Skip to content

Commit 2d7eabf

Browse files
zerokzerok
committed
ci: add renovate
We need a way to update the dependencies mentioned inside the Dockerfile definition. Dependabot does not support this but Renovate does, allowing to treat arbitrary strings as version identifiers. This also includes support for updating the kubectl, kustomize, and helm versions included in the Dockerfile.
1 parent d30882b commit 2d7eabf

File tree

7 files changed

+197
-111
lines changed

7 files changed

+197
-111
lines changed

‎.github/renovate-config.json5

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
{
2+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
3+
branchPrefix: "grafanarenovatebot/",
4+
customDatasources: {
5+
"kubectl": {
6+
"defaultRegistryUrlTemplate": "https://cdn.dl.k8s.io/release/stable.txt",
7+
"format": "plain",
8+
"transformTemplates": [
9+
"{\"releases\": [releases . {\"version\": $substring(version, 1)}]}",
10+
],
11+
},
12+
"helm": {
13+
"defaultRegistryUrlTemplate": "https://api.github.com/repos/helm/helm/releases",
14+
"format": "json",
15+
"transformTemplates": [
16+
"{\"releases\": [$.tag_name . {\"version\": $substring($, 1)}]}",
17+
],
18+
},
19+
"kustomize": {
20+
"defaultRegistryUrlTemplate": "https://api.github.com/repos/kubernetes-sigs/kustomize/releases",
21+
"format": "json",
22+
"transformTemplates": [
23+
"{\"releases\": [$$ [$match(tag_name, /kustomize.*/) and $not(draft) and $not(prerelease) ] . {\"version\": $substringAfter(tag_name, \"/v\")}]}",
24+
],
25+
},
26+
},
27+
28+
customManagers: [
29+
{
30+
"customType": "regex",
31+
"fileMatch": ["Dockerfile"],
32+
"matchStrings": [
33+
"ARG KUBECTL_VERSION=(?<currentValue>\\S+)",
34+
],
35+
"datasourceTemplate": "custom.kubectl",
36+
"depNameTemplate": "kubectl",
37+
},
38+
{
39+
"customType": "regex",
40+
"fileMatch": ["Dockerfile"],
41+
"matchStrings": [
42+
"ARG HELM_VERSION=(?<currentValue>\\S+)",
43+
],
44+
"datasourceTemplate": "custom.helm",
45+
"depNameTemplate": "helm",
46+
"versioningTemplate": "semver",
47+
},
48+
{
49+
"customType": "regex",
50+
"fileMatch": ["Dockerfile"],
51+
"matchStrings": [
52+
"ARG KUSTOMIZE_VERSION=(?<currentValue>\\S+)",
53+
],
54+
"datasourceTemplate": "custom.kustomize",
55+
"depNameTemplate": "kustomize",
56+
"versioningTemplate": "semver",
57+
},
58+
],
59+
dependencyDashboard: false,
60+
enabledManagers: ["custom.regex"],
61+
forkProcessing: "enabled",
62+
globalExtends: [":pinDependencies", "config:best-practices"],
63+
onboarding: false,
64+
osvVulnerabilityAlerts: true,
65+
packageRules: [
66+
{
67+
labels: ["update-major"],
68+
matchUpdateTypes: ["major"],
69+
},
70+
{
71+
labels: ["update-minor"],
72+
matchUpdateTypes: ["minor"],
73+
},
74+
{
75+
automerge: true,
76+
labels: ["automerge-patch"],
77+
matchUpdateTypes: ["patch"],
78+
},
79+
{
80+
labels: ["update-digest"],
81+
matchUpdateTypes: ["digest"],
82+
},
83+
{
84+
// Run the custom matcher on early Monday mornings (UTC)
85+
schedule: "* 0-4 * * 1",
86+
matchPackageNames: ["ghcr.io/renovatebot/renovate"],
87+
},
88+
],
89+
platformCommit: "enabled",
90+
rebaseWhen: "behind-base-branch",
91+
requireConfig: "optional",
92+
vulnerabilityAlerts: {
93+
automerge: true,
94+
enabled: true,
95+
labels: ["automerge-security-update"],
96+
},
97+
}

‎.github/workflows/acceptance-tests.yml

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -21,30 +21,11 @@ jobs:
2121
- name: Checkout
2222
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2323

