Skip to content

Commit 3c9a48d

Browse files
zerokzerok
authored
ci: add renovate (#1262)
We need a way to update the dependencies mentioned inside the Dockerfile definition. Dependabot does not support this but Renovate does, allowing to treat arbitrary strings as version identifiers. This also includes support for updating the kubectl, kustomize, and helm versions included in the Dockerfile.
1 parent d30882b commit 3c9a48d

File tree

8 files changed

+197
-112
lines changed

8 files changed

+197
-112
lines changed

‎.github/renovate-config.json5

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
{
2+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
3+
branchPrefix: "grafanarenovatebot/",
4+
customDatasources: {
5+
"kubectl": {
6+
"defaultRegistryUrlTemplate": "https://cdn.dl.k8s.io/release/stable.txt",
7+
"format": "plain",
8+
"transformTemplates": [
9+
"{\"releases\": [releases . {\"version\": $substring(version, 1)}]}",
10+
],
11+
},
12+
"helm": {
13+
"defaultRegistryUrlTemplate": "https://api.github.com/repos/helm/helm/releases",
14+
"format": "json",
15+
"transformTemplates": [
16+
"{\"releases\": [$.tag_name . {\"version\": $substring($, 1)}]}",
17+
],
18+
},
19+
"kustomize": {
20+
"defaultRegistryUrlTemplate": "https://api.github.com/repos/kubernetes-sigs/kustomize/releases",
21+
"format": "json",
22+
"transformTemplates": [
23+
"{\"releases\": [$$ [$match(tag_name, /kustomize.*/) and $not(draft) and $not(prerelease) ] . {\"version\": $substringAfter(tag_name, \"/v\")}]}",
24+
],
25+
},
26+
},
27+
28+
customManagers: [
29+
{
30+
"customType": "regex",
31+
"fileMatch": ["Dockerfile"],
32+
"matchStrings": [
33+
"ARG KUBECTL_VERSION=(?<currentValue>\\S+)",
34+
],
35+
"datasourceTemplate": "custom.kubectl",
36+
"depNameTemplate": "kubectl",
37+
},
38+
{
39+
"customType": "regex",
40+
"fileMatch": ["Dockerfile"],
41+
"matchStrings": [
42+
"ARG HELM_VERSION=(?<currentValue>\\S+)",
43+
],
44+
"datasourceTemplate": "custom.helm",
45+
"depNameTemplate": "helm",
46+
"versioningTemplate": "semver",
47+
},
48+
{
49+
"customType": "regex",
50+
"fileMatch": ["Dockerfile"],
51+
"matchStrings": [
52+
"ARG KUSTOMIZE_VERSION=(?<currentValue>\\S+)",
53+
],
54+
"datasourceTemplate": "custom.kustomize",
55+
"depNameTemplate": "kustomize",
56+
"versioningTemplate": "semver",
57+
},
58+
],
59+
dependencyDashboard: false,
60+
enabledManagers: ["custom.regex"],
61+
forkProcessing: "enabled",
62+
globalExtends: [":pinDependencies", "config:best-practices"],
63+
onboarding: false,
64+
osvVulnerabilityAlerts: true,
65+
packageRules: [
66+
{
67+
labels: ["update-major"],
68+
matchUpdateTypes: ["major"],
69+
},
70+
{
71+
labels: ["update-minor"],
72+
matchUpdateTypes: ["minor"],
73+
},
74+
{
75+
automerge: true,
76+
labels: ["automerge-patch"],
77+
matchUpdateTypes: ["patch"],
78+
},
79+
{
80+
labels: ["update-digest"],
81+
matchUpdateTypes: ["digest"],
82+
},
83+
{
84+
// Run the custom matcher on early Monday mornings (UTC)
85+
schedule: "* 0-4 * * 1",
86+
matchPackageNames: ["ghcr.io/renovatebot/renovate"],
87+
},
88+
],
89+
platformCommit: "enabled",
90+
rebaseWhen: "behind-base-branch",
91+
requireConfig: "optional",
92+
vulnerabilityAlerts: {
93+
automerge: true,
94+
enabled: true,
95+
labels: ["automerge-security-update"],
96+
},
97+
}

‎.github/workflows/acceptance-tests.yml

+1-20
Original file line numberDiff line numberDiff line change
@@ -21,30 +21,11 @@ jobs:
2121
- name: Checkout
2222
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2323

24-
- name: "Determine dependency versions"
25-
id: "versions"
26-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
27-
with:
28-
script: |
29-
const helmRelease = await github.rest.repos.getLatestRelease({
30-
'owner': 'helm',
31-
'repo': 'helm',
32-
});
33-
core.setOutput('helm', helmRelease.data.tag_name);
34-
console.log('Helm version', helmRelease.data.tag_name);
35-
const kustomizeReleases = await github.rest.repos.listReleases({
36-
'owner': 'kubernetes-sigs',
37-
'repo': 'kustomize',
38-
});
39-
const kustomizeRelease = kustomizeReleases.data.filter(release => release.tag_name.startsWith('kustomize') && !release.draft && !release.prerelease).map(release => release.tag_name.split('/')[1])[0];
40-
console.log('Kustomize version', kustomizeRelease);
41-
core.setOutput('kustomize', kustomizeRelease);
42-
4324
- name: Call Dagger Function
4425
id: dagger
4526
uses: dagger/dagger-for-github@e5153f5610d82ac9f3f848f3a25ad9d696641068 # v7.0.1
4627
with:
4728
version: "0.14.0"
4829
verb: call
4930
dagger-flags: "--silent"
50-
args: "acceptance-tests --root-dir .:source-files --acceptance-tests-dir ./acceptance-tests --kustomize-version ${{ steps.versions.outputs.kustomize }} --helm-version ${{ steps.versions.outputs.helm }}"
31+
args: "acceptance-tests --root-dir .:source-files --acceptance-tests-dir ./acceptance-tests"

‎.github/workflows/docker.yml

-30
Original file line numberDiff line numberDiff line change
@@ -36,34 +36,7 @@ env:
3636
type=semver,pattern={{version}},value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
3737
3838
jobs:
39-
determine-versions:
40-
runs-on: ubuntu-latest
41-
outputs:
42-
helm: ${{ steps.versions.outputs.helm }}
43-
kustomize: ${{ steps.versions.outputs.kustomize }}
44-
steps:
45-
- name: "Determine dependency versions"
46-
id: "versions"
47-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
48-
with:
49-
script: |
50-
const helmRelease = await github.rest.repos.getLatestRelease({
51-
'owner': 'helm',
52-
'repo': 'helm',
53-
});
54-
core.setOutput('helm', helmRelease.data.tag_name);
55-
console.log('Helm version', helmRelease.data.tag_name);
56-
const kustomizeReleases = await github.rest.repos.listReleases({
57-
'owner': 'kubernetes-sigs',
58-
'repo': 'kustomize',
59-
});
60-
const kustomizeRelease = kustomizeReleases.data.filter(release => release.tag_name.startsWith('kustomize') && !release.draft && !release.prerelease).map(release => release.tag_name.split('/')[1])[0];
61-
console.log('Kustomize version', kustomizeRelease);
62-
core.setOutput('kustomize', kustomizeRelease);
63-
6439
build:
65-
needs:
66-
- determine-versions
6740
strategy:
6841
fail-fast: false
6942
matrix:
@@ -98,9 +71,6 @@ jobs:
9871
context: .
9972
labels: ${{ steps.meta.outputs.labels }}
10073
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event_name == 'push' }}
101-
build-args: |
102-
HELM_VERSION=${{ needs.determine-versions.outputs.helm }}
103-
KUSTOMIZE_VERSION=${{ needs.determine-versions.outputs.kustomize }}
10474

10575
- name: Export digest
10676
id: digest

‎.github/workflows/renovate.yml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Renovate
2+
on:
3+
schedule:
4+
# Offset by 12 minutes to avoid busy times on the hour
5+
- cron: 12 */4 * * *
6+
7+
pull_request:
8+
paths:
9+
- .github/renovate-config.json5
10+
- .github/workflows/renovate.yml
11+
types:
12+
- edited
13+
- opened
14+
- ready_for_review
15+
- synchronize
16+
17+
push:
18+
branches:
19+
- main
20+
paths:
21+
- .github/renovate-config.json5
22+
- .github/workflows/renovate.yml
23+
24+
workflow_dispatch:
25+
inputs:
26+
dry-run:
27+
description: "Run Renovate in dry-run mode"
28+
required: false
29+
default: false
30+
type: boolean
31+
32+
jobs:
33+
renovate:
34+
permissions:
35+
contents: read
36+
id-token: write
37+
runs-on: ubuntu-latest
38+
timeout-minutes: 5
39+
40+
steps:
41+
- name: Checkout Code
42+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
43+
with:
44+
sparse-checkout: |
45+
.github/renovate-config.json5
46+
47+
- name: Retrieve renovate secrets
48+
id: get-secrets
49+
uses: grafana/shared-workflows/actions/get-vault-secrets@97c6f45f01d4bca8a3b1acfe397113ce88858a81 # get-vault-secrets-v1.0.1
50+
with:
51+
common_secrets: |
52+
GRAFANA_RENOVATE_APP_ID=grafana-renovate-app:app-id
53+
GRAFANA_RENOVATE_PRIVATE_KEY=grafana-renovate-app:private-key
54+
55+
- name: Generate token
56+
id: generate-token
57+
uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
58+
with:
59+
app-id: ${{ env.GRAFANA_RENOVATE_APP_ID }}
60+
private-key: ${{ env.GRAFANA_RENOVATE_PRIVATE_KEY }}
61+
62+
- name: Self-hosted Renovate
63+
uses: renovatebot/github-action@936628dfbff213ab2eb95033c5e123cfcaf09ebb # v41.0.5
64+
with:
65+
configurationFile: .github/renovate-config.json5
66+
# renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
67+
renovate-version: 39.42.4@sha256:c5d718e312cdacc0746e37f13c215ff498be28c51e50efd24c070ae29f5b636a
68+
token: ${{ steps.generate-token.outputs.token }}
69+
env:
70+
LOG_LEVEL: ${{ github.event_name == 'pull_request' && 'debug' || 'info' }}
71+
# For pull requests, this means we'll get the dependencies of the PR's
72+
# branch, so you can fix/change things and see the results in the PR's
73+
# run. By default, Renovate will clone the main/default branch.
74+
RENOVATE_BASE_BRANCHES: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || null }}
75+
# Dry run if the event is pull_request, or workflow_dispatch AND the dry-run input is true
76+
RENOVATE_DRY_RUN: ${{ (github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true')) && 'full' || null }}
77+
RENOVATE_PLATFORM: github
78+
RENOVATE_REPOSITORIES: ${{ github.repository }}
79+
RENOVATE_USERNAME: GrafanaRenovateBot

