Automate dependency updates

Purpose of this guide

This guide is meant to give an introduction to configuring your project to use Renovate to automate dependency updates.

Getting started

Using Renovate on Workshop is a three step process.

1. Provision a renovatebot service account using _namespace-configuration
2. Include the Workshop-customized Renovate component in your pipeline.
3. Ensure your project is running scheduled pipelines.

Provision renovatebot

The Namespace configuration component automates the creation of a Project-level Service Account, including setting up token rotation and an SSH key that Renovate uses to sign its commits. Add enable_renovatebot: true to every project's configuration that needs to run the Renovate jobs.

cg-workshop.yml

projects:
  project-path:
    name: My Project
    enable_renovatebot: true
    # ...rest of settings

Include the component

Within your project's .gitlab-ci.yml you must include the Workshop provided Renovate component.

.gitlab-ci.yml

stages:
  - build
  - test

include:
  - component: $CI_SERVER_FQDN/workshop/components/renovate/renovate@1

This component will finish setting up the Service Account's git signing so that commits will show as Verified and include jobs from the upstream Renovate component

Schedule pipelines

Renovate will create new merge requests and make updates from issue and MR comments and descriptions when a renovate pipeline is started manually or via a pipeline schedule. To shorten the feedback cycle we recommend creating a scheduled pipeline that runs every hour.

You can do this either using the Pipeline Schedules UI or with some custom terraform in your _namespace-configuration project. The following example will set up an hourly pipline for project-path.

pipeline_schedules.tf

resource "gitlab_pipeline_schedule" "renovate_schedule" {
  project        = module.projects["project-path"].project_id
  description    = "Dependency Updates"
  ref            = "refs/heads/${module.projects["project-path"].default_branch}"
  cron           = "21 * * * *" # run at 21 past the hour, every hour
  take_ownership = true
}

First merge request

The first MR that Renovate will open will be to add its own configuration file. Review and merge that file to start receiving actual dependency updates.