Sync with upstream main

.github/actions/setup-node/action.yml

@@ -0,0 +1,60 @@
+name: 'Setup Node.js'
+description: 'Setup Node and install dependencies using cache'
+inputs:
+  save-cache:
+    description: 'Save cache when needed'
+    required: false
+    default: 'false'
+
+runs:
+  using: 'composite'
+
+  steps:
+    - name: ⚙️ Calculate `CACHE_KEY`
+      shell: bash
+      run: |
+        echo 'CACHE_KEY=node_modules-${{
+          hashFiles('.node-version', 'pnpm-lock.yaml')
+        }}' >> "$GITHUB_ENV"
+
+    - name: ♻️ Restore `node_modules`
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      id: node-modules-restore
+      with:
+        path: node_modules
+        key: ${{ env.CACHE_KEY }}
+        enableCrossOsArchive: true
+
+    - name: Calculate `CACHE_HIT`
+      shell: bash
+      run: |
+        echo 'CACHE_HIT=${{
+          (steps.node-modules-restore.outputs.cache-hit == 'true') && 'true' || ''
+        }}' >> "$GITHUB_ENV"
+
+    - name: ⚙️ Setup pnpm
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      with:
+        standalone: true
+
+    - name: ⚙️ Setup Node.js ${{ inputs.node-version }}
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      with:
+        node-version-file: .node-version
+        cache: ${{ env.CACHE_HIT != 'true' && 'pnpm' || '' }}
+
+    - name: 📥 Install dependencies
+      if: env.CACHE_HIT != 'true'
+      shell: bash
+      run: pnpm install --frozen-lockfile
+      env:
+        # Other environment variables
+        HUSKY: '0' # By default do not run HUSKY install
+
+    - name: ♻️ Write `node_modules` cache
+      if: inputs.save-cache == 'true' && env.CACHE_HIT != 'true'
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: node_modules
+        key: ${{ env.CACHE_KEY }}
+        enableCrossOsArchive: true

.github/renovate.json

@@ -2,18 +2,6 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["github>renovatebot/.github", ":pinDependencies"],
   "packageRules": [
-    {
-      "description": "Update references in Markdown files weekly",
-      "matchFileNames": ["**/*.md"],
-      "extends": ["schedule:weekly"],
-      "automerge": true,
-      "minimumReleaseAge": null,
-      "separateMajorMinor": false,
-      "commitMessageTopic": "references to {{{depName}}}",
-      "semanticCommitType": "docs",
-      "semanticCommitScope": null,
-      "additionalBranchPrefix": "docs-"
-    },
     {
       "description": "Use build semantic type for some deps",
       "matchPackageNames": ["@vercel/ncc", "typescript"],
@@ -28,12 +16,32 @@
       "description": "Use ci semantic type for some deps",
       "matchFileNames": [".github/workflows/**"],
       "semanticCommitType": "ci"
+    },
+    {
+      "description": "Don't require approval for renovate",
+      "matchPackageNames": [
+        "ghcr.io/renovatebot/renovate",
+        "renovatebot/github-action"
+      ],
+      "dependencyDashboardApproval": false
+    },
+    {
+      "description": "Don't pin renovate updates",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "pinDigests": false
+    },
+    {
+      "description": "Use feat! semantic type for renovate major",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(deps)!:",
+      "additionalBranchPrefix": "renovate-major"
     }
   ],
   "customManagers": [
     {
       "customType": "regex",
-      "fileMatch": ["^README\\.md$"],
+      "managerFilePatterns": ["README.md"],
       "matchStrings": [
         "uses: renovatebot/github-action@(?<currentValue>[^\\s]+)"
       ],
@@ -42,10 +50,26 @@
     },
     {
       "customType": "regex",
-      "fileMatch": ["^README\\.md$"],
+      "managerFilePatterns": ["README.md"],
       "matchStrings": ["renovate-version: (?<currentValue>[^\\s]+)"],
       "depNameTemplate": "ghcr.io/renovatebot/renovate",
       "datasourceTemplate": "docker"
+    },
+    {
+      "description": "Update renovate version in action.yml",
+      "customType": "regex",
+      "managerFilePatterns": ["action.yml"],
+      "matchStrings": ["default: '(?<currentValue>[^\\s]+)' # renovate"],
+      "depNameTemplate": "ghcr.io/renovatebot/renovate",
+      "datasourceTemplate": "docker"
+    },
+    {
+      "description": "Update renovate version in src/docker.ts",
+      "customType": "regex",
+      "managerFilePatterns": ["src/docker.ts"],
+      "matchStrings": ["version = '(?<currentValue>[^\\s]+)'; // renovate"],
+      "depNameTemplate": "ghcr.io/renovatebot/renovate",
+      "datasourceTemplate": "docker"
     }
   ]
 }