‎Dockerfile

+8-12
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# download kubectl
22
FROM golang:1.23.3-alpine AS kubectl
3+
ARG KUBECTL_VERSION=1.31.3
34
RUN apk add --no-cache curl
4-
RUN export VERSION=$(curl -s https://cdn.dl.k8s.io/release/stable.txt) &&\
5-
export OS=$(go env GOOS) && \
5+
RUN export OS=$(go env GOOS) && \
66
export ARCH=$(go env GOARCH) &&\
7-
curl -o /usr/local/bin/kubectl -L https://cdn.dl.k8s.io/release/${VERSION}/bin/${OS}/${ARCH}/kubectl &&\
7+
curl -o /usr/local/bin/kubectl -L https://cdn.dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${OS}/${ARCH}/kubectl &&\
88
chmod +x /usr/local/bin/kubectl
99

1010
# build jsonnet-bundler
@@ -19,25 +19,21 @@ RUN apk add --no-cache git make bash &&\
1919

2020
FROM golang:1.23.3-alpine AS helm
2121
WORKDIR /tmp/helm
22-
ARG HELM_VERSION
22+
ARG HELM_VERSION=3.16.3
2323
RUN apk add --no-cache jq curl
2424
RUN export OS=$(go env GOOS) && \
2525
export ARCH=$(go env GOARCH) &&\
26-
if [[ -z ${HELM_VERSION} ]]; then export HELM_VERSION=$(curl --silent "https://api.github.com/repos/helm/helm/releases" | jq -r '.[0].tag_name'); fi && \
27-
curl -SL "https://get.helm.sh/helm-${HELM_VERSION}-${OS}-${ARCH}.tar.gz" > helm.tgz && \
26+
curl -SL "https://get.helm.sh/helm-v${HELM_VERSION}-${OS}-${ARCH}.tar.gz" > helm.tgz && \
2827
tar -xvf helm.tgz --strip-components=1
2928

3029
FROM golang:1.23.3-alpine AS kustomize
3130
WORKDIR /tmp/kustomize
32-
ARG KUSTOMIZE_VERSION
31+
ARG KUSTOMIZE_VERSION=5.5.0
3332
RUN apk add --no-cache jq curl
34-
# Get the latest version of kustomize
35-
# Releases are filtered by their name since the kustomize repository exposes multiple products in the releases
3633
RUN export OS=$(go env GOOS) &&\
3734
export ARCH=$(go env GOARCH) &&\
38-
if [[ -z ${KUSTOMIZE_VERSION} ]]; then export KUSTOMIZE_VERSION=$(curl --silent "https://api.github.com/repos/kubernetes-sigs/kustomize/releases" | jq -r '[ .[] | select(.name | startswith("kustomize")) ] | .[0].tag_name | split("/")[1]'); fi && \
39-
echo "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" && \
40-
curl -SL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" > kustomize.tgz && \
35+
echo "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" && \
36+
curl -SL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_${OS}_${ARCH}.tar.gz" > kustomize.tgz && \
4137
tar -xvf kustomize.tgz
4238

4339
FROM golang:1.23.3 AS build

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ test:
1616
go test ./... -bench=. -benchmem
1717

1818
acceptance-tests:
19-
dagger call acceptance-tests --root-dir .:source-files --acceptance-tests-dir ./acceptance-tests --kustomize-version "" --helm-version ""
19+
dagger call acceptance-tests --root-dir .:source-files --acceptance-tests-dir ./acceptance-tests
2020

2121
# Compilation
2222
dev:

‎dagger/dagger.gen.go

+8-40
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)