Skip to content

Renovate Runner

We use Renovate to automatically open merge requests on our GitLab-based repositories when a dependency is out of date. Due to limitations within GitLab's security model, we have to create our own copy of the upstream renovate-runner repository. This copy runs once per day and scans our GitLab repositories for any that have a renovate.json or renovate.json5 file, and creates relevant merge requests against them.

Our copy of the runner is set up to run once daily and will create up to two merge requests against an onboarded repository each day (unless manually triggered for additional runs). Note that our copy is only available to OpenCraft team members, and is NOT a fork of the runner repository, but an independently cloned and pushed version. This is by recommendation of the renovate-runner bot developers.

Shared Configuration

OpenCraft maintains a shared Renovate configuration in the renovate-config repository. It centralizes the presets applied across all of our repositories so that dependency updates are handled consistently. The config is based on the Renovate config:recommended preset.

Repositories reference it by extending the gitlab>opencraft/dev/renovate-config preset (see Renovate's preset documentation).

Enabling Renovate Updates for Your Repository

To enable Renovate for one of our GitLab-based repositories, you must:

  1. Ensure that the repository is under the OpenCraft namespace on GitLab
  2. Add a renovate.json5 file to the repository.
  3. Make sure the @opencraft-renovate user has a Developer role in your repository (this should already be the case, as the bot is a member of our opencraft/core group).

That's it. The recommended renovate.json5 file contents are:

1
2
3
4
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["gitlab>opencraft/dev/renovate-config"],
}

Expect to get several merge requests over the next few days. They will slow down to a dribble once the repository is fully up to date.

Manually Triggering the Renovate Bot

You can also forcibly run the renovate bot to generate new merge requests (and test that your renovate.json5 file was recognized) by going to the Pipeline Schedules for the runner and triggering a run.

Making Changes to the Shared Config

The shared config lives in the renovate-config repository. Since all onboarded repositories extend it, changes there apply to every repository that uses it. To propose a change, create a merge request against renovate-config.