From 61811a5386ab4ea470489b506e80cece2783cdc3 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 14:57:46 +0000 Subject: [PATCH 01/16] chore(deps): bump apm to 0.30.0 and opencode to 1.18.31, add renovate config --- .github/renovate.json5 | 71 ++++++++++++++++++++++++++++++ tools/README.md | 4 +- tools/lockfiles/apm.lock.json | 18 ++++---- tools/lockfiles/opencode.lock.json | 18 ++++---- 4 files changed, 91 insertions(+), 20 deletions(-) create mode 100644 .github/renovate.json5 diff --git a/.github/renovate.json5 b/.github/renovate.json5 new file mode 100644 index 0000000..4bc293a --- /dev/null +++ b/.github/renovate.json5 @@ -0,0 +1,71 @@ +// ******************************************************************************* +// Copyright (c) 2026 Contributors to the Eclipse Foundation +// +// See the NOTICE file(s) distributed with this work for additional +// information regarding copyright ownership. +// +// This program and the accompanying materials are made available under the +// terms of the Apache License Version 2.0 which is available at +// https://www.apache.org/licenses/LICENSE-2.0 +// +// SPDX-License-Identifier: Apache-2.0 +// ******************************************************************************* +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:base", + ":dependencyDashboard", + ":semanticCommits" + ], + "timezone": "UTC", + "schedule": [ + "after 10pm on Monday" + ], + "lockFileMaintenance": { + "enabled": true, + "schedule": [ + "after 10pm on Monday" + ] + }, + "semanticCommits": "enabled", + "commitMessagePrefix": "chore(deps):", + "prConcurrentLimit": 5, + "prCreation": "auto", + "customManagers": [ + { + "customType": "regex", + "fileMatch": [ + "^tools/lockfiles/apm\\.lock\\.json$" + ], + "matchStrings": [ + "\"version\":\\s*\"(?[^\"]+)\"", + "\"url\":\\s*\"https://github\\.com/microsoft/apm/releases/download/v(?[^/]+)/[^\"]+\"" + ], + "datasourceTemplate": "github-releases", + "depNameTemplate": "microsoft/apm", + "versioningTemplate": "semver", + "autoReplaceStringTemplate": "\"version\": \"{{{newVersion}}}\"", + "updateType": "major" + }, + { + "customType": "regex", + "fileMatch": [ + "^tools/lockfiles/opencode\\.lock\\.json$" + ], + "matchStrings": [ + "\"version\":\\s*\"(?[^\"]+)\"", + "\"url\":\\s*\"https://github\\.com/anomalyco/opencode/releases/download/v(?[^/]+)/[^\"]+\"" + ], + "datasourceTemplate": "github-releases", + "depNameTemplate": "anomalyco/opencode", + "versioningTemplate": "semver" + } + ], + "ignoreDeps": [], + "labels": [ + "type:dependencies" + ], + "reviewers": [ + "team:maintainers" + ] +} diff --git a/tools/README.md b/tools/README.md index 0642aff..e7b39aa 100644 --- a/tools/README.md +++ b/tools/README.md @@ -40,10 +40,10 @@ access while Bazel downloads and caches the executable. | Command | Version | Purpose | | --- | --- | --- | | `actionlint` | `1.7.7` | Check GitHub Actions workflow files | -| `apm` | `0.27.0` | Manage APM packages | +| `apm` | `0.30.0` | Manage APM packages | | `bazelisk` | `1.27.0` | Run the Bazel version selected by a repository | | `buildifier` | `8.2.1` | Format and lint Bazel files | -| `opencode` | `1.18.15` | Run the OpenCode CLI | +| `opencode` | `1.18.31` | Run the OpenCode CLI | | `pre-commit` | `4.5.1` | Run repository pre-commit hooks | | `ruff` | `0.11.13` | Check and format Python code | | `shellcheck` | `0.10.0` | Check shell scripts | diff --git a/tools/lockfiles/apm.lock.json b/tools/lockfiles/apm.lock.json index ad01b22..940fbee 100644 --- a/tools/lockfiles/apm.lock.json +++ b/tools/lockfiles/apm.lock.json @@ -1,7 +1,7 @@ { "$schema": "https://raw.githubusercontent.com/bazel-contrib/rules_multitool/main/lockfile.schema.json", "apm": { - "version": "0.27.0", + "version": "0.30.0", "description": "Manage APM packages", "binaries": [ { @@ -9,8 +9,8 @@ "type": "tar.gz", "dir": "apm-darwin-arm64", "file": "apm-darwin-arm64/apm", - "url": "https://github.com/microsoft/apm/releases/download/v0.27.0/apm-darwin-arm64.tar.gz", - "sha256": "4c68e5eaa3cfdb0b25734c316deb532835eaf3c3e2f7379a4c7c06918043a641", + "url": "https://github.com/microsoft/apm/releases/download/v0.30.0/apm-darwin-arm64.tar.gz", + "sha256": "1cbd8fefbb5f74fd0e05f196bb81cff3cec2876f8f8e1a2e45d4b78fa127a37c", "os": "macos", "cpu": "arm64" }, @@ -19,8 +19,8 @@ "type": "tar.gz", "dir": "apm-darwin-x86_64", "file": "apm-darwin-x86_64/apm", - "url": "https://github.com/microsoft/apm/releases/download/v0.27.0/apm-darwin-x86_64.tar.gz", - "sha256": "846b30055d96cbc6fa0fcf451f50d13f632b540ffdff344873a025bba607e25a", + "url": "https://github.com/microsoft/apm/releases/download/v0.30.0/apm-darwin-x86_64.tar.gz", + "sha256": "648ea29ef54d234c10495dc139d70a535e107b1e1e848c815197ca2b7b6f8515", "os": "macos", "cpu": "x86_64" }, @@ -29,8 +29,8 @@ "type": "tar.gz", "dir": "apm-linux-x86_64", "file": "apm-linux-x86_64/apm", - "url": "https://github.com/microsoft/apm/releases/download/v0.27.0/apm-linux-x86_64.tar.gz", - "sha256": "be2d8a97ca8816636117ec26da85482d647ae3353213ea022fb1130c2dd3d3b0", + "url": "https://github.com/microsoft/apm/releases/download/v0.30.0/apm-linux-x86_64.tar.gz", + "sha256": "8b84bebf19c350faf36d21aebb350dc656d04c0b7a1c2bf8ea35c0caa0e44bb9", "os": "linux", "cpu": "x86_64" }, @@ -39,8 +39,8 @@ "type": "tar.gz", "dir": "apm-linux-arm64", "file": "apm-linux-arm64/apm", - "url": "https://github.com/microsoft/apm/releases/download/v0.27.0/apm-linux-arm64.tar.gz", - "sha256": "7df6e64ca9540665367f07af0226077ba92820f6cc759c10a5ca37e038a500e4", + "url": "https://github.com/microsoft/apm/releases/download/v0.30.0/apm-linux-arm64.tar.gz", + "sha256": "5d40fce0bb4beb6f59d35949b6ce5dcb6eb1e8493f4a55fc5d91d764077f82df", "os": "linux", "cpu": "arm64" } diff --git a/tools/lockfiles/opencode.lock.json b/tools/lockfiles/opencode.lock.json index 811d21e..1eeb7ac 100644 --- a/tools/lockfiles/opencode.lock.json +++ b/tools/lockfiles/opencode.lock.json @@ -1,14 +1,14 @@ { "$schema": "https://raw.githubusercontent.com/bazel-contrib/rules_multitool/main/lockfile.schema.json", "opencode": { - "version": "1.18.15", + "version": "1.18.31", "description": "Run the OpenCode CLI", "binaries": [ { "kind": "archive", "file": "opencode", - "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.15/opencode-darwin-arm64.zip", - "sha256": "bd60b57cb9fe0494a5352c807424d36d6d7853cf6dbddb97065c7ccd3c5d391c", + "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.31/opencode-darwin-arm64.zip", + "sha256": "caf7f31fa1aec2353ea859d4ef9ab824c6273d941b016e88d51193fa3028d34e", "type": "zip", "os": "macos", "cpu": "arm64" @@ -16,8 +16,8 @@ { "kind": "archive", "file": "opencode", - "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.15/opencode-darwin-x64.zip", - "sha256": "e97e8185e7b7942f6e14f51b8727dbe023b54772e075bc16fead813680455d17", + "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.31/opencode-darwin-x64.zip", + "sha256": "f8510eaf400f07c3a2014e3a517e3650c705bcd6ac3e6740351b723ee685042f", "type": "zip", "os": "macos", "cpu": "x86_64" @@ -25,8 +25,8 @@ { "kind": "archive", "file": "opencode", - "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.15/opencode-linux-x64.tar.gz", - "sha256": "d842e0e8c622c672a481b7dc6f0329009b64db96b2ba6041e56f4f93f0293b1c", + "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.31/opencode-linux-x64.tar.gz", + "sha256": "e9312be75ed803b7415fc2aeabda1f4fe938912a39673762dc0c38c0e11ebde4", "type": "tar.gz", "os": "linux", "cpu": "x86_64" @@ -34,8 +34,8 @@ { "kind": "archive", "file": "opencode", - "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.15/opencode-linux-arm64.tar.gz", - "sha256": "500611819ff88916b185649990505a9be76ad13ca5bb4b9323e5abdd39b1c6fb", + "url": "https://github.com/anomalyco/opencode/releases/download/v1.18.31/opencode-linux-arm64.tar.gz", + "sha256": "d4e332f46b227448582c0d9fc75f6f826dfe95c9f751bc2011fc4d937a042be6", "type": "tar.gz", "os": "linux", "cpu": "arm64" From 0efa2f7743494e7849dad6e29bb28f471e6a2521 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:03:10 +0000 Subject: [PATCH 02/16] chore: add renovate workflow for scheduled dependency updates --- .github/workflows/renovate.yaml | 