Add support to update action in GitHub Actions workflow #5733

vidavidorra · 2020-03-17T07:03:42Z

What would you like Renovate to be able to do?
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
I'd like to update actions in an GitHub Action workflow. In the example workflow (shortened) below the wagoid/commitlint-github-action can be updated to 1.6.0.

jobs:
  commitlint:
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Lint commit messages
        uses: wagoid/[email protected]

Describe the solution you'd like

I'd like the github-actions manager to create updates for action in GitHub Actions workflow.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Current alternative is to also add a regex manager (source).

{
  ...
  regexManagers: [
    {
      fileMatch: ['^\\.github/workflows/[^/]+\\.ya?ml$'],
      matchStrings: ['uses: (?<depName>.*?)@(?<currentValue>.*?)\\s'],
      datasourceTemplate: 'github-tags',
    },
  ],
  ...
}

Additional context
Add any other context or screenshots about the feature request here.
See discussions in renovatebot/config-help#570 for this feature.

The text was updated successfully, but these errors were encountered:

ikesyo · 2020-04-07T10:46:46Z

Good news https://github.blog/changelog/2020-04-07-github-apps-workflow-permission

ikesyo · 2020-04-08T10:20:43Z

@rarkins Could you add the new permission to the hosted GitHub App?

rarkins · 2020-04-08T10:44:08Z

@ikesyo can you first double check that our current github-actions manager is fully up to date with GitHub's latest syntax? I thought I'd wait until verifying that before asking for more permissions.

ikesyo · 2020-04-08T10:53:22Z

@rarkins Current github-actions manager partially supports the latest (YAML) syntax; only docker images

renovate/lib/manager/github-actions/extract.ts

Line 15 in 69fedcf

/^\s+uses: docker:\/\/([^"]+)\s*$/.exec(line);

. To update actions on GitHub repo (e.g. uses: actions/checkout@v2), we need to use regex manager or update github-actions manager.

viceice · 2020-04-08T11:40:26Z

@rarkins I think it's save to enable github-actions, we can update the manager later and use the regex manager for now.

@ikesyo Will you send a pr to update the github-actions manager?

rarkins · 2020-04-08T11:44:08Z

I've updated the app's permissions so that existing org admins will get a request to approve them. We need to make sure that we gracefully handle permission failures though.

Today: The git push fails, which is problematic error
Better: Ignore the workflows push fail, keep going
Best: Enable/disable the github-actions manager based on whether we have permissions or not

viceice · 2020-04-08T11:47:07Z

ok, so currently users have to explicit enable the github-action manager for the app?

rarkins · 2020-04-08T13:49:34Z

Yes, until we're sure that we're handing the lack of permissions gracefully enough

fabianbru · 2020-06-26T08:40:00Z

Just for my understanding, with approved permission it should be possible to update action files with the regex manager?

I added the regex manager from above (slightly modified), but my run fails with "repository-changed".
Approved permissions: "Read and write access to actions, checks, commit statuses, issues, and pull requests"

Run ID: 194424030

regex manager config

  "regexManagers": [
    {
      "fileMatch": ["^\\.github/workflows/[^/]+\\.ya?ml$"],
      "matchStrings": ["uses: (?<depName>.*?)@(?<currentValue>.*?)\\s"],
      "datasourceTemplate": "github-tags",
      "versioningTemplate": "regex:^v(?<major>\\d+)(\\.(?<minor>\\d+)(\\.(?<patch>\\d+))?)?$"
    }

regex updates found during run

"regex": [
      {
        "packageFile": ".github/workflows/default.yml",
        "manager": "regex",
        "deps": [
            {
            "depName": "actions/cache",
            "currentValue": "v1",
            "datasource": "github-tags",
            "versioning": "regex:^v(?\\d+)(\\.(?\\d+)(\\.(?\\d+))?)?$",
            "replaceString": "uses: actions/cache@v1\n",
            "depIndex": 2,
            "updates": [
              {
                "fromVersion": "v1",
                "toVersion": "v1.2.0",
                "newValue": "v1.2.0",
                "newMajor": 1,
                "newMinor": 2,
                "updateType": "minor",
                "isSingleVersion": true
              },
              {
                "fromVersion": "v1",
                "toVersion": "v2.0.0",
                "newValue": "v2.0.0",
                "newMajor": 2,
                "newMinor": 0,
                "updateType": "major",
                "isSingleVersion": true
              }
            ],
            "warnings": [],
            "sourceUrl": "https://github.com/actions/cache"
          }
...

