ci(renovate): update dependencies and release weekly #29

Merged

ryan.mcgee merged 3 commits from ci/renovate into main 2026-10-20 20:38:05 +00:00

Conversation 0 Commits 3 Files changed 9 +406 -15

ryan.mcgee commented 2026-10-20 20:19:46 +00:00

Owner

Copy link

Summary

• Dependencies were not kept up to date and releases were manual. Renovate now opens update PRs and the forge merges them once CI passes; every Monday a job cuts a release if files that ship have changed since the latest one, and otherwise the latest release stands.
• Follows the helm repo for Renovate (self-hosted pinned image, forgejo platform, forge-side automerge) and keeps the existing tag-driven release workflow as the publisher.

Changes

• renovate.json: managers mix, dockerfile, github-actions and a regex manager for the annotated esbuild/tailwind versions in config/config.exs; automerge for patch and minor (squash, 3 day release age); majors stay manual. The hexpm/elixir toolchain is excluded: it moves with .tool-versions, CI cache keys and PLTs. The Debian runtime tag (trixie-YYYYMMDD-slim) has a regex versioning so the date orders and the release (trixie) never changes. The helm repo's workaround for this forge's 404 on branch statuses of slash-named branches (ignoreTests, statusCheckWhen) is included. Renovate does not touch the version.
• .github/workflows/renovate.yml: daily and manual run with RENOVATE_TOKEN and RENOVATE_GITHUB_COM_TOKEN.
• scripts/propose-release.sh and .github/workflows/weekly-release.yml: every Monday, if commits since the latest x.y.z tag changed shipped files (what the Containerfile copies: lib, priv, assets, config, mix.exs, mix.lock, plus the Containerfile; not config/dev.exs, config/test.exs, priv/repo/seeds.exs), open a chore(release): bump version to x.y.z PR (those commits listed) and set it to merge when the required checks pass. The bump follows the conventional commits: breaking (! or BREAKING CHANGE:) raises the major, feat the minor, anything else (dependency updates, fixes, performance) the patch. Tests, docs, CI, scripts and tooling changes never cause a release. No shipped change, an existing bump branch, or a mix.exs already ahead of the latest tag: do nothing.
• scripts/tag-release.sh and .github/workflows/tag.yml: on every push to main, tag the commit with the mix.exs version if it is untagged and higher than every release; release.yml then publishes. Pushed with RENOVATE_TOKEN (a real account), because the job token may not start the tag-triggered workflow.
• .github/workflows/development.yml: ignore chore/deps-* and chore/release-* branches so automation does not take the shared development tag.
• config/config.exs: # renovate: annotations on the two tool versions.
• README: dependency updates and release sections.

Verification

• renovate-config-validator --strict renovate.json passes (Renovate 44.167.5, the pinned image).
• Local --platform=local --dry-run=lookup with the config: extracts 31 Hex dependencies, the Debian image, the actions and both annotated tools; the toolchain image is disabled; finds real updates (phoenix, phoenix_live_view, bandit patch, ecto_sqlite3 minor, esbuild patch). GitHub-hosted lookups report github-token-required locally only because no token was given; the workflow supplies one. Debian regex checked against Docker Hub (trixie-20261005-slim is the newest, so no update is correct).
• propose-release.sh against throwaway remotes with a stubbed curl: docs-only, tests-only, CI/scripts-only and dev-only config and seeds changes leave the release standing; a feat that touches no shipped file does too; a mix.lock dependency update, a fix, a perf change and a Containerfile change propose a patch bump; feat in lib or priv a minor; fix!: and a BREAKING CHANGE: footer a major; deps plus feat plus fix a minor. A full run pushes the bumped branch with the right commit and makes exactly two API calls (create PR, merge when checks succeed); a second run does not duplicate; 1.9.0 proposes 1.10.0; a version ahead of the tag stays pending; dry runs push nothing.
• tag-release.sh against a throwaway remote: first version tagged; already tagged is a no-op; a lower version is refused; 1.10.0 ranks above 1.1.0; no token fails. This found and fixed a pipefail bug when no release tag exists.
• shellcheck -x, actionlint, mix format --check-formatted, mix compile --warnings-as-errors clean.
• Not run: an actual Renovate run against the forge, mix.lock regeneration, the forge honouring merge_when_checks_succeed for the bump PR, and the tag-triggered release from tag.yml.