41 +++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 .github/workflows/renovate.yaml diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml new file mode 100644 index 0000000..043adad --- /dev/null +++ b/.github/workflows/renovate.yaml @@ -0,0 +1,41 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +name: Update Dependencies with Renovate + +on: + schedule: + # Run at 2 AM UTC on Monday + - cron: '0 2 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + issues: write + +jobs: + renovate: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v7 + + - name: Run Renovate + uses: renovatebot/github-action@v46.2.4 + with: + configurationFile: .github/renovate.json5 + env: + LOG_LEVEL: debug + # Uses the default GITHUB_TOKEN unless overridden + # For private repos or higher rate limits, use RENOVATE_TOKEN From 4647a2741c496fbf51b791b94a69121273af15d4 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:05:10 +0000 Subject: [PATCH 03/16] chore: improve renovate config to work with daily workflow --- .github/renovate.json5 | 11 ++++++----- .github/workflows/renovate.yaml | 11 ++++++----- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 4bc293a..8b60b15 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -31,6 +31,7 @@ "commitMessagePrefix": "chore(deps):", "prConcurrentLimit": 5, "prCreation": "auto", + "automerge": false, "customManagers": [ { "customType": "regex", @@ -39,13 +40,12 @@ ], "matchStrings": [ "\"version\":\\s*\"(?[^\"]+)\"", - "\"url\":\\s*\"https://github\\.com/microsoft/apm/releases/download/v(?[^/]+)/[^\"]+\"" + "\"url\":\\s*\"https://github\\.com/microsoft/apm/releases/download/v[^/]+/[^\"]+\"", + "\"sha256\":\\s*\"(?[^\"]+)\"" ], "datasourceTemplate": "github-releases", "depNameTemplate": "microsoft/apm", - "versioningTemplate": "semver", - "autoReplaceStringTemplate": "\"version\": \"{{{newVersion}}}\"", - "updateType": "major" + "versioningTemplate": "semver" }, { "customType": "regex", @@ -54,7 +54,8 @@ ], "matchStrings": [ "\"version\":\\s*\"(?[^\"]+)\"", - "\"url\":\\s*\"https://github\\.com/anomalyco/opencode/releases/download/v(?[^/]+)/[^\"]+\"" + "\"url\":\\s*\"https://github\\.com/anomalyco/opencode/releases/download/v[^/]+/[^\"]+\"", + "\"sha256\":\\s*\"(?[^\"]+)\"" ], "datasourceTemplate": "github-releases", "depNameTemplate": "anomalyco/opencode", diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index 043adad..dd912cc 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -11,12 +11,12 @@ # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* -name: Update Dependencies with Renovate +name: Daily Renovate Dependency Updates on: schedule: - # Run at 2 AM UTC on Monday - - cron: '0 2 * * 1' + # Run daily at 2 AM UTC + - cron: '0 2 * * *' workflow_dispatch: permissions: @@ -27,6 +27,8 @@ permissions: jobs: renovate: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@v7 @@ -35,7 +37,6 @@ jobs: uses: renovatebot/github-action@v46.2.4 with: configurationFile: .github/renovate.json5 + token: ${{ secrets.GITHUB_TOKEN }} env: LOG_LEVEL: debug - # Uses the default GITHUB_TOKEN unless overridden - # For private repos or higher rate limits, use RENOVATE_TOKEN From a846be3e9e565a5d85273eb213bf84b6f5bf74cb Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:05:33 +0000 Subject: [PATCH 04/16] chore: rename to daily workflow following cicd-workflows pattern --- .github/workflows/{renovate.yaml => daily.yaml} | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) rename .github/workflows/{renovate.yaml => daily.yaml} (90%) diff --git a/.github/workflows/renovate.yaml b/.github/workflows/daily.yaml similarity index 90% rename from .github/workflows/renovate.yaml rename to .github/workflows/daily.yaml index dd912cc..4cf03ff 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/daily.yaml @@ -11,18 +11,17 @@ # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* -name: Daily Renovate Dependency Updates +name: Daily on: schedule: - # Run daily at 2 AM UTC - cron: '0 2 * * *' workflow_dispatch: permissions: contents: write - pull-requests: write issues: write + pull-requests: