Skip to content

Renovate

Renovate is a tool for automatically updating dependencies in a codebase. Think of it as Dependabot on steroids - it supports more ecosystems and offers finer control. While it supports every ecosystem under the sun, our default configuration only uses it to automatically update templates from the Golden Path through Pull Requests. We run Renovate as a scheduled GitHub Actions workflow in golden-path-renovate.

How do I use it?

Renovate regularly opens Pull Requests in enrolled repositories. How updates are grouped depends on which preset your repository extends in its renovate.json5. The recommended configuration is to use oslokommune/golden-path-renovate:default.json5 and oslokommune/golden-path-renovate:only-golden-path-v2.json5. For reference see renovate.json5.

If your repository already uses Dependabot for standard dependencies (npm, pip, Docker, etc.), the two tools work side by side since the only- preset limits Renovate to Golden Path templates, and GitHub workflows.

Previous preset

There exists a previous preset, only-golden-path, with different behavior. The new one works better and limits the amount of PRs created.

Handling an update to a Terraform template

  1. Read the release notes to understand the changes.
    These can be especially useful when updating major versions as that typically implies some kind of breaking change that requires manual intervention.
  2. Review and merge the PR.
    If it's a minor or patch update, you should typically be able to merge the changes as-is.

New: Terraform CI/CD workflows

Renovate works best in conjunction with Terraform CI/CD workflows. If you haven't set these up, take a look at the migration guide.

Familiarize yourself with the Dependency Dashboard

Renovate will create an issue named Dependency Dashboard the first time it runs against a repository. This issue will show you all the available updates, and can also be used to manually select which updates Renovate should create Pull Requests for on its next run.

Tip

Pin the Dependency Dashboard issue to keep it at the top of your issues list for easy access. You can pin it by opening the issue and clicking the pin icon in the right sidebar, or by using the three-dot menu and selecting "Pin issue".

Configuration and schedule

  • Reads the renovate.json5 file in your repository to determine behavior. See configuration options to customize it.
  • Tracks Golden Path Boilerplate templates, Oslo Origo's shared composite actions and reusable workflows, and GitHub Actions referenced in your workflows.
  • Opens at most 10 PRs at once. Override this temporarily via the Dependency Dashboard, or permanently in renovate.json5.
  • Creates one PR per environment for Boilerplate templates.
  • Keeps each PR up to date with the latest version until merged.
  • Third-party dependencies: 7-day cooldown after release.
  • Renovate runs every weekday on an hourly schedule. To apply changes immediately (e.g., after updating the Dependency Dashboard), trigger the workflow manually.

Any questions or input? Let us know in #utviklerflyt-support 🙋