run error during commiting files

DEBUG: Error commiting files(branch="renovate/actions-cache-1.x")
{
  "err": {
    "message": "To https://**redacted**@github.com/<USER>/<REPO>.git'\n",
    "stack": "Error: To https://**redacted**@github.com/<USER>/<REPO>.git'\n\n
    at toError (/home/ubuntu/renovateapp/node_modules/simple-git/promise.js:90:14)\n
    at /home/ubuntu/renovateapp/node_modules/simple-git/promise.js:61:36\n
    at Git. (/home/ubuntu/renovateapp/node_modules/simple-git/src/git.js:937:21)\n
    at Function.Git.fail (/home/ubuntu/renovateapp/node_modules/simple-git/src/git.js:1475:18)\n
    at fail (/home/ubuntu/renovateapp/node_modules/simple-git/src/git.js:1433:20)\n
    at /home/ubuntu/renovateapp/node_modules/simple-git/src/git.js:1442:16\n
    at runMicrotasks ()\n
    at processTicksAndRejections (internal/process/task_queues.js:97:5)"
  }
}
DEBUG: Passing repository-changed error up(branch="renovate/actions-cache-1.x")
INFO: Repository has changed during renovation - aborting

Am I doing something wrong? 🤔

rarkins · 2020-06-26T08:53:45Z

Unfortunately GitHub still block apps if the Actions change is made via git instead of API.

mrlubos · 2020-08-28T11:43:51Z

@rarkins Is that so? I am new to this issue but quickly checked if Dependabot supports this feature and it seems so, so I assume RenovateBot should be able to achieve this as well. Of course, unless Github keeps this API exclusive to their dependency manager

viceice · 2020-08-28T11:46:50Z

Renovate app now has permission to update github workflows, but it's missing some manager features.
Renovate can currently only update uses: docker:xxx actions.

As a workaround you can use regexManagers:

renovate.json

...
"regexManagers": [
      {
        "fileMatch": ["^\\.github/workflows/[^/]+\\.ya?ml$"],
        "matchStrings": ["uses: (?<depName>[a-z-/]+?)@(?<currentValue>.+?)\\s"],
        "datasourceTemplate": "github-tags"
      }
    ]
...

rarkins · 2020-08-28T11:47:25Z

@mrlubos it's unblocked now actually. The challenge was that we use git to push our changes to GitHub while Dependabot uses the API. The git flow does not follow the exact same path as API so there can be unintentional differences at times (it's not about GitHub benefiting their own app deliberately).

RichiCoder1 · 2020-10-09T03:07:18Z

This is up for grabs right? I might be interested in taking a swing.

rarkins · 2020-10-09T03:25:20Z

@RichiCoder1 it's all yours!

RichiCoder1 · 2020-10-09T03:28:14Z

Is there a way/pattern in renovate to track tags but pin to a commit kind like in docker? I know it's pretty common for use to track tags, but pin to a commit to avoid tag-shifting issues.

(Also just generally any advice?)

rarkins · 2020-10-09T03:31:29Z

@RichiCoder1 can you give an example of what you mean? I'm not sure the actions syntax allows both a tag as well as a SHA, so if we were to support that then we may need to invent part of the syntax ourselves.

Also for this issue I suggest you start with basic updating before progressing to anything advanced like pinning.

RichiCoder1 · 2020-10-09T03:32:11Z

Sounds good!

RichiCoder1 · 2020-10-09T03:41:00Z

can you give an example of what you mean? I'm not sure the actions syntax allows both a tag as well as a SHA, so if we were to support that then we may need to invent part of the syntax ourselves.

