fix(ci): Add initial config for renovate - #103
Conversation
Renovate is used to update Go dependencies to the latest version in the main branch. Currently, many dependencies are excluded because updating them would require code changes. As soon as these dependencies are updated, Renovate can start monitoring them. In addition, Renovate keeps the GitHub actions and updates the Renovate action itself. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Dominik Holler <dholler@redhat.com>
|
Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
kubevirt-prow
Bot
added
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||
| "extends": [":gitSignOff"], | ||
| "requireConfig": "ignored", | ||
| "gitAuthor": "Renovate Bot <renovate@hollyhome.ath.cx>", |
There was a problem hiding this comment.
The email can be removed, or from my perspective better adjusted to the account for RENOVATE_FORK_TOKEN
| # "Renovate Bot" as author (via gitAuthor in the config). | ||
| # | ||
| # Required repository secrets (Settings > Secrets and variables > Actions): | ||
| # RENOVATE_TOKEN - PAT from an org member (classic with |
There was a problem hiding this comment.
It should be possible to inject an API key with these permissions through GitHub Actions without tying this API key to a specific user account
There was a problem hiding this comment.
Ack, would be great, but I made a knot in my mind, but did not found a way.
The token needs permissions to create a PR to the repo.
There was a problem hiding this comment.
https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
This should help you getting started with the GITHUB_TOKEN
| # RENOVATE_TOKEN - PAT from an org member (classic with | ||
| # public_repo scope, or fine-grained with | ||
| # Pull requests R/W scoped to this repo). | ||
| # RENOVATE_FORK_TOKEN - PAT from the bot account (classic with |
There was a problem hiding this comment.
If the bot would create branches in this repo, would we even need a separate fork then?
There was a problem hiding this comment.
If RENOVATE_FORK_TOKEN is used, the fork will be in the repo of RENOVATE_TOKEN and avoid temporary branches in this repo. #88 was generated by this configuration.
There was a problem hiding this comment.
My idea was to avoid external dependencies (repos / tokens). IMO it is okay to have temporary branches in this repo (one per updated branch?).
| "golang.org/x/{/,}**", | ||
| "google.golang.org/{/,}**", | ||
| "go.opentelemetry.io/{/,}**", | ||
| "github.com/onsi/ginkgo/{/,}**", | ||
| "github.com/go-openapi/{/,}**", | ||
| "github.com/grpc-ecosystem/{/,}**", | ||
| "github.com/prometheus/procfs{/,}**", | ||
| "go.etcd.io/etcd/{/,}**", | ||
| "k8s.io/{/,}**", | ||
| "kubevirt.io/{/,}**", | ||
| "sigs.k8s.io/{/,}**", | ||
| "github.com/openshift/{/,}**", | ||
| "github.com/prometheus-operator/{/,}**" |
There was a problem hiding this comment.
It should be OK to automatically update most of these? Perhaps exclude only k8s.io and sigs.k8s.io.
There was a problem hiding this comment.
Right now the next upate seems to require application code changes.
If they are updated manually before merging this PR, this would make sense.
| "description": "Disable openshift/api updates as they may require code changes", | ||
| "enabled": false, | ||
| "matchPackageNames": [ | ||
| "github.com/openshift/api" |
There was a problem hiding this comment.
Move this to exclude block below?
There was a problem hiding this comment.
makes sense, would require verification. I will do it after we have an idea about the tokens.
3 participants
What this PR does / why we need it:
Renovate is used to update Go dependencies to the latest version in the main branch. Currently, many dependencies are excluded because updating them would require code changes.
As soon as these dependencies are updated, Renovate can start monitoring them.
In addition, Renovate keeps the GitHub actions and updates the Renovate action itself.
There is an example run in https://github.com/tmp-kv-mirror/virt-template/actions/runs/28255231964/job/83716489678