chore: restore self-hosted Renovate workflow#214
Open
vredchenko wants to merge 1 commit into
Open
Conversation
The org-wide Mend.io Renovate GitHub App has not been reliably processing this repo since late April. Restore the self-hosted workflow originally added in the Dependabot -> Renovate migration and dropped in smartem-devtools#182. Schedule is twice daily plus workflow_dispatch; renovate.json is unchanged and continues to drive configuration via the shared preset. Requires RENOVATE_TOKEN secret to be set.
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restores the self-hosted Renovate workflow that was dropped in smartem-devtools#182 on 2026-03-25 in favour of the org-wide Mend.io Renovate GitHub App. The app has not been reliably processing this repo since then — visible in git log as a sequence of manually-authored
chore(deps)andsecurity:CVE bumps over the past month (mako, urllib3, idna, starlette on smartem-decisions; equivalent gaps elsewhere) that Renovate should have automated.What this changes
Adds
.github/workflows/renovate.yml:04:00and16:00UTC) plusworkflow_dispatchfor ad-hoc runs.renovatebot/github-action@v46.1.14(latest as of 2026-05-11) — Renovate itself will bump it.permissionsblock covers whatGITHUB_TOKENneeds for checkout and the action's bookkeeping; the actual Renovate identity and write permissions come fromRENOVATE_TOKEN.renovate.json(no config changes needed).What does NOT change
renovate.jsonand the sharedrenovate/default.jsonpreset are untouched — both validate cleanly viarenovate-config-validator.Required before merge
Repo admin must add a
RENOVATE_TOKENsecret (fine-grained PAT withcontents: write,pull-requests: write,issues: write,workflows: write,metadata: readon this repo). Without it the workflow will run but Renovate will exit immediately complaining about an empty token.Test plan
RENOVATE_TOKENsecret added.Why per-repo and not autodiscovery
Per-repo workflow keeps the Renovate orchestration footprint inside each repo — no cross-repo token scope, no single workflow whose failure stops dep updates everywhere. Aligned with the workspace's preference for vendor-independent, locally-controlled tooling.