.github/workflows/build.yml

@@ -10,81 +10,77 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  NODE_VERSION: 20
-  RENOVATE_VERSION: 37.281.2 # renovate: datasource=docker depName=renovate packageName=ghcr.io/renovatebot/renovate
+  RENOVATE_VERSION: 43.123.8 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
 
 jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: false
+
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
+        with:
+          save-cache: true
+
   commitlint:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || github.repository_owner != github.event.pull_request.head.repo.owner.login }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           show-progress: false
           filter: blob:none # we don't need all blobs, only the full tree
 
       - name: Lint commit messages
-        uses: wagoid/commitlint-github-action@9763196e10f27aef304c9b8b660d31d97fce0f99 # v5.5.1
+        uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
         continue-on-error: true
 
   lint:
+    needs:
+      - prepare
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || github.repository_owner != github.event.pull_request.head.repo.owner.login }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: false
 
-      - name: enable corepack
-        run: corepack enable
-
-      - name: Setup node
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-
-      - name: enable corepack
-        run: corepack enable
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
 
-      - name: Install project
-        run: pnpm install --frozen-lockfile
       - name: Lint
         run: pnpm lint
 
   e2e:
+    needs:
+      - prepare
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || github.repository_owner != github.event.pull_request.head.repo.owner.login }}
 
     strategy:
       fail-fast: false
       matrix:
-        configurationFile: [example/renovate-config.js, example/renovate.json]
+        configurationFile:
+          - example/renovate-config.js
+          - example/renovate-config.json
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: false
 
-      - name: enable corepack
-        run: corepack enable
-
-      - name: Setup node
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-
-      - name: enable corepack
-        run: corepack enable
-
-      - name: Install project
-        run: pnpm install --frozen-lockfile
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
 
       - name: Build
         run: pnpm build
@@ -106,7 +102,6 @@ jobs:
           LOG_LEVEL: debug
         with:
           configurationFile: ${{ matrix.configurationFile }}
-          renovate-version: ${{ env.RENOVATE_VERSION }}
 
       - name: Renovate test with entrypoint
         uses: ./
@@ -118,20 +113,42 @@ jobs:
           docker-cmd-file: example/entrypoint.sh
           docker-user: root
 
+  renovate-config-validator:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    container:
+      image: ghcr.io/renovatebot/renovate:43.123.8@sha256:6c503f53f84038135f4a721bccbc7fd95099e4c66e6db6e40171e41dd413defe
+      # github hosted runners are running as `1001:127` (ubuntu:docker)
+      options: -u 1001:0 --group-add 1000 --group-add 12021 --group-add 127
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: false
+
+      - name: Validate Renovate configuration
+        working-directory: example
+        run: |
+          renovate-config-validator renovate-config.js renovate-config.json
+
   release:
-    needs: [lint, commitlint, e2e]
+    needs:
+      - lint
+      - commitlint
+      - e2e
+      - renovate-config-validator
     runs-on: ubuntu-latest
     steps:
       - name: Setup Git user
         shell: bash
         run: |
           git config --global core.autocrlf false
           git config --global core.symlinks true
-          git config --global user.email 'bot@renovateapp.com'
-          git config --global user.name  'Renovate Bot'
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # required for semantic release
           ref: 'release'
@@ -148,20 +165,8 @@ jobs:
           git merge --no-ff -Xtheirs -m 'skip: merge (${{ github.sha }}) [skip release]' ${{ github.sha }}
           commit=$(git rev-parse HEAD)
 
-      - name: enable corepack
-        run: corepack enable
-
-      - name: Setup node
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-
-      - name: enable corepack
-        run: corepack enable
-
-      - name: Install project
-        run: pnpm install --frozen-lockfile
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
 
       - name: Push release branch
         run: git push origin release:release

.github/workflows/pr-auto.yml

@@ -0,0 +1,18 @@
+name: auto-pr
+
+on:
+  pull_request_target:
+    types:
+      - opened
+
+jobs:
+  review:
+    if: github.event.action == 'opened' && !endsWith(github.event.pull_request.user.login, '[bot]')
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: hkusu/review-assign-action@5bee595fdb9765d4a0bd35724b6302fa15569158 # v1.4.0
+        with:
+          reviewers: ${{ vars.REVIEWERS }}
+          max-num-of-reviewers: 2