write jobs: renovate: @@ -37,6 +36,5 @@ jobs: uses: renovatebot/github-action@v46.2.4 with: configurationFile: .github/renovate.json5 - token: ${{ secrets.GITHUB_TOKEN }} env: LOG_LEVEL: debug From fb1191a1f2e0852c65d300a0957efa7821aa7de3 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:06:46 +0000 Subject: [PATCH 05/16] chore: use shared cicd-workflows daily maintenance with renovate --- .github/workflows/{daily.yaml => daily.yml} | 39 ++++++++++++++++----- 1 file changed, 31 insertions(+), 8 deletions(-) rename .github/workflows/{daily.yaml => daily.yml} (58%) diff --git a/.github/workflows/daily.yaml b/.github/workflows/daily.yml similarity index 58% rename from .github/workflows/daily.yaml rename to .github/workflows/daily.yml index 4cf03ff..418b72d 100644 --- a/.github/workflows/daily.yaml +++ b/.github/workflows/daily.yml @@ -11,28 +11,51 @@ # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* -name: Daily - -on: - schedule: - - cron: '0 2 * * *' - workflow_dispatch: +name: Daily Maintenance permissions: contents: write issues: write pull-requests: write + pages: write + id-token: write + actions: write # cleanup old caches + +on: + # Runs every day at midnight UTC + schedule: + - cron: '0 0 * * *' + + # On changes to this workflow file + pull_request: + branches: + - main + paths: + - '.github/workflows/daily.yml' + + # Manually trigger the workflow from the GitHub UI + workflow_dispatch: {} jobs: + maintenance: + uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@cache + permissions: + contents: write + issues: write + pull-requests: write + pages: write + id-token: write + actions: write + renovate: runs-on: ubuntu-latest permissions: contents: read steps: - - name: Checkout + - name: Checkout config file uses: actions/checkout@v7 - - name: Run Renovate + - name: Run renovate uses: renovatebot/github-action@v46.2.4 with: configurationFile: .github/renovate.json5 From 958ac97bbf8ca5bdd8353d05d03e004e43b60651 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:08:01 +0000 Subject: [PATCH 06/16] fix: add token to renovate action --- .github/workflows/daily.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 418b72d..950db9f 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -58,6 +58,7 @@ jobs: - name: Run renovate uses: renovatebot/github-action@v46.2.4 with: + token: ${{ secrets.GITHUB_TOKEN }} configurationFile: .github/renovate.json5 env: LOG_LEVEL: debug From 312d1cc707525ad388303ebdc3d74584c4af5e40 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:10:13 +0000 Subject: [PATCH 07/16] chore: use org RENOVATE_TOKEN secret --- .github/workflows/daily.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 950db9f..a968b49 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -58,7 +58,7 @@ jobs: - name: Run renovate uses: renovatebot/github-action@v46.2.4 with: - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ secrets.RENOVATE_TOKEN }} configurationFile: .github/renovate.json5 env: LOG_LEVEL: debug From fef4a623cebf58ffbab980aeb178f6dc4e833edb Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:14:20 +0000 Subject: [PATCH 08/16] chore: format daily.yml with yamlfmt --- .github/workflows/daily.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index a968b49..f6bfd17 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -10,9 +10,7 @@ # # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* - name: Daily Maintenance - permissions: contents: write issues: write @@ -20,22 +18,18 @@ permissions: pages: write id-token: write actions: write # cleanup old caches - on: # Runs every day at midnight UTC schedule: - cron: '0 0 * * *' - # On changes to this workflow file pull_request: branches: - main paths: - '.github/workflows/daily.yml' - # Manually trigger the workflow from the GitHub UI workflow_dispatch: {} - jobs: maintenance: uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@cache @@ -46,7 +40,6 @@ jobs: pages: write id-token: write actions: write - renovate: runs-on: ubuntu-latest permissions: @@ -54,7 +47,6 @@ jobs: steps: - name: Checkout config file uses: actions/checkout@v7 - - name: Run renovate uses: renovatebot/github-action@v46.2.4 with: From fe9c1f720a64efd49c6628c74c5f8a57a33011b5 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:14:55 +0000 Subject: [PATCH 09/16] fix: add required permissions for renovate job to create PRs and issues --- .github/workflows/daily.