From 1eb7e7e3da36835c83c0debc4e58cd739a494171 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Thu, 15 Oct 2026 11:40:41 +0200 Subject: [PATCH] Use public Renovate approval action directly --- .github/workflows/auto-approve-bot-prs.yml | 22 ++-------------------- .github/workflows/renovate.yml | 4 +--- README.md | 5 ++--- renovate.json | 4 ++-- 4 files changed, 7 insertions(+), 28 deletions(-) diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml index 33f17a5..24a6395 100644 --- a/.github/workflows/auto-approve-bot-prs.yml +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -12,33 +12,15 @@ concurrency: jobs: approve: - if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' && vars.RENOVATE_GH_APP_CLIENT_ID != '' + if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' runs-on: ubuntu-latest timeout-minutes: 5 permissions: contents: read pull-requests: read steps: - - name: Create read-only token for the shared approval action - id: policy-token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 - with: - client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }} - private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: renovate-config - permission-contents: read - - name: Checkout the pinned shared approval action - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - repository: StackVista/renovate-config - ref: 45d01defd5070a9c05f0b3bf9b28995487bd8262 - token: ${{ steps.policy-token.outputs.token }} - path: renovate-config - sparse-checkout: .github/actions/auto-approve-renovate - persist-credentials: false - name: Approve verified Renovate PRs - uses: ./renovate-config/.github/actions/auto-approve-renovate # zizmor: ignore[self-repository] + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@45d01defd5070a9c05f0b3bf9b28995487bd8262 with: app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index bedbd55..d24b43c 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -29,9 +29,7 @@ jobs: client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }} private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} - repositories: | - stackstate-backup-cli - renovate-config + repositories: stackstate-backup-cli permission-contents: write permission-pull-requests: write permission-issues: write diff --git a/README.md b/README.md index f482ae0..da41787 100644 --- a/README.md +++ b/README.md @@ -468,14 +468,13 @@ The library group includes direct and indirect modules. Other module minors, module majors, and Go release-line migrations require manual review. Dependency updates reach published binaries through the existing tag release process. -This public repository runs Renovate locally because GitHub restricts private reusable workflows and actions to private callers. -The approval workflow fetches the pinned shared action with a read-only updater App token. +The approval workflow calls the pinned public `renovate-config` action directly. The separate approval App supplies the review token. The updater App needs Contents, Pull requests, Issues, and Workflows write permissions, plus Checks and Commit statuses read permissions. Before merging the Renovate workflows: -1. Grant `renovate-update-app` access to this repository and `renovate-config`. +1. Grant `renovate-update-app` access to this repository. 2. Install `renovatee-approver-stackvista` on this repository. 3. Apply the `pulumi-infra/github/repoVariables` changes that supply both Apps' credentials. 4. Check that the live branch protection requires all five CI checks listed in `pulumi-infra/github/repositories/resources.yaml`. diff --git a/renovate.json b/renovate.json index ffd2080..62006ae 100644 --- a/renovate.json +++ b/renovate.json @@ -1,8 +1,8 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "local>StackVista/renovate-config", - "local>StackVista/renovate-config:go" + "github>StackVista/renovate-config", + "github>StackVista/renovate-config:go" ], "prConcurrentLimit": 0, "prHourlyLimit": 0,