From 7f4cbdf057f06bf3cbcc06b7265501f568990cae Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Sat, 29 Aug 2026 15:05:57 +0100 Subject: [PATCH] Pin CI tools and manage dependency updates with Renovate --- .github/dependabot.yml | 12 --------- .github/renovate.json5 | 44 ++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 7 ++++- .github/workflows/publish.yml | 2 +- .github/workflows/third_party.yml | 45 ++++++++++++++++++++++++------- .pre-commit-config.yaml | 11 ++++++-- 6 files changed, 96 insertions(+), 25 deletions(-) delete mode 100644 .github/dependabot.yml create mode 100644 .github/renovate.json5 diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 2e4b9645..00000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,12 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: monthly - groups: - actions: - patterns: - - "*" - cooldown: - default-days: 7 diff --git a/.github/renovate.json5 b/.github/renovate.json5 new file mode 100644 index 00000000..54433b1b --- /dev/null +++ b/.github/renovate.json5 @@ -0,0 +1,44 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["schedule:monthly", "helpers:pinGitHubActionDigestsToSemver"], + "dependencyDashboard": true, + "enabledManagers": ["github-actions", "custom.regex", "pre-commit", "pep621"], + "pre-commit": { + "enabled": true + }, + "minimumReleaseAge": "7 days", + "packageRules": [ + { + // Pin versions already in use without waiting for the upgrade cooldown. + "matchUpdateTypes": ["pinDigest"], + "minimumReleaseAge": null + }, + { + // Preserve Python versions, runners, and containers. The custom manager + // handles tool inputs so uv's version and checksum are updated together. + "matchManagers": ["github-actions"], + "matchDepTypes": ["uses-with", "github-runner", "docker", "container", "service"], + "enabled": false + }, + { + // Only manage build requirements; preserve Python support and library dependencies. + "matchManagers": ["pep621"], + "matchDepTypes": ["!build-system.requires"], + "enabled": false + }, + { + "matchManagers": ["github-actions", "custom.regex", "pre-commit", "pep621"], + "groupName": "CI dependencies" + } + ], + "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": ["/^\\.github/workflows/(ci|third_party)\\.yml$/"], + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)\\s+version: \"(?[^\"\\r\\n]+)\"(?:\\s+checksum: \"(?[a-f0-9]{64})\")?" + ], + "versioningTemplate": "semver" + } + ] +} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 74c35186..a1851360 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,9 +30,12 @@ jobs: with: persist-credentials: false - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: "3.14" - name: Build docs in nitpicky mode @@ -119,6 +122,8 @@ jobs: github.repository == 'python/typing_extensions' && (github.event_name == 'push' || github.event_name == 'pull_request') with: + # renovate: datasource=github-releases depName=codecov/codecov-cli + version: "v11.3.1" use_oidc: true flags: ${{ matrix.python-version }} directory: src diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6ca7c2e1..bcf9b51f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -159,4 +159,4 @@ jobs: - name: Ensure exactly one sdist and one wheel have been downloaded run: test "$(find dist/*.tar.gz | wc -l | xargs)" = 1 && test "$(find dist/*.whl | wc -l | xargs)" = 1 - name: Publish distribution to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 diff --git a/.github/workflows/third_party.yml b/.github/workflows/third_party.yml index c528d2df..77a874a4 100644 --- a/.github/workflows/third_party.yml +++ b/.github/workflows/third_party.yml @@ -51,9 +51,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Checkout pydantic run: git clone --depth=1 https://github.com/pydantic/pydantic.git || git clone --depth=1 https://github.com/pydantic/pydantic.git @@ -84,9 +87,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Checkout typing_inspect run: git clone --depth=1 https://github.com/ilevkivskyi/typing_inspect.git || git clone --depth=1 https://github.com/ilevkivskyi/typing_inspect.git @@ -119,9 +125,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Check out pycroscope run: git clone --depth=1 https://github.com/JelleZijlstra/pycroscope.git || git clone --depth=1 https://github.com/JelleZijlstra/pycroscope.git @@ -154,9 +163,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Check out typeguard run: git clone --depth=1 https://github.com/agronholm/typeguard.git || git clone --depth=1 https://github.com/agronholm/typeguard.git @@ -192,9 +204,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Check out typed-argument-parser run: git clone --depth=1 https://github.com/swansonk14/typed-argument-parser.git || git clone --depth=1 https://github.com/swansonk14/typed-argument-parser.git @@ -235,9 +250,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Checkout mypy for stubtest and mypyc tests run: git clone --depth=1 https://github.com/python/mypy.git || git clone --depth=1 https://github.com/python/mypy.git @@ -271,9 +289,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Checkout cattrs run: git clone --depth=1 https://github.com/python-attrs/cattrs.git || git clone --depth=1 https://github.com/python-attrs/cattrs.git @@ -309,9 +330,12 @@ jobs: runs-on: ubuntu-22.04 timeout-minutes: 60 steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Checkout sqlalchemy run: git clone -b ${{ matrix.checkout-ref }} --depth=1 https://github.com/sqlalchemy/sqlalchemy.git || git clone -b ${{ matrix.checkout-ref }} --depth=1 https://github.com/sqlalchemy/sqlalchemy.git @@ -341,9 +365,12 @@ jobs: # As of 2 November 2025 a dependency is missing 3.14 wheels python-version: [ "3.11", "3.12", "3.13" ] steps: - - name: Install the latest version of uv + - name: Install uv uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: + # renovate: datasource=github-release-attachments depName=astral-sh/uv + version: "0.12.7" + checksum: "788f18abea7c5f55d6216e4f5613fd89d4d59b631efeec117b2b07fe72f1da21" python-version: ${{ matrix.python-version }} - name: Checkout litestar run: git clone --depth=1 https://github.com/litestar-org/litestar.git || git clone --depth=1 https://github.com/litestar-org/litestar.git diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 870794fb..22b01713 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -24,18 +24,25 @@ repos: - repo: https://github.com/python-jsonschema/check-jsonschema rev: 6b63472e72e1a91ed8a2f6d483790dfb644fa1d3 # frozen: 0.37.4 hooks: - - id: check-dependabot + - id: check-renovate + # Renovate needs an explicit language to update additional_dependencies. + language: python + additional_dependencies: ["json5==0.15.0"] - id: check-github-workflows - id: check-readthedocs - repo: https://github.com/abravalheri/validate-pyproject rev: 4b2e70d08cb2ccd26d1fba73588de41c7a5d50b7 # frozen: v0.25 hooks: - id: validate-pyproject - additional_dependencies: ["validate-pyproject-schema-store[all]"] + # Renovate needs an explicit language to update additional_dependencies. + language: python + additional_dependencies: ["validate-pyproject-schema-store[all]==2026.8.15"] - repo: https://github.com/rhysd/actionlint rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # frozen: v1.7.12 hooks: - id: actionlint + # Renovate needs an explicit language to update additional_dependencies. + language: golang additional_dependencies: # actionlint has a shellcheck integration which extracts shell scripts in `run:` steps from GitHub Actions # and checks these with shellcheck. This is arguably its most useful feature,