24-
- name: "Determine dependency versions"
25-
id: "versions"
26-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
27-
with:
28-
script: |
29-
const helmRelease = await github.rest.repos.getLatestRelease({
30-
'owner': 'helm',
31-
'repo': 'helm',
32-
});
33-
core.setOutput('helm', helmRelease.data.tag_name);
34-
console.log('Helm version', helmRelease.data.tag_name);
35-
const kustomizeReleases = await github.rest.repos.listReleases({
36-
'owner': 'kubernetes-sigs',
37-
'repo': 'kustomize',
38-
});
39-
const kustomizeRelease = kustomizeReleases.data.filter(release => release.tag_name.startsWith('kustomize') && !release.draft && !release.prerelease).map(release => release.tag_name.split('/')[1])[0];
40-
console.log('Kustomize version', kustomizeRelease);
41-
core.setOutput('kustomize', kustomizeRelease);
42-
4324
- name: Call Dagger Function
4425
id: dagger
4526
uses: dagger/dagger-for-github@e5153f5610d82ac9f3f848f3a25ad9d696641068 # v7.0.1
4627
with:
4728
version: "0.14.0"
4829
verb: call
4930
dagger-flags: "--silent"
50-
args: "acceptance-tests --root-dir .:source-files --acceptance-tests-dir ./acceptance-tests --kustomize-version ${{ steps.versions.outputs.kustomize }} --helm-version ${{ steps.versions.outputs.helm }}"
31+
args: "acceptance-tests --root-dir .:source-files --acceptance-tests-dir ./acceptance-tests"

‎.github/workflows/docker.yml

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -36,34 +36,7 @@ env:
3636
type=semver,pattern={{version}},value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
3737
3838
jobs:
39-
determine-versions:
40-
runs-on: ubuntu-latest
41-
outputs:
42-
helm: ${{ steps.versions.outputs.helm }}
43-
kustomize: ${{ steps.versions.outputs.kustomize }}
44-
steps:
45-
- name: "Determine dependency versions"
46-
id: "versions"
47-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
48-
with:
49-
script: |
50-
const helmRelease = await github.rest.repos.getLatestRelease({
51-
'owner': 'helm',
52-
'repo': 'helm',
53-
});
54-
core.setOutput('helm', helmRelease.data.tag_name);
55-
console.log('Helm version', helmRelease.data.tag_name);
56-
const kustomizeReleases = await github.rest.repos.listReleases({
57-
'owner': 'kubernetes-sigs',
58-
'repo': 'kustomize',
59-
});
60-
const kustomizeRelease = kustomizeReleases.data.filter(release => release.tag_name.startsWith('kustomize') && !release.draft && !release.prerelease).map(release => release.tag_name.split('/')[1])[0];
61-
console.log('Kustomize version', kustomizeRelease);
62-
core.setOutput('kustomize', kustomizeRelease);
63-
6439
build:
65-
needs:
66-
- determine-versions
6740
strategy:
6841
fail-fast: false
6942
matrix:
@@ -98,9 +71,6 @@ jobs:
9871
context: .
9972
labels: ${{ steps.meta.outputs.labels }}
10073
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event_name == 'push' }}
101-
build-args: |
102-
HELM_VERSION=${{ needs.determine-versions.outputs.helm }}
103-
KUSTOMIZE_VERSION=${{ needs.determine-versions.outputs.kustomize }}
10474

10575
- name: Export digest
10676
id: digest

‎.github/workflows/renovate.yml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Renovate
2+
on:
3+
schedule:
4+
# Offset by 12 minutes to avoid busy times on the hour
5+
- cron: 12 */4 * * *
6+
7+
pull_request:
8+
paths:
9+
- .github/renovate-config.json5
10+
- .github/workflows/renovate.yml
11+
types:
12+
- edited
13+
- opened
14+
- ready_for_review
15+
- synchronize
16+
17+
push:
18+
branches:
19+
- main
20+
paths:
21+
- .github/renovate-config.json5
22+
- .github/workflows/renovate.yml
23+
24+
workflow_dispatch:
25+
inputs:
26+
dry-run:
27+
description: "Run Renovate in dry-run mode"
28+
required: false
29+
default: false
30+
type: boolean
31+
32+
jobs:
33+
renovate:
34+
permissions:
35+
contents: read
36+
id-token: write
37+
runs-on: ubuntu-latest
38+
timeout-minutes: 5
39+
40+
steps:
41+
- name: Checkout Code
42+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
43+
with:
44+
sparse-checkout: |
45+
.github/renovate-config.json5
46+
47+
- name: Retrieve renovate secrets
48+
id: get-secrets
49+
# TODO: Pin version
50+
uses: grafana/shared-workflows/actions/[email protected]
51+
with:
52+
common_secrets: |
53+
GRAFANA_RENOVATE_APP_ID=grafana-renovate-app:app-id
54+
GRAFANA_RENOVATE_PRIVATE_KEY=grafana-renovate-app:private-key
55+
56+
- name: Generate token
57+
id: generate-token
58+
uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
59+
with:
60+
app-id: ${{ env.GRAFANA_RENOVATE_APP_ID }}
61+
private-key: ${{ env.GRAFANA_RENOVATE_PRIVATE_KEY }}
62+
63+
- name: Self-hosted Renovate
64+
uses: renovatebot/github-action@936628dfbff213ab2eb95033c5e123cfcaf09ebb # v41.0.5
65+
with:
66+
configurationFile: .github/renovate-config.json5
67+
# renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
68+
renovate-version: 39.42.4@sha256:c5d718e312cdacc0746e37f13c215ff498be28c51e50efd24c070ae29f5b636a
69+
token: ${{ steps.generate-token.outputs.token }}
70+
env:
71+
LOG_LEVEL: ${{ github.event_name == 'pull_request' && 'debug' || 'info' }}
72+
# For pull requests, this means we'll get the dependencies of the PR's
73+
# branch, so you can fix/change things and see the results in the PR's
74+
# run. By default, Renovate will clone the main/default branch.
75+
RENOVATE_BASE_BRANCHES: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || null }}
76+
# Dry run if the event is pull_request, or workflow_dispatch AND the dry-run input is true
77+
RENOVATE_DRY_RUN: ${{ (github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true')) && 'full' || null }}
78+
RENOVATE_PLATFORM: github
79+
RENOVATE_REPOSITORIES: ${{ github.repository }}
80+
RENOVATE_USERNAME: GrafanaRenovateBot

