Renovate is a helpful tool that updates your dependencies automatically. This is cool, because it means you don’t have to track updates to your dependencies manually, which let’s be honest never really work. Renovate will just create a new merge request as soon as it detects an update.

This is particularly relevant now, with more and more vulnerabilities being detected in our software supply chain every day.

Setting things up

Renovate is super easy to set up by using its CLI in a GitLab pipeline.

The only particular point is that this needs to run in a repo that not everyone has access to, as it uses a GitLab access token to create MRs, so it is now in the sysadmin/renovate-bot in invent.

Rust

Renovate supports Cargo as a package manager by default, so the configuration is extremely short and the repos with Rust just need to be listed in kde-renovate.

If you maintain a Rust project, feel free to open a merge request to list your project there.

Craft

Craft is the most interesting project to benefit from this, as it is used to build our binaries for Android, Windows, macOS and more. It is also the most complex, as Renovate doesn’t natively support Craft, nor does it have a way to retrieve updates from Anitya, only from GitLab, GitHub, pip and other sources.

Adding Anitya support was easy with a custom data source:

  "customDatasources": {
    "release-monitoring": {
      "defaultRegistryUrlTemplate": "https://release-monitoring.org/api/v2/versions/?project_id={{{packageName}}}",
      "format": "json",
      "transformTemplates": [
        "{\"releases\": [stable_versions.{\"version\": $}]}"
      ]
    }
  },

This uses the releaseManagerId from the blueprints to match each blueprint to a project on Anitya.

Updating the blueprints is trickier, as they are written in Python, so I had to write a small script using Python’s ast module to modify them. It is a bit cursed, but it works as long as the blueprints follow the common structure with for ver in ["x.x.x", "y.y.y"]:.

The next step is to make sure all Craft blueprints contain a releaseManagerId, and this is where help would be much appreciated also checking that the PRs created by Renovate are correct and the new updated package build on every of our platforms.

Huge thanks to Ben and Hannah for setting this up and happy hacking!