# Renovate

[Renovate](https://github.com/renovatebot/renovate){:target="_blank"} is a tool for automatically updating dependencies in a codebase. Think of it as Dependabot on steroids - it supports more ecosystems and offers finer control. While it supports every ecosystem under the sun, the Golden Path default configuration only uses it to automatically update templates from the Golden Path through Pull Requests.
Renovate runs as a scheduled GitHub Actions workflow in [golden-path-renovate](https://github.com/oslokommune/golden-path-renovate/actions/workflows/renovate.yml){:target="_blank"}.

## How to use it?

Renovate regularly opens Pull Requests in enrolled repositories. How updates are grouped depends on which preset your repository extends in its `renovate.json5`.
The recommended configuration is to use `oslokommune/golden-path-renovate:default.json5` and `oslokommune/golden-path-renovate:only-golden-path-v2.json5`. For reference see [renovate.json5](https://github.com/oslokommune/golden-path-templates/blob/main/templates/gh-cicd-app/renovate.json5){:target="_blank"}.

<!-- prettier-ignore-start -->
!!! Note "Previous preset"
    There exists a previous preset, `only-golden-path`, with different behavior. The new one works better and limits the amount of PRs created.
<!-- prettier-ignore-end -->

### Running alongside Dependabot

Your repository might already use Dependabot for standard dependencies such as npm, pip, and Docker. If you don't want Renovate to replace Dependabot, the two tools can work side by side. An `only-` preset limits Renovate to Golden Path templates and the GitHub Actions in your workflows.

When you run both, **ensure that you disable Dependabot for the `github-actions` ecosystem** since Renovate updates all dependencies related to GitHub Actions. Remove the `github-actions` entry from `.github/dependabot.yml` and leave your other ecosystems as they are.

### Handling an update to a Terraform template

1. **Read the release notes to understand the changes.**<br/>
   These can be especially useful when updating major versions as that typically implies some kind of breaking change that requires manual intervention.
1. **Review and merge the PR.**<br/>
   If it's a minor or patch update, you should typically be able to merge the changes as-is.

<!-- prettier-ignore-start -->
!!! note "New: Terraform CI/CD workflows"
    Renovate works best in conjunction with Terraform CI/CD workflows. If you haven't set these up, see how to [prepare your infrastructure repository](migrate-to-latest-workflows/prepare-infrastructure-repository.md).
<!-- prettier-ignore-end -->

### Familiarize yourself with the `Dependency Dashboard`

Renovate creates an issue named `Dependency Dashboard` the first time it runs against a repository. This issue shows you all the available updates, and can also be used to manually select which updates Renovate should create Pull Requests for on its next run.

<!-- prettier-ignore-start -->
!!! tip
    Pin the Dependency Dashboard issue to keep it at the top of your issues list. You can pin it by opening the issue and clicking the pin icon in the right sidebar, or by using the three-dot menu and selecting "Pin issue".
<!-- prettier-ignore-end -->

## Configuration and schedule

<!-- vale off -->

- Reads the `renovate.json5` file in your repository to determine behavior. See [configuration options](https://docs.renovatebot.com/configuration-options/) to customize it.
  - If you have the Renovate GitHub app installed, but no `renovate.json5`, the recommended configuration [mentioned above](#how-to-use-it) will be used as default.
- Tracks Golden Path Boilerplate templates, Digitaliseringsetaten's shared composite actions and reusable workflows, and GitHub Actions referenced in your workflows.
- Opens at most 10 PRs at once. Override this temporarily via the `Dependency Dashboard`, or permanently in `renovate.json5`.
- Creates one PR per environment for Boilerplate templates.
- Keeps each PR up to date with the latest version until merged.
- **Third-party dependencies**: 7-day cooldown after release.
- Renovate runs every weekday on an hourly schedule. To apply changes immediately (e.g., after updating the `Dependency Dashboard`), [trigger the workflow manually](https://github.com/oslokommune/golden-path-renovate/actions/workflows/renovate.yml).

<!-- vale on-->

Post questions or feedback in [`#utviklerflyt-support`](https://oslokommune.slack.com/archives/CV9EGL9UG) 🙋