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index f6bfd17..6b28961 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -43,7 +43,9 @@ jobs: renovate: runs-on: ubuntu-latest permissions: - contents: read + contents: write + pull-requests: write + issues: write steps: - name: Checkout config file uses: actions/checkout@v7 From ec566c78a8d701710b834b025fac57e9d1f300b2 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:20:01 +0000 Subject: [PATCH 10/16] chore(deps): update apm and opencode versions in s-core-local versions.yaml --- .../.devcontainer/s-core-local/versions.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml b/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml index 912e77a..95ea793 100644 --- a/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml +++ b/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml @@ -52,9 +52,9 @@ ripgrep: lcov: version: 2.0 apm: - version: 0.27.0 + version: 0.30.0 opencode: - version: 1.18.15 + version: 1.18.31 pkg_config: version: 1.8.1 libcairo2_dev: From 0300ae34c3c90937219ceb2dc298977d0ba7962f Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Thu, 17 Sep 2026 15:20:46 +0000 Subject: [PATCH 11/16] chore: add renovate managers for versions.yaml to detect apm and opencode updates --- .github/renovate.json5 | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 8b60b15..de68f89 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -60,6 +60,30 @@ "datasourceTemplate": "github-releases", "depNameTemplate": "anomalyco/opencode", "versioningTemplate": "semver" + }, + { + "customType": "regex", + "fileMatch": [ + "versions\\.yaml$" + ], + "matchStrings": [ + "apm:\\n\\s+version:\\s+(?\\d+\\.\\d+\\.\\d+)" + ], + "datasourceTemplate": "github-releases", + "depNameTemplate": "microsoft/apm", + "versioningTemplate": "semver" + }, + { + "customType": "regex", + "fileMatch": [ + "versions\\.yaml$" + ], + "matchStrings": [ + "opencode:\\n\\s+version:\\s+(?\\d+\\.\\d+\\.\\d+)" + ], + "datasourceTemplate": "github-releases", + "depNameTemplate": "anomalyco/opencode", + "versioningTemplate": "semver" } ], "ignoreDeps": [], From d594a8cbab4a38d56aeb2d50e18519cee987c092 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Fri, 18 Sep 2026 07:34:21 +0000 Subject: [PATCH 12/16] fix comments --- .github/renovate.json5 | 13 +++++++------ .github/workflows/daily.yml | 13 +++++-------- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index de68f89..df48a5b 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -19,12 +19,12 @@ ], "timezone": "UTC", "schedule": [ - "after 10pm on Monday" + "at any time" ], "lockFileMaintenance": { "enabled": true, "schedule": [ - "after 10pm on Monday" + "at any time" ] }, "semanticCommits": "enabled", @@ -40,8 +40,7 @@ ], "matchStrings": [ "\"version\":\\s*\"(?[^\"]+)\"", - "\"url\":\\s*\"https://github\\.com/microsoft/apm/releases/download/v[^/]+/[^\"]+\"", - "\"sha256\":\\s*\"(?[^\"]+)\"" + "\"url\":\\s*\"https://github\\.com/microsoft/apm/releases/download/v(?[^/]+)/[^\"]+\",\\s*\"sha256\":\\s*\"(?[^\"]+)\"" ], "datasourceTemplate": "github-releases", "depNameTemplate": "microsoft/apm", @@ -54,8 +53,7 @@ ], "matchStrings": [ "\"version\":\\s*\"(?[^\"]+)\"", - "\"url\":\\s*\"https://github\\.com/anomalyco/opencode/releases/download/v[^/]+/[^\"]+\"", - "\"sha256\":\\s*\"(?[^\"]+)\"" + "\"url\":\\s*\"https://github\\.com/anomalyco/opencode/releases/download/v(?[^/]+)/[^\"]+\",\\s*\"sha256\":\\s*\"(?