> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Update application dependencies with Renovate

This guide shows how to let [Renovate](<https://km.oslo.systems/terraform-automation/renovate/index.md>) open pull requests for the dependencies of your application, such as libraries, Docker images, and GitHub Actions.

It works for both [application repositories and hybrid repositories](<https://km.oslo.systems/terraform/repository-types/index.md>). The `renovate.json5` from the CI/CD guides limits Renovate to Golden Path templates and GitHub Actions. This guide removes that limit. In a hybrid repository, Renovate then also updates the Terraform providers and modules.

```
/golden-path:renovate-onboard Turn on Renovate for every dependency, and stop Dependabot from opening the same updates.
/golden-path:renovate-triage Read the Dependency Dashboard and suggest which updates to merge first.
/golden-path:renovate-review Explain what a Renovate pull request changes, and whether it's safe to merge.
```

## Step 1: Add your repository to the Renovate GitHub App

Ask Team Utviklerflyt in [the `#utviklerflyt-support` Slack channel](<https://oslokommune.slack.com/archives/CV9EGL9UG>) to add your repository to the `kjoremiljo-renovate` GitHub App.

```
Hei! Kan dere legge til repoet `oslokommune/<repository>` i GitHub-appen `kjoremiljo-renovate`?
```

> [!NOTE]
>
> **Why the app matters**
>
> Renovate runs from a workflow in [`golden-path-renovate`](<https://github.com/oslokommune/golden-path-renovate>). Every hour on weekdays, the workflow runs Renovate one time for each repository that the app is installed on. If the app isn't installed on your repository, Renovate never runs there, whatever the configuration says.

## Step 2: Add the configuration

```
Set up Renovate to open pull requests for all the dependencies of this application. Follow `{page}`, starting from Step 2. Step 1 is done.
```

Create `renovate.json5` in the root of the repository, or change the one you have:

renovate.json5

```
{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  extends: [
    "github>oslokommune/golden-path-renovate:default.json5", // (1)!
    "github>oslokommune/golden-path-renovate:golden-path-v2.json5", // (2)!
  ],
}
```

1. The shared settings. Renovate updates every dependency it finds, on weekdays, and waits 7 days after a third-party release. It keeps at most 10 pull requests open.
2. The rules for Golden Path templates. If your file has `only-golden-path-v2.json5` here, replace it with this line. The `only-` preset turns off every update except Golden Path templates and GitHub Actions.

> [!WARNING]
>
> **Expect up to 10 pull requests at a time**
>
> Renovate opens a pull request for each dependency that has a newer version. When you merge or close one, it opens the next. To choose which ones it opens first, use the [`Dependency Dashboard`](<https://km.oslo.systems/terraform-automation/renovate/#familiarize-yourself-with-the-dependency-dashboard>) issue.

Dependabot and Renovate both open a pull request for the same update when they cover the same dependencies. To prevent that, remove those ecosystems from `.github/dependabot.yml`.

## Step 3: Verify

1. Open [the Renovate workflow](<https://github.com/oslokommune/golden-path-renovate/actions/workflows/renovate.yml>).
2. Select **Run workflow**, enter the name of your repository, and start the run. You can also wait for the next hourly run.
3. Check your repository when the run finishes. The `Dependency Dashboard` issue lists the dependencies that Renovate found, and new pull requests come from branches that start with `ok-renovate/`.

If the run has no job for your repository, the app isn't installed on it. Go back to step 1.

## Next steps

To let Renovate merge some of these updates on its own, see [Automatically merge dependency updates with Renovate](<https://km.oslo.systems/application/automatically-merge-dependency-updates-with-renovate/index.md>).