file: .github/renovate-central.json5 + RENOVATE_CONFIG_FILE: ${{ github.workspace }}/central/.github/renovate-central.json5 # Central config location ("owner/repo@ref"), split into CENTRAL_REPO / # CENTRAL_REF per job by the "Resolve central config location" step below — # expression contexts cannot split strings. The default tracks the floating From b9da2a43ff3cbe386a7be009143445e1d83f2d2e Mon Sep 17 00:00:00 2001 From: "Alexander Bassmanow (AlexBass01)" Date: Mon, 7 Sep 2026 12:06:07 +0200 Subject: [PATCH 2/4] no need for renovate-self Signed-off-by: Alexander Bassmanow (AlexBass01) --- .github/workflows/release-please.yml | 1 - .github/workflows/renovate-self.yml | 52 ---------------------------- 2 files changed, 53 deletions(-) delete mode 100644 .github/workflows/renovate-self.yml diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 09a7496..32cf64d 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -20,7 +20,6 @@ on: # exclusively when one of its files changes. paths: - '.github/workflows/renovate.yml' - - '.github/workflows/renovate-self.yml' - '.github/workflows/renovate-schedule.yml' - '.github/renovate-central.json5' - '.github/renovate.json5' diff --git a/.github/workflows/renovate-self.yml b/.github/workflows/renovate-self.yml deleted file mode 100644 index 74277ed..0000000 --- a/.github/workflows/renovate-self.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Renovate -on: - schedule: - - cron: '0 2 * * *' # nightly at 2am UTC - push: - branches: - - main - pull_request: - branches: - - main - paths: - - .github/workflows/renovate.yml - - .github/renovate.json5 - - .github/renovate-central.json5 - workflow_dispatch: - inputs: - repoCache: - description: 'Repository cache: enabled (use + update), disabled (skip), reset (discard old, start fresh)' - type: choice - default: enabled - options: [ enabled, disabled, reset ] - ignoreSchedule: - description: 'Ignore renovate schedule settings' - type: boolean - default: false - logLevel: - description: 'Log level' - type: choice - default: info - options: [ info, debug ] - useOdgbotCredentials: - description: 'Use GitHub App credentials if configured (else: GITHUB_TOKEN)' - type: boolean - default: true - -permissions: - contents: read - -jobs: - renovate: - uses: open-component-model/.github/.github/workflows/renovate.yml@v1 - secrets: inherit - with: - repository: ${{ github.repository }} - # use in forks for testing - # centralConfig: alexbass01/open-component-model-github@v1 - repoCache: ${{ inputs.repoCache || 'enabled' }} - ignoreSchedule: ${{ github.event_name == 'workflow_dispatch' && inputs.ignoreSchedule }} - logLevel: ${{ inputs.logLevel || 'info' }} - useOdgbotCredentials: ${{ github.event_name != 'workflow_dispatch' || inputs.useOdgbotCredentials }} - # Pull requests validate the config via a read-only dry-run. - dryRun: ${{ github.event_name == 'pull_request' }} From 344418428825f9e684f33b67ecd82a6a2794f21b Mon Sep 17 00:00:00 2001 From: "Alexander Bassmanow (AlexBass01)" Date: Mon, 7 Sep 2026 12:16:02 +0200 Subject: [PATCH 3/4] remove unused config Signed-off-by: Alexander Bassmanow (AlexBass01) --- .github/renovate.json5 | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 88ac5f4..cf9efd4 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -45,14 +45,6 @@ matchManagers: ['github-actions'], automerge: true, }, - { - // gardener/cc-utils is intentionally pinned to @v1 as a floating major - // tag — frequent updates, deliberately unpinned. Disable to avoid - // constant SHA-bump PRs. - matchManagers: ['github-actions'], - matchDepNames: ['gardener/cc-utils'], - enabled: false, - }, ], customManagers: [ { From d8de1f8d66adde4db5503551c548a73ddc76a8b2 Mon Sep 17 00:00:00 2001 From: "Alexander Bassmanow (AlexBass01)" Date: Mon, 7 Sep 2026 12:17:30 +0200 Subject: [PATCH 4/4] remove comment Signed-off-by: Alexander Bassmanow (AlexBass01) --- .github/renovate.json5 | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index cf9efd4..2996467 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -12,15 +12,6 @@ 'internalChecksFilter': 'strict', 'minimumReleaseAge': '7 days', 'branchPrefix': 'renovate/', - // Commit identity is intentionally unset: renovate runs with platformCommit - // and a GitHub App token, so GitHub sets the commit author and renovate - // auto-discovers it from the token. All fleet bots that may touch renovate - // branches are whitelisted via gitIgnoredAuthors in the central config. Add - // a repo-level gitIgnoredAuthors only if an app NOT listed centrally runs - // renovate here — it replaces (not extends) the central list, so repeat - // entries you still need. - // drip-feed PRs so the initial onboarding wave doesn't flood reviewers; - // renovate opens more as PRs get merged prConcurrentLimit: 5, prHourlyLimit: 0, automerge: false, @@ -32,7 +23,7 @@ packageRules: [ { // Majors wait as checkboxes in the dependency dashboard ("Pending - // Approval") instead of occupying prConcurrentLimit slots — tick one + // Approval") instead of occupying prConcurrentLimit slots - tick one // there to have its PR created when you're ready to work on it. matchUpdateTypes: ['major'], dependencyDashboardApproval: true,