[^\"]+)\"" ], "datasourceTemplate": "github-releases", "depNameTemplate": "anomalyco/opencode", @@ -86,6 +84,9 @@ "versioningTemplate": "semver" } ], + "enabledManagers": [ + "custom.regex" + ], "ignoreDeps": [], "labels": [ "type:dependencies" diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 6b28961..108a47f 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -15,9 +15,6 @@ permissions: contents: write issues: write pull-requests: write - pages: write - id-token: write - actions: write # cleanup old caches on: # Runs every day at midnight UTC schedule: @@ -28,11 +25,12 @@ on: - main paths: - '.github/workflows/daily.yml' + - '.github/renovate.json5' # Manually trigger the workflow from the GitHub UI workflow_dispatch: {} jobs: maintenance: - uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@cache + uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3 permissions: contents: write issues: write @@ -41,16 +39,15 @@ jobs: id-token: write actions: write renovate: + if: github.event_name != 'pull_request' runs-on: ubuntu-latest permissions: - contents: write - pull-requests: write - issues: write + contents: read steps: - name: Checkout config file uses: actions/checkout@v7 - name: Run renovate - uses: renovatebot/github-action@v46.2.4 + uses: renovatebot/github-action@5402b206248e5a8c8427a15102702eb9c1793efc # v46.2.4 with: token: ${{ secrets.RENOVATE_TOKEN }} configurationFile: .github/renovate.json5 From a12271317b836e446f8bba43d06fbbcaedd655fd Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Fri, 18 Sep 2026 09:49:59 +0000 Subject: [PATCH 13/16] moved to merge queue --- .github/workflows/ci.yaml | 6 ++++++ .github/workflows/daily.yml | 14 +++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 2b6472e..ebda701 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -23,6 +23,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true jobs: + validate-renovate-config: + name: Validate Renovate config + if: github.event_name == 'merge_group' + uses: ./.github/workflows/daily.yml + permissions: + contents: read build: strategy: matrix: diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 108a47f..dd9ce50 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -16,6 +16,7 @@ permissions: issues: write pull-requests: write on: + workflow_call: # Runs every day at midnight UTC schedule: - cron: '0 0 * * *' @@ -30,6 +31,7 @@ on: workflow_dispatch: {} jobs: maintenance: + if: github.event_name != 'workflow_call' uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3 permissions: contents: write @@ -39,7 +41,7 @@ jobs: id-token: write actions: write renovate: - if: github.event_name != 'pull_request' + if: github.event_name != 'pull_request' && github.event_name != 'workflow_call' runs-on: ubuntu-latest permissions: contents: read @@ -53,3 +55,13 @@ jobs: configurationFile: .github/renovate.json5 env: LOG_LEVEL: debug + validate-renovate-config: + if: github.event_name == 'workflow_call' + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout config file + uses: actions/checkout@v7 + - name: Validate Renovate config + run: npx --yes --package renovate renovate-config-validator .github/renovate.json5 From a3d8eed8a8a1309aa89b0e1f829fc531d2042728 Mon Sep 17 00:00:00 2001 From: Frank Scholter Peres Date: Fri, 18 Sep 2026 10:12:23 +0000 Subject: [PATCH 14/16] remove triggers --- .github/workflows/ci.yaml | 8 ++++++-- .github/workflows/daily.yml | 20 -------------------- 2 files changed, 6 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ebda701..0ae0d7f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -25,10 +25,14 @@ concurrency: jobs: validate-renovate-config: name: Validate Renovate config - if: github.event_name == 'merge_group' - uses: ./.github/workflows/daily.yml + runs-on: ubuntu-latest permissions: contents: read + steps: + - name: Checkout config file + uses: actions/checkout@v7 + - name: Validate Renovate config + run: npx --yes --package renovate renovate-config-validator .github/renovate.json5 build: strategy: matrix: diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index dd9ce50..63ee42a 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -16,22 +16,13 @@ permissions: issues: write pull-requests: write on: - workflow_call: # Runs every day at midnight UTC schedule: - cron: '0 0 * * *' - # On changes to this workflow file - pull_request: - branches: - - main - paths: - - '.github/workflows/daily.yml' - - '.github/renovate.json5' # Manually trigger the workflow from the GitHub UI workflow_dispatch: {} jobs: maintenance: - if: github.event_name != 'workflow_call' uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3 permissions: contents: write @@ -41,7 +32,6 @@ jobs: id-token: write actions: write renovate: - if: github.event_name != 'pull_request' && github.event_name != 'workflow_call' runs-on: ubuntu-latest permissions: contents: read @@ -55,13 +45,3 @@ jobs: configurationFile: .github/renovate.json5 env: LOG_LEVEL: debug - validate-renovate-config: - if: github.event_name == 'workflow_call' - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - name: Checkout config file - uses: actions/checkout@v7 - - name: Validate Renovate config - run: npx --yes --package renovate renovate-config-validator .github/renovate.json5 From 5b0a2f2ad6c2232f63a2c3eaf0b6f61dfde7ffac Mon Sep 17 00:00:00 2001 From: Lutz Reinhardt Date: Fri, 18 Sep 2026 11:08:16 +0000 Subject: [PATCH 15/16] wire daily workflow into CI workflow --- .github/workflows/ci.yaml | 26 +++++++++++++++++++------- .github/workflows/daily.yml | 13 +++++++++++++ 2 files changed, 32 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0ae0d7f..1e606c9 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -23,16 +23,23 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true jobs: - validate-renovate-config: - name: Validate Renovate config - runs-on: ubuntu-latest + changes: + name: Detect changed files + runs-on: ubuntu-24.04 permissions: contents: read + outputs: + daily: ${{ steps.filter.outputs.daily }} steps: - - name: Checkout config file + - name: Checkout (GitHub) uses: actions/checkout@v7 - - name: Validate Renovate config - run: npx --yes --package renovate renovate-config-validator .github/renovate.json5 + - uses: dorny/paths-filter@v4 + id: filter + with: + filters: | + daily: + - '.github/workflows/daily.yml' + - '.github/renovate.json5' build: strategy: matrix: @@ -105,10 +112,15 @@ jobs: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin ./scripts/publish.sh --${{ matrix.os }} "main" fi + daily: + secrets: inherit + needs: [changes] + if: needs.changes.outputs.daily == 'true' + uses: ./.github/workflows/daily.yml overall-result: name: build/overall-result runs-on: ubuntu-24.04 - needs: [build] + needs: [build, daily] if: ${{ !cancelled() }} permissions: {} steps: diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 63ee42a..966b46c 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -21,6 +21,7 @@ on: - cron: '0 0 * * *' # Manually trigger the workflow from the GitHub UI workflow_dispatch: {} + workflow_call: jobs: maintenance: uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3 @@ -33,6 +34,7 @@ jobs: actions: write renovate: runs-on: ubuntu-latest + if: ${{ github.event_name == 'schedule' }} permissions: contents: read steps: @@ -41,7 +43,18 @@ jobs: - name: Run renovate uses: renovatebot/github-action@5402b206248e5a8c8427a15102702eb9c1793efc # v46.2.4 with: + # Pull requests from forks do not have access to secrets token: ${{ secrets.RENOVATE_TOKEN }} configurationFile: .github/renovate.json5 env: LOG_LEVEL: debug + validate-renovate-config: + name: Validate Renovate config + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout config file + uses: actions/checkout@v7 + - name: Validate Renovate config + run: npx --yes --package renovate renovate-config-validator .github/renovate.json5 From 64175705d7ce455ab115810581ebc88bbc30ebf6 Mon Sep 17 00:00:00 2001 From: Lutz Reinhardt Date: Fri, 18 Sep 2026 11:17:04 +0000 Subject: [PATCH 16/16] fix workflow permissions --- .github/workflows/ci.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 1e606c9..63068b4 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -117,6 +117,13 @@ jobs: needs: [changes] if: needs.changes.outputs.daily == 'true' uses: ./.github/workflows/daily.yml + permissions: + actions: write + contents: write + issues: write + pages: write + pull-requests: write + id-token: write overall-result: name: build/overall-result runs-on: ubuntu-24.04