From 8186cb81afcea983b9cfaad564ef964217606ef3 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Mon, 20 Jul 2026 14:29:18 +0100 Subject: [PATCH 1/3] feat(CI): Add force-update input to Renovate workflow Adds an optional `packages` workflow_dispatch input that force-enables the named packages for a single run via RENOVATE_FORCE, allowing out-of-band bumps despite the security-only-updates preset. Empty input leaves scheduled runs unchanged. beep boop --- .github/workflows/renovate.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 20722e91f5d7..25bd69e4978f 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -3,7 +3,12 @@ name: Renovate on: schedule: - cron: '0 3 * * *' - workflow_dispatch: {} + workflow_dispatch: + inputs: + packages: + description: 'Comma-separated packages to force-update out of band (leave empty for a normal run)' + required: false + type: string permissions: contents: read @@ -27,10 +32,21 @@ jobs: app-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }} private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }} + - name: Compute Renovate force override + id: force + env: + PACKAGES: ${{ inputs.packages }} + run: | + if [ -n "$PACKAGES" ]; then + names=$(jq -Rc 'split(",") | map(gsub("^\\s+|\\s+$";"")) | map(select(length > 0))' <<< "$PACKAGES") + printf 'value={"packageRules":[{"matchPackageNames":%s,"enabled":true,"rangeStrategy":"bump"}]}\n' "$names" >> "$GITHUB_OUTPUT" + fi + - name: Run Renovate uses: renovatebot/github-action@v46.1.14 env: RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }} + RENOVATE_FORCE: ${{ steps.force.outputs.value }} RENOVATE_REPOSITORIES: ${{ github.repository }} RENOVATE_GIT_AUTHOR: ${{ vars.RENOVATE_GIT_AUTHOR }} RENOVATE_HOST_RULES: >- From 4d49c3c39d42ccb4011e625580867472c0bdfba9 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Mon, 20 Jul 2026 15:37:43 +0100 Subject: [PATCH 2/3] pin actions to SHAs --- .github/workflows/renovate.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 25bd69e4978f..a51e665cc06f 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -2,11 +2,11 @@ name: Renovate on: schedule: - - cron: '0 3 * * *' + - cron: "0 3 * * *" workflow_dispatch: inputs: packages: - description: 'Comma-separated packages to force-update out of band (leave empty for a normal run)' + description: "Comma-separated packages to force-update out of band (leave empty for a normal run)" required: false type: string @@ -27,9 +27,9 @@ jobs: - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v1 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 with: - app-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }} + client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }} private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }} - name: Compute Renovate force override @@ -43,7 +43,7 @@ jobs: fi - name: Run Renovate - uses: renovatebot/github-action@v46.1.14 + uses: renovatebot/github-action@3064367f740a1a91cca218698a63902689cce200 env: RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }} RENOVATE_FORCE: ${{ steps.force.outputs.value }} From 3de7669d800eff7500fd513cef568d47a958cc93 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Mon, 20 Jul 2026 17:08:20 +0100 Subject: [PATCH 3/3] ci(Renovate): Compute force override in Python instead of jq Replaces the jq/shell snippet with a `shell: python` step. Keeps the input in an env var rather than interpolating it into the script body, avoiding injection. beep boop --- .github/workflows/renovate.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index a51e665cc06f..ea6dcb12e590 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -34,13 +34,16 @@ jobs: - name: Compute Renovate force override id: force + shell: python env: PACKAGES: ${{ inputs.packages }} run: | - if [ -n "$PACKAGES" ]; then - names=$(jq -Rc 'split(",") | map(gsub("^\\s+|\\s+$";"")) | map(select(length > 0))' <<< "$PACKAGES") - printf 'value={"packageRules":[{"matchPackageNames":%s,"enabled":true,"rangeStrategy":"bump"}]}\n' "$names" >> "$GITHUB_OUTPUT" - fi + import json, os + names = [n for part in os.environ["PACKAGES"].split(",") if (n := part.strip())] + if names: + value = {"packageRules": [{"matchPackageNames": names, "enabled": True, "rangeStrategy": "bump"}]} + with open(os.environ["GITHUB_OUTPUT"], "a") as f: + f.write(f"value={json.dumps(value)}\n") - name: Run Renovate uses: renovatebot/github-action@3064367f740a1a91cca218698a63902689cce200