mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-09-17 21:30:09 +00:00
75 lines
2.7 KiB
Bash
Executable File
75 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
set -euo pipefail
|
|
|
|
repo_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
|
|
# An optional image version lets maintainers reproduce failures before changing the pin.
|
|
mapