Skip to content

Update application dependencies with Renovate

This guide shows how to let Renovate open pull requests for the dependencies of your application, such as libraries, Docker images, and GitHub Actions.

It works for both application repositories and hybrid repositories. The renovate.json5 from the CI/CD guides limits Renovate to Golden Path templates and GitHub Actions. This guide removes that limit. In a hybrid repository, Renovate then also updates the Terraform providers and modules.

/golden-path:renovate-onboard Turn on Renovate for every dependency, and stop Dependabot from opening the same updates.
/golden-path:renovate-triage Read the Dependency Dashboard and suggest which updates to merge first.
/golden-path:renovate-review Explain what a Renovate pull request changes, and whether it's safe to merge.

Step 1: Add your repository to the Renovate GitHub App

Ask Team Utviklerflyt in the #utviklerflyt-support Slack channel to add your repository to the kjoremiljo-renovate GitHub App.

Hei! Kan dere legge til repoet `oslokommune/<repository>` i GitHub-appen `kjoremiljo-renovate`?

Why the app matters

Renovate runs from a workflow in golden-path-renovate. Every hour on weekdays, the workflow runs Renovate one time for each repository that the app is installed on. If the app isn't installed on your repository, Renovate never runs there, whatever the configuration says.

Step 2: Add the configuration

Set up Renovate to open pull requests for all the dependencies of this application. Follow `{page}`, starting from Step 2. Step 1 is done.

Create renovate.json5 in the root of the repository, or change the one you have:

renovate.json5
{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  extends: [
    "github>oslokommune/golden-path-renovate:default.json5", // (1)!
    "github>oslokommune/golden-path-renovate:golden-path-v2.json5", // (2)!
  ],
}
  1. The shared settings. Renovate updates every dependency it finds, on weekdays, and waits 7 days after a third-party release. It keeps at most 10 pull requests open.
  2. The rules for Golden Path templates. If your file has only-golden-path-v2.json5 here, replace it with this line. The only- preset turns off every update except Golden Path templates and GitHub Actions.

Expect up to 10 pull requests at a time

Renovate opens a pull request for each dependency that has a newer version. When you merge or close one, it opens the next. To choose which ones it opens first, use the Dependency Dashboard issue.

Dependabot and Renovate both open a pull request for the same update when they cover the same dependencies. To prevent that, remove those ecosystems from .github/dependabot.yml.

Step 3: Verify

  1. Open the Renovate workflow.
  2. Select Run workflow, enter the name of your repository, and start the run. You can also wait for the next hourly run.
  3. Check your repository when the run finishes. The Dependency Dashboard issue lists the dependencies that Renovate found, and new pull requests come from branches that start with ok-renovate/.

If the run has no job for your repository, the app isn't installed on it. Go back to step 1.

Next steps

To let Renovate merge some of these updates on its own, see Automatically merge dependency updates with Renovate.