Skip to content

Renovate

Renovate is a tool for automatically updating dependencies in a codebase. Think of it as Dependabot on steroids - it supports more ecosystems and offers finer control. While it supports every ecosystem under the sun, the Golden Path default configuration only uses it to automatically update templates from the Golden Path through Pull Requests. Renovate runs as a scheduled GitHub Actions workflow in golden-path-renovate.

How to use it?

Renovate regularly opens Pull Requests in enrolled repositories. How updates are grouped depends on which preset your repository extends in its renovate.json5. The recommended configuration is to use oslokommune/golden-path-renovate:default.json5 and oslokommune/golden-path-renovate:only-golden-path-v2.json5. For reference see renovate.json5.

Previous preset

There exists a previous preset, only-golden-path, with different behavior. The new one works better and limits the amount of PRs created.

Running alongside Dependabot

Your repository might already use Dependabot for standard dependencies such as npm, pip, and Docker. If you don't want Renovate to replace Dependabot, the two tools can work side by side. An only- preset limits Renovate to Golden Path templates and the GitHub Actions in your workflows.

When you run both, ensure that you disable Dependabot for the github-actions ecosystem since Renovate updates all dependencies related to GitHub Actions. Remove the github-actions entry from .github/dependabot.yml and leave your other ecosystems as they are.

Handling an update to a Terraform template

  1. Read the release notes to understand the changes.
    These can be especially useful when updating major versions as that typically implies some kind of breaking change that requires manual intervention.
  2. Review and merge the PR.
    If it's a minor or patch update, you should typically be able to merge the changes as-is.

New: Terraform CI/CD workflows

Renovate works best in conjunction with Terraform CI/CD workflows. If you haven't set these up, see how to prepare your infrastructure repository.

Familiarize yourself with the Dependency Dashboard

Renovate creates an issue named Dependency Dashboard the first time it runs against a repository. This issue shows you all the available updates, and can also be used to manually select which updates Renovate should create Pull Requests for on its next run.

Tip

Pin the Dependency Dashboard issue to keep it at the top of your issues list for easy access. You can pin it by opening the issue and clicking the pin icon in the right sidebar, or by using the three-dot menu and selecting "Pin issue".

Configuration and schedule

  • Reads the renovate.json5 file in your repository to determine behavior. See configuration options to customize it.
  • If you have the Renovate GitHub app installed, but no renovate.json5, the recommended configuration mentioned above will be used as default.
  • Tracks Golden Path Boilerplate templates, Digitaliseringsetaten's shared composite actions and reusable workflows, and GitHub Actions referenced in your workflows.
  • Opens at most 10 PRs at once. Override this temporarily via the Dependency Dashboard, or permanently in renovate.json5.
  • Creates one PR per environment for Boilerplate templates.
  • Keeps each PR up to date with the latest version until merged.
  • Third-party dependencies: 7-day cooldown after release.
  • Renovate runs every weekday on an hourly schedule. To apply changes immediately (e.g., after updating the Dependency Dashboard), trigger the workflow manually.

Post questions or feedback in #utviklerflyt-support 🙋