That's fair. It doesn't, hence why I asked if something like that already existed.

renovate-release · 2020-10-20T09:13:39Z

🎉 This issue has been resolved in version 23.55.0 🎉

The release is available on:

GitHub release
23.55.0

Your semantic-release bot 📦🚀

viceice added manager:github-actions Github actions manager good first issue Suitable for new contributors ready priority-4-low Low priority, unlikely to be done unless it becomes important to more people labels Mar 17, 2020

renovatebot deleted a comment from ZHEL12 Mar 21, 2020

jdbruijn mentioned this issue Mar 27, 2020

Setup using GitHub personal access token renovatebot/config-help#570

Closed

squarebracket mentioned this issue May 7, 2020

Support multiple registries (#13) Azure/docker-login#14

Merged

ChristianMurphy mentioned this issue Jun 9, 2020

CI: Upgrade GHA artefact upload action openequella/openEQUELLA#1793

Merged

2 tasks

rarkins removed the ready label Jun 18, 2020

yurake mentioned this issue Jul 31, 2020

Passing repository-changed error up(branch="renovate/actions-checkout-2.x") #6890

Closed

whilp mentioned this issue Sep 13, 2020

Renovate and pin non docker actions whilp/world#355

Open

JamieMagee added the hacktoberfest label Sep 23, 2020

srueg mentioned this issue Oct 8, 2020

Automated update of GitHub Actions projectsyn/commodore#210

Closed

2 tasks

rarkins assigned RichiCoder1 Oct 9, 2020

RichiCoder1 mentioned this issue Oct 9, 2020

feat: add github-actions tag support #7434

Merged

rarkins closed this as completed in #7434 Oct 20, 2020

renovate-release added the released label Oct 20, 2020

github-actions bot locked as resolved and limited conversation to collaborators Dec 15, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support to update action in GitHub Actions workflow #5733

Add support to update action in GitHub Actions workflow #5733

vidavidorra commented Mar 17, 2020

ikesyo commented Apr 7, 2020

ikesyo commented Apr 8, 2020

rarkins commented Apr 8, 2020

ikesyo commented Apr 8, 2020 •

edited

Loading

viceice commented Apr 8, 2020

rarkins commented Apr 8, 2020

viceice commented Apr 8, 2020

rarkins commented Apr 8, 2020

fabianbru commented Jun 26, 2020

rarkins commented Jun 26, 2020

mrlubos commented Aug 28, 2020

viceice commented Aug 28, 2020 •

edited

Loading

rarkins commented Aug 28, 2020

RichiCoder1 commented Oct 9, 2020

rarkins commented Oct 9, 2020

RichiCoder1 commented Oct 9, 2020

rarkins commented Oct 9, 2020

RichiCoder1 commented Oct 9, 2020

RichiCoder1 commented Oct 9, 2020

renovate-release commented Oct 20, 2020

Add support to update action in GitHub Actions workflow #5733

Add support to update action in GitHub Actions workflow #5733

Comments

vidavidorra commented Mar 17, 2020

ikesyo commented Apr 7, 2020

ikesyo commented Apr 8, 2020

rarkins commented Apr 8, 2020

ikesyo commented Apr 8, 2020 • edited Loading

viceice commented Apr 8, 2020

rarkins commented Apr 8, 2020

viceice commented Apr 8, 2020

rarkins commented Apr 8, 2020

fabianbru commented Jun 26, 2020

rarkins commented Jun 26, 2020

mrlubos commented Aug 28, 2020

viceice commented Aug 28, 2020 • edited Loading

rarkins commented Aug 28, 2020

RichiCoder1 commented Oct 9, 2020

rarkins commented Oct 9, 2020

RichiCoder1 commented Oct 9, 2020

rarkins commented Oct 9, 2020

RichiCoder1 commented Oct 9, 2020

RichiCoder1 commented Oct 9, 2020

renovate-release commented Oct 20, 2020

ikesyo commented Apr 8, 2020 •

edited

Loading

viceice commented Aug 28, 2020 •

edited

Loading