ci: add renovate workflow

.github/workflows/renovate.yml

@@ -0,0 +1,133 @@
+name: Renovate
+on:
+  issues:
+    # Dependency Dashboard
+    types: [edited]
+  pull_request_target:
+    types:
+      # rebaseLabel
+      - labeled
+      # stopUpdatingLabel
+      - unlabeled
+      # PrControls
+      - edited
+      # ignore update
+      - closed
+      # Edited/Blocked
+      - synchronize
+    branches: ["main"]
+  push:
+    branches:
+      - "main"
+      # https://docs.renovatebot.com/config-validation/#validation-of-renovate-config-change-prs
+      - "renovate/reconfigure"
+  schedule:
+    # Run every 30 minutes:
+    - cron: "0,30 * * * *"
+  # This lets you dispatch a renovate job with different cache options if you want to reset or disable the cache manually.
+  workflow_dispatch:
+    inputs:
+      repoCache:
+        description: "Reset or disable the cache?"
+        type: choice
+        default: enabled
+        options:
+          - enabled
+          - disabled
+          - reset
+
+permissions: {}
+
+# Adding these as env variables makes it easy to re-use them in different steps and in bash.
+env:
+  # This is the dir renovate provides
+  cache_dir: /tmp/renovate/cache
+  # This can be manually changed to bust the cache if neccessary.
+  cache_key: renovate-cache
+  # tool versions
+  # renovate: datasource=docker depName=renovate packageName=ghcr.io/renovatebot/renovate
+  RENOVATE_VERSION: 37.377.4
+
+jobs:
+  env:
+    runs-on: ubuntu-latest
+    outputs:
+      renovate_actor: "mazi-renovate[bot]"
+      dashboard_title: "Dependency Dashboard"
+      rebaseLabel: "rebase"
+      stopUpdatingLabel: "stop-updating"
+    steps:
+      - run: ""
+
+  renovate:
+    name: Renovate
+    needs: [env]
+    if: >-
+      ${{
+        github.actor != needs.env.outputs.renovate_actor
+        && (
+            (github.event.issue.title == needs.env.outputs.dashboard_title && github.event.issue.user.login == needs.env.outputs.renovate_actor)
+            || (
+                github.event.pull_request.user.login == needs.env.outputs.renovate_actor
+                && (
+                    (github.event.action == 'labeled' && github.event.label.name == needs.env.outputs.rebaseLabel)
+                    || (github.event.action == 'unlabeled' && github.event.label.name == needs.env.outputs.stopUpdatingLabel)
+                    || contains(fromJSON('["edited", "closed", "synchronize"]'), github.event.action)
+                )
+            )
+            || contains(fromJSON('["push", "schedule", "workflow_dispatch"]'), github.event_name)
+        )
+      }}
+    concurrency:
+      group: ${{ github.workflow }}
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: restore-cache
+        if: github.event.inputs.repoCache != 'disabled'
+        with:
+          key: ${{ env.cache_key }}
+          path: ${{ env.cache_dir }}
+
+      - run: sudo chown -R runneradmin:root /tmp/renovate/
+        continue-on-error: true
+
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@a0de6af83968303c8c955486bf9739a57d23c7f1 # v1.10.0
+        with:
+          app-id: ${{ vars.MAZI_RENOVATE_APP_ID }}
+          private-key: ${{ secrets.MAZI_RENOVATE_PRIVATE_KEY }}
+
+      - uses: renovatebot/github-action@063e0c946b9c1af35ef3450efc44114925d6e8e6 # v40.1.11
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          renovate-version: ${{ env.RENOVATE_VERSION }}
+          env-regex: "^(?:RENOVATE_\\w+|FORCE_COLOR|LOG_LEVEL)$"
+        env:
+          # This enables the cache -- if this is set, it's not necessary to add it to renovate.json.
+          RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}
+          RENOVATE_AUTODISCOVER: true
+          RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
+          RENOVATE_DEPENDENCY_DASHBOARD_FOOTER: "- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository"
+          RENOVATE_PLATFORM_COMMIT: true
+          FORCE_COLOR: 3 # chalk.supportsColor
+          LOG_LEVEL: debug
+
+      - run: tree -L 5 -h --du -F "${cache_dir}"
+
+      - name: delete old cache
+        if: github.event.inputs.repoCache != 'disabled' && github.ref_name == github.event.repository.default_branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: gh cache delete ${{ steps.restore-cache.outputs.cache-primary-key }}
+        continue-on-error: true
+
+      - uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        if: github.event.inputs.repoCache != 'disabled' && github.ref_name == github.event.repository.default_branch
+        with:
+          key: ${{ steps.restore-cache.outputs.cache-primary-key }}
+          path: ${{ env.cache_dir }}

renovate.json

@@ -4,9 +4,28 @@
     "config:best-practices",
     ":disableRateLimiting",
     ":disablePrControls",
-    "helpers:pinGitHubActionDigests"
+    "customManagers:githubActionsVersions",
+    "security:openssf-scorecard"
   ],
   "kubernetes": {
     "fileMatch": ["\\.yaml$"]
-  }
+  },
+  "packageRules": [
+    {
+      "matchDepTypes": [
+        "dependencies",
+        "require"
+      ],
+      "labels": [
+        "dependencies",
+        "semver:patch"
+      ]
+    },
+    {
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "pinDigests": false
+    }
+  ]
 }