From afb9a05dfc7b853f4cbbb942f5c67b6aeeaf5b84 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Mon, 17 Aug 2026 22:37:16 +0200 Subject: [PATCH] ci(renovate): track the tool versions pinned in workflows and actions Four versions sat frozen because no manager could see them -- they live in composite-action input defaults and a shell assignment, not in a manifest: @antora/cli 3.1.14 build-antora-site asciidoctor-kroki 0.18.1 build-antora-site orhun/git-cliff 2.13.1 setup-git-cliff rhysd/actionlint 1.7.7 ci.yml Same silent rot as the Nisse pin that Renovate skipped for a missing xmlns: a pinned version that nothing updates is not a pin, it is a version nobody is watching. A `# renovate:` comment above each makes it a tracked dependency. Not the customManagers:githubActionsVersions preset -- that expects the value on a `SOMETHING_VERSION:` key, and three of these are action-input `default:`s. The two matchStrings were tested against the real files and discover exactly these four. git-cliff needs one more thing. Renovate can bump the version but cannot compute the new SHA-256, so a bump will fail the checksum -- which is correct, and failing closed is the point. The check now prints the expected and actual digests and says which input to update, so the fix is a copy-paste rather than a puzzle. Also holds asciidoctor-kroki below 1.x: 1.x is not compatible with Antora, which is the only thing using it. This closes reqstool.github.io#41 and stops it being re-proposed. Signed-off-by: Jimisola Laursen --- .github/actions/build-antora-site/action.yml | 2 ++ .github/actions/setup-git-cliff/action.yml | 13 ++++++++- .github/renovate.json5 | 28 ++++++++++++++++++++ .github/workflows/ci.yml | 1 + 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/.github/actions/build-antora-site/action.yml b/.github/actions/build-antora-site/action.yml index e1d85f4..1444f0f 100644 --- a/.github/actions/build-antora-site/action.yml +++ b/.github/actions/build-antora-site/action.yml @@ -10,10 +10,12 @@ inputs: antora-version: description: "@antora/cli and @antora/site-generator version." required: false + # renovate: datasource=npm depName=@antora/cli default: "3.1.14" kroki-version: description: "asciidoctor-kroki version." required: false + # renovate: datasource=npm depName=asciidoctor-kroki default: "0.18.1" playbook: description: "Path to the Antora playbook." diff --git a/.github/actions/setup-git-cliff/action.yml b/.github/actions/setup-git-cliff/action.yml index a1a75b5..a16ad69 100644 --- a/.github/actions/setup-git-cliff/action.yml +++ b/.github/actions/setup-git-cliff/action.yml @@ -5,6 +5,7 @@ inputs: version: description: "git-cliff version, without the leading v." required: false + # renovate: datasource=github-releases depName=orhun/git-cliff default: "2.13.1" sha256: description: "SHA-256 of the x86_64-unknown-linux-gnu tarball. Change with `version`." @@ -28,7 +29,17 @@ runs: TARBALL="$(mktemp -d)/git-cliff.tar.gz" curl -fsSL -o "$TARBALL" \ "https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz" - echo "${GIT_CLIFF_SHA256} ${TARBALL}" | sha256sum -c - + # Spelled out rather than `sha256sum -c`, because Renovate can bump the + # version but cannot compute the new digest -- so this failure is the + # expected outcome of a version bump, and it should say what to paste. + ACTUAL="$(sha256sum "$TARBALL" | cut -d" " -f1)" + if [ "$ACTUAL" != "$GIT_CLIFF_SHA256" ]; then + echo "::error::git-cliff ${GIT_CLIFF_VERSION} checksum mismatch." + echo "::error:: expected: ${GIT_CLIFF_SHA256}" + echo "::error:: actual: ${ACTUAL}" + echo "::error::If you are bumping the version, set the sha256 input default to the actual value above." + exit 1 + fi # /usr/local/bin is on PATH and runner-writable, so no sudo and no # $GITHUB_PATH write (zizmor flags the latter). tar -xzf "$TARBALL" --strip-components=1 -C /usr/local/bin \ diff --git a/.github/renovate.json5 b/.github/renovate.json5 index e4366a8..e6ab760 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -44,6 +44,27 @@ osvVulnerabilityAlerts: true, + // Tool versions pinned inside workflows and composite actions are invisible to + // every built-in manager -- there is no manifest for them -- so they sat frozen + // while everything with a package file kept moving. The `# renovate:` comment + // above each one is what makes it a tracked dependency. + // + // Not the customManagers:githubActionsVersions preset: that requires the value + // to sit on a `SOMETHING_VERSION:` key, and these are action-input `default:`s. + customManagers: [ + { + customType: "regex", + managerFilePatterns: [ + "/^\\.github/actions/.+/action\\.ya?ml$/", + "/^\\.github/workflows/.+\\.ya?ml$/", + ], + matchStrings: [ + "# renovate: datasource=(?[a-z-]+?) depName=(?\\S+)\\s+default: \"(?[^\"]+)\"", + "# renovate: datasource=(?[a-z-]+?) depName=(?\\S+)\\s+VERSION=\"(?[^\"]+)\"", + ], + }, + ], + packageRules: [ // ===================================================== @@ -60,6 +81,13 @@ allowedVersions: "<=21", }, + { + // asciidoctor-kroki 1.x is not compatible with Antora, which is the only + // thing that uses it here. Lift when Antora supports it. + matchDepNames: ["asciidoctor-kroki"], + allowedVersions: "<1", + }, + // ===================================================== // Version classification labels // ===================================================== diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b2ba565..3d61d7d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,6 +26,7 @@ jobs: - name: Install actionlint run: | + # renovate: datasource=github-releases depName=rhysd/actionlint VERSION="1.7.7" curl -fsSL \ "https://github.com/rhysd/actionlint/releases/download/v${VERSION}/actionlint_${VERSION}_linux_amd64.tar.gz" \