Update dependencies #1397
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Centralized Renovate workflow | |
| # | |
| # Reusable workflow that runs Renovate with a centrally pinned version. | |
| # The Renovate version is defined in /package.json and managed by Renovate itself. | |
| # | |
| # Uses OIDC token to resolve the correct checkout ref for the package.json. | |
| # | |
| # TODO: Replace OIDC workaround with $/ syntax once available | |
| # see: https://github.com/orgs/community/discussions/26245#discussioncomment-15601440 | |
| name: Update dependencies | |
| on: | |
| pull_request: | |
| paths: | |
| - ".github/workflows/housekeeping-dependencies.yml" | |
| - "package.json" | |
| schedule: | |
| - cron: "0 */2 * * *" | |
| workflow_dispatch: | |
| inputs: | |
| repoCache: | |
| description: "Reset or disable the cache?" | |
| type: choice | |
| default: enabled | |
| options: | |
| - enabled | |
| - disabled | |
| - reset | |
| logLevel: | |
| description: "Override default log level" | |
| type: choice | |
| default: info | |
| options: | |
| - "debug" | |
| - "info" | |
| - "warn" | |
| - "error" | |
| overrideSchedule: | |
| description: "Override all schedules" | |
| type: boolean | |
| default: false | |
| dryRun: | |
| description: "Dry run mode" | |
| type: choice | |
| default: disabled | |
| options: | |
| - disabled | |
| - extract | |
| - lookup | |
| - full | |
| workflow_call: | |
| inputs: | |
| repoCache: | |
| description: "Reset or disable the cache?" | |
| type: string | |
| default: enabled | |
| logLevel: | |
| description: "Override default log level" | |
| type: string | |
| default: info | |
| overrideSchedule: | |
| description: "Override all schedules" | |
| type: boolean | |
| default: false | |
| dryRun: | |
| description: "Dry run mode" | |
| type: string | |
| default: disabled | |
| permissions: | |
| actions: read | |
| contents: write | |
| id-token: write | |
| jobs: | |
| renovate: | |
| name: Renovate | |
| runs-on: ubuntu-24.04 | |
| concurrency: | |
| cancel-in-progress: false | |
| group: renovate | |
| env: | |
| is_pr: ${{ github.event_name == 'pull_request' }} | |
| dry_run: ${{ github.event_name == 'pull_request' && 'extract' || inputs.dryRun || 'disabled' }} | |
| repo_cache: ${{ inputs.repoCache || 'enabled' }} | |
| steps: | |
| - name: Resolve reusable workflow ref | |
| id: workflow-ref | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| with: | |
| script: | | |
| const token = await core.getIDToken(); | |
| const [, payload] = token.split('.'); | |
| const { job_workflow_ref } = JSON.parse(Buffer.from(payload, 'base64url')); | |
| const ref = job_workflow_ref.split('@')[1]; | |
| core.setOutput('ref', ref); | |
| - name: Checkout .github repo for Renovate version | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: hashintel/.github | |
| ref: ${{ steps.workflow-ref.outputs.ref }} | |
| sparse-checkout: package.json | |
| - name: Read Renovate version | |
| id: renovate-version | |
| run: | | |
| version=$(jq -r '.devDependencies.renovate' package.json) | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| echo "Renovate version: $version" | |
| - name: Authenticate Vault | |
| id: secrets | |
| uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4 | |
| with: | |
| url: ${{ vars.VAULT_ADDR }} | |
| method: jwt | |
| role: dev | |
| secrets: | | |
| automation/data/pipelines/hash/dev github_worker_app_id | GITHUB_WORKER_APP_ID ; | |
| automation/data/pipelines/hash/dev github_worker_app_private_key | GITHUB_WORKER_APP_PRIVATE_KEY ; | |
| - name: Get token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ steps.secrets.outputs.GITHUB_WORKER_APP_ID }} | |
| private-key: ${{ steps.secrets.outputs.GITHUB_WORKER_APP_PRIVATE_KEY }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| - name: Install Renovate | |
| run: npm install --global "renovate@${{ steps.renovate-version.outputs.version }}" | |
| - name: Download renovate cache | |
| uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21 | |
| if: env.is_pr != 'true' && env.repo_cache != 'disabled' | |
| continue-on-error: true | |
| with: | |
| name: renovate-cache | |
| path: cache-download | |
| - name: Extract renovate cache | |
| if: env.is_pr != 'true' && env.repo_cache != 'disabled' | |
| run: | | |
| if [ ! -d cache-download ]; then | |
| echo "No cache found." | |
| exit 0 | |
| fi | |
| mkdir -p /tmp/renovate/cache/renovate/repository | |
| tar -xzf cache-download/renovate_cache.tar.gz -C /tmp/renovate/cache/renovate/repository | |
| - name: Run Renovate | |
| env: | |
| LOG_LEVEL: ${{ inputs.logLevel || 'info' }} | |
| RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }} | |
| RENOVATE_FORCE: ${{ inputs.overrideSchedule && '{"schedule":null}' || '' }} | |
| RENOVATE_DRY_RUN: ${{ env.dry_run == 'disabled' && 'null' || env.dry_run }} | |
| RENOVATE_PLATFORM_COMMIT: enabled | |
| RENOVATE_REPOSITORIES: ${{ github.repository }} | |
| RENOVATE_REPOSITORY_CACHE: ${{ env.repo_cache }} | |
| run: renovate | |
| - name: Compress renovate cache | |
| if: env.is_pr != 'true' && env.dry_run == 'disabled' && env.repo_cache != 'disabled' | |
| run: tar -czvf renovate_cache.tar.gz -C /tmp/renovate/cache/renovate/repository . | |
| - name: Upload renovate cache | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: env.is_pr != 'true' && env.dry_run == 'disabled' && env.repo_cache != 'disabled' | |
| with: | |
| name: renovate-cache | |
| path: renovate_cache.tar.gz | |
| retention-days: 1 |