Add self-hosted Renovate to track shellcheck/rubyfmt version pins - #6
Merged
Conversation
Dependabot's github-actions ecosystem only tracks 'uses:' references, so it can't see the shellcheck version+checksum baked into a run: step in ci.yml, or the rubyfmt version pinned in support/latest. Adds a weekly self-hosted Renovate job (avoids installing the hosted GitHub App, which would need broader org-level approval) scoped via enabledManagers to two custom regex managers covering just those two pins, so it doesn't duplicate Dependabot's existing coverage of actions/checkout and zizmor-action. Hoists the shellcheck version/checksum into the lint job's env: block (previously duplicated across two run: steps) so there's a single text location for the regex manager to match and bump. Neither custom manager recomputes checksums automatically -- there's no published checksum for Renovate to fetch for either dependency. A version-only bump PR will fail CI with a checksum mismatch, which is the intended safe failure mode; the PR body points at the manual fix (support/sync-versions.sh for rubyfmt, a manual recompute for shellcheck). Verified locally with 'renovate --platform=local --dry-run=full': both custom managers correctly extract exactly one dependency each, resolve against the real GitHub releases API, and report zero pending updates (matching that both pins are already current).
… pin Previously pinned to an arbitrary commit on rhysd/actionlint's main branch, which isn't something Renovate can sensibly track (every push to main would look like an update). Switched to the same SHA+comment convention used for actions/checkout elsewhere in this repo (commit 914e7df @ v1.7.12, the current latest release), and added a third custom regex manager using the github-tags datasource + digest tracking to keep both the SHA and the version comment in sync automatically -- unlike the shellcheck/rubyfmt pins, this needs no manual follow-up, since there's no separate checksum to refresh. Verified the only functional difference between the two script versions is a hardcoded fallback version string (used only if the script's own GitHub API call fails), and confirmed locally with 'renovate --platform=local --dry-run=full' that the new manager correctly extracts the digest+comment and resolves them against the live rhysd/actionlint tags.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #5 (stacked on that branch — merge #5 first), answering: can something detect a new
shellcheck/rubyfmtrelease and open a PR for it?Dependabot's
github-actionsecosystem only tracksuses:references (that's why it already handlesactions/checkoutandzizmor-action, seedependabot.yml). It has no visibility into theshellcheckversion+checksum baked into arun:step inci.yml, or therubyfmtversion pinned insupport/latest..github/workflows/renovate.yml, weekly) rather than installing the hosted Renovate GitHub App, since that would need broader org-level approval to grant a third-party app repo/org access..github/renovate-config.jsonscopes Renovate viaenabledManagers: ["custom.regex"]to exactly two custom regex managers — theshellcheckversion and therubyfmtversion — so it can't overlap or conflict with Dependabot's existing coverage.shellcheckversion/checksum out of two duplicatedrun:steps into thelintjob'senv:block, so there's one text location for Renovate to match and bump (previously it appeared twice).rubyfmt, runsupport/sync-versions.sh <tag>; forshellcheck, manually recompute and updateSHELLCHECK_SHA256. This is called out in the PR body Renovate generates (viapackageRules[].prBodyNotes) and in the README.Test plan
renovate-config-validator .github/renovate-config.jsonpasses.renovate --platform=local --dry-run=full(with a real GitHub token) correctly extracts exactly one dependency per custom manager, resolves both against the live GitHub releases API, and reports zero pending updates (both pins are already current).zizmorandactionlintpass on the new/changed workflow files.Renovateworkflow (workflow_dispatch) once to confirm it runs cleanly end-to-end against the real repo.