‎Dockerfile

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# download kubectl
22
FROM golang:1.23.3-alpine AS kubectl
3+
ARG KUBECTL_VERSION=1.31.3
34
RUN apk add --no-cache curl
4-
RUN export VERSION=$(curl -s https://cdn.dl.k8s.io/release/stable.txt) &&\
5-
export OS=$(go env GOOS) && \
5+
RUN export OS=$(go env GOOS) && \
66
export ARCH=$(go env GOARCH) &&\
7-
curl -o /usr/local/bin/kubectl -L https://cdn.dl.k8s.io/release/${VERSION}/bin/${OS}/${ARCH}/kubectl &&\
7+
curl -o /usr/local/bin/kubectl -L https://cdn.dl.k8s.io/release/${KUBECTL_VERSION}/bin/${OS}/${ARCH}/kubectl &&\
88
chmod +x /usr/local/bin/kubectl
99

1010
# build jsonnet-bundler
@@ -19,25 +19,21 @@ RUN apk add --no-cache git make bash &&\
1919

2020
FROM golang:1.23.3-alpine AS helm
2121
WORKDIR /tmp/helm
22-
ARG HELM_VERSION
22+
ARG HELM_VERSION=3.16.3
2323
RUN apk add --no-cache jq curl
2424
RUN export OS=$(go env GOOS) && \
2525
export ARCH=$(go env GOARCH) &&\
26-
if [[ -z ${HELM_VERSION} ]]; then export HELM_VERSION=$(curl --silent "https://api.github.com/repos/helm/helm/releases" | jq -r '.[0].tag_name'); fi && \
27-
curl -SL "https://get.helm.sh/helm-${HELM_VERSION}-${OS}-${ARCH}.tar.gz" > helm.tgz && \
26+
curl -SL "https://get.helm.sh/helm-v${HELM_VERSION}-${OS}-${ARCH}.tar.gz" > helm.tgz && \
2827
tar -xvf helm.tgz --strip-components=1
2928

3029
FROM golang:1.23.3-alpine AS kustomize
3130
WORKDIR /tmp/kustomize
32-
ARG KUSTOMIZE_VERSION
31+
ARG KUSTOMIZE_VERSION=5.5.0
3332
RUN apk add --no-cache jq curl
34-
# Get the latest version of kustomize
35-
# Releases are filtered by their name since the kustomize repository exposes multiple products in the releases
3633
RUN export OS=$(go env GOOS) &&\
3734
export ARCH=$(go env GOARCH) &&\
38-
if [[ -z ${KUSTOMIZE_VERSION} ]]; then export KUSTOMIZE_VERSION=$(curl --silent "https://api.github.com/repos/kubernetes-sigs/kustomize/releases" | jq -r '[ .[] | select(.name | startswith("kustomize")) ] | .[0].tag_name | split("/")[1]'); fi && \
39-
echo "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" && \
40-
curl -SL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" > kustomize.tgz && \
35+
echo "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" && \
36+
curl -SL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" > kustomize.tgz && \
4137
tar -xvf kustomize.tgz
4238

4339
FROM golang:1.23.3 AS build

‎dagger/dagger.gen.go

Lines changed: 8 additions & 40 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)