Skip to content

Add Renovate workflow for Docker base image updates #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChengYanJin merged 1 commit into from
May 4, 2026
Merged

Add Renovate workflow for Docker base image updates #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions .github/workflows/renovate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
name: Renovate

Copilot AI Apr 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow file is named renovate.yaml, but the existing workflows in this repo use the .yml extension (e.g., docker.yml, release.yml, tests.yml). Consider renaming this to renovate.yml for consistency and easier discovery/grep across workflows.

Copilot uses AI. Check for mistakes.
on:
schedule:
- cron: "0 8 * * 1-5" # Weekdays at 8am UTC
workflow_dispatch: # Allow manual trigger

jobs:
renovate:
runs-on: ubuntu-latest
permissions: {}
steps:
- name: Generate app token
id: app-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.ACTIONS_APP_ID }}
private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}

- name: Checkout
uses: actions/checkout@v6

Copilot AI Apr 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v6 is inconsistent with the rest of the repo’s workflows (which use actions/checkout@v4) and may not be available depending on the Actions release stream. Align this to the same major used elsewhere (or pin to the project’s standard) to avoid workflow failures.

Suggested change
uses: actions/checkout@v6
uses: actions/checkout@v4

Copilot uses AI. Check for mistakes.
with:
token: ${{ steps.app-token.outputs.token }}

- name: Run Renovate
uses: renovatebot/github-action@v46.1.9
with:
configurationFile: renovate.json
token: ${{ steps.app-token.outputs.token }}
env:
RENOVATE_REPOSITORIES: ${{ github.repository }}

- name: Auto-approve Renovate PRs
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh pr list --repo ${{ github.repository }} --state open --json number,headRefName --jq '.[] | select(.headRefName | startswith("improvement/renovate-")) | .number' | while read -r pr; do

Copilot AI Apr 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This auto-approval logic selects PRs purely by branch prefix, so it will also “approve” Renovate major updates even though the Renovate config distinguishes major updates (adds a major label). If the intent is to only auto-approve safer updates, filter by update type/labels (e.g., only approve when the PR does not have the major label, or only when it has an allowlisted label set).

Suggested change
gh pr list --repo ${{ github.repository }} --state open --json number,headRefName --jq '.[] | select(.headRefName | startswith("improvement/renovate-")) | .number' | while read -r pr; do
gh pr list --repo ${{ github.repository }} --state open --json number,headRefName,labels --jq '.[] | select((.headRefName | startswith("improvement/renovate-")) and ((.labels | map(.name) | index("major")) == null)) | .number' | while read -r pr; do

Copilot uses AI. Check for mistakes.
if ! gh pr view "$pr" --repo ${{ github.repository }} --json comments --jq '.comments[].body' | grep -q '^/approve$'; then
gh pr comment "$pr" --repo ${{ github.repository }} --body '/approve'
echo "Approved PR #$pr"
else
echo "PR #$pr already approved, skipping"
Comment on lines +38 to +42

Copilot AI Apr 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The “Auto-approve Renovate PRs” step doesn’t actually approve PRs in GitHub; it only posts a /approve comment and then logs “Approved PR”. Unless you have an external bot that converts /approve comments into reviews, this won’t satisfy branch protection that requires an approving review. Consider using an actual review approval mechanism (e.g., gh pr review --approve with a token that has pull_requests: write) or rename the step/output to reflect what it really does.

Suggested change
if ! gh pr view "$pr" --repo ${{ github.repository }} --json comments --jq '.comments[].body' | grep -q '^/approve$'; then
gh pr comment "$pr" --repo ${{ github.repository }} --body '/approve'
echo "Approved PR #$pr"
else
echo "PR #$pr already approved, skipping"
if ! gh pr view "$pr" --repo ${{ github.repository }} --json reviews --jq '.reviews[].state' | grep -q '^APPROVED$'; then
gh pr review "$pr" --repo ${{ github.repository }} --approve
echo "Approved PR #$pr"
else
echo "PR #$pr already has an approving review, skipping"

Copilot uses AI. Check for mistakes.
fi
done
18 changes: 18 additions & 0 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended"],
"enabledManagers": ["dockerfile"],
"branchPrefix": "improvement/renovate-",
"packageRules": [
{
"matchManagers": ["dockerfile"],
"matchUpdateTypes": ["minor", "patch"],
"addLabels": ["dependencies", "docker", "renovate"]
},
{
"matchManagers": ["dockerfile"],
"matchUpdateTypes": ["major"],
"addLabels": ["dependencies", "docker", "major", "renovate"]
}
]
}
Loading