## Summary - Dependencies were not kept up to date and releases were manual. Renovate now opens update PRs and the forge merges them once CI passes; every Monday a job cuts a release if files that ship have changed since the latest one, and otherwise the latest release stands. - Follows the helm repo for Renovate (self-hosted pinned image, `forgejo` platform, forge-side automerge) and keeps the existing tag-driven release workflow as the publisher. ## Changes - `renovate.json`: managers `mix`, `dockerfile`, `github-actions` and a regex manager for the annotated `esbuild`/`tailwind` versions in `config/config.exs`; automerge for patch and minor (squash, 3 day release age); majors stay manual. The `hexpm/elixir` toolchain is excluded: it moves with `.tool-versions`, CI cache keys and PLTs. The Debian runtime tag (`trixie-YYYYMMDD-slim`) has a regex versioning so the date orders and the release (trixie) never changes. The helm repo's workaround for this forge's 404 on branch statuses of slash-named branches (`ignoreTests`, `statusCheckWhen`) is included. Renovate does not touch the version. - `.github/workflows/renovate.yml`: daily and manual run with `RENOVATE_TOKEN` and `RENOVATE_GITHUB_COM_TOKEN`. - `scripts/propose-release.sh` and `.github/workflows/weekly-release.yml`: every Monday, if commits since the latest `x.y.z` tag changed shipped files (what the `Containerfile` copies: `lib`, `priv`, `assets`, `config`, `mix.exs`, `mix.lock`, plus the `Containerfile`; not `config/dev.exs`, `config/test.exs`, `priv/repo/seeds.exs`), open a `chore(release): bump version to x.y.z` PR (those commits listed) and set it to merge when the required checks pass. The bump follows the conventional commits: breaking (`!` or `BREAKING CHANGE:`) raises the major, `feat` the minor, anything else (dependency updates, fixes, performance) the patch. Tests, docs, CI, scripts and tooling changes never cause a release. No shipped change, an existing bump branch, or a `mix.exs` already ahead of the latest tag: do nothing. - `scripts/tag-release.sh` and `.github/workflows/tag.yml`: on every push to `main`, tag the commit with the `mix.exs` version if it is untagged and higher than every release; `release.yml` then publishes. Pushed with `RENOVATE_TOKEN` (a real account), because the job token may not start the tag-triggered workflow. - `.github/workflows/development.yml`: ignore `chore/deps-*` and `chore/release-*` branches so automation does not take the shared `development` tag. - `config/config.exs`: `# renovate:` annotations on the two tool versions. - README: dependency updates and release sections. ## Verification - `renovate-config-validator --strict renovate.json` passes (Renovate 44.167.5, the pinned image). - Local `--platform=local --dry-run=lookup` with the config: extracts 31 Hex dependencies, the Debian image, the actions and both annotated tools; the toolchain image is `disabled`; finds real updates (`phoenix`, `phoenix_live_view`, `bandit` patch, `ecto_sqlite3` minor, `esbuild` patch). GitHub-hosted lookups report `github-token-required` locally only because no token was given; the workflow supplies one. Debian regex checked against Docker Hub (`trixie-20261005-slim` is the newest, so no update is correct). - `propose-release.sh` against throwaway remotes with a stubbed `curl`: docs-only, tests-only, CI/scripts-only and dev-only config and seeds changes leave the release standing; a `feat` that touches no shipped file does too; a `mix.lock` dependency update, a fix, a perf change and a `Containerfile` change propose a patch bump; `feat` in `lib` or `priv` a minor; `fix!:` and a `BREAKING CHANGE:` footer a major; deps plus feat plus fix a minor. A full run pushes the bumped branch with the right commit and makes exactly two API calls (create PR, merge when checks succeed); a second run does not duplicate; `1.9.0` proposes `1.10.0`; a version ahead of the tag stays pending; dry runs push nothing. - `tag-release.sh` against a throwaway remote: first version tagged; already tagged is a no-op; a lower version is refused; `1.10.0` ranks above `1.1.0`; no token fails. This found and fixed a `pipefail` bug when no release tag exists. - `shellcheck -x`, `actionlint`, `mix format --check-formatted`, `mix compile --warnings-as-errors` clean. - Not run: an actual Renovate run against the forge, `mix.lock` regeneration, the forge honouring `merge_when_checks_succeed` for the bump PR, and the tag-triggered release from `tag.yml`.

ryan.mcgee added 1 commit 2026-10-20 20:19:46 +00:00

ci(renovate): update dependencies and cut releases ... db3c2308ec

- run a pinned self-hosted Renovate daily for Hex packages, the
  esbuild and tailwind versions, the Debian runtime image, GitHub
  actions and the Renovate image
- automerge patch and minor updates once the required checks pass
- raise the minor version in mix.exs with every update that changes
  what ships
- tag main when a merge raises the version above the latest release,
  which starts the existing release workflow
- skip development images for Renovate branches

ryan.mcgee changed title from ci(renovate): update dependencies and cut releases to ci(renovate): update dependencies and release weekly 2026-10-20 20:24:13 +00:00

ryan.mcgee added 1 commit 2026-10-20 20:24:14 +00:00

ci(release): cut a release weekly when main changed ... d648008d59

- replace the per-update version bump with a weekly job that opens
  a version bump pull request when main has commits since the
  latest release, set to merge once checks pass
- leave the latest release standing when nothing changed
- skip development images for release bump branches

ryan.mcgee added 1 commit 2026-10-20 20:28:17 +00:00

ci(release): release only for changed shipped files ... 784734a4bf

- count only commits that changed what the Containerfile copies
  (lib, priv, assets, config, mix.exs, mix.lock) or the Containerfile
  itself, minus dev and test only files
- size the bump from conventional commits: breaking changes raise
  the major, feat the minor, everything else (dependency updates,
  fixes) the patch

ryan.mcgee merged commit 6fd79e95a7 into main 2026-10-20 20:38:05 +00:00

ryan.mcgee deleted branch ci/renovate 2026-10-20 20:38:05 +00:00

ryan.mcgee referenced this pull request from a commit 2026-10-20 20:38:06 +00:00

ci(renovate): update dependencies and release weekly (#29)

renovate-bot referenced this pull request 2026-10-21 14:06:34 +00:00

chore(release): bump version to 1.1.0 #35

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

White_Ghost_Cyber_Systems/traefik-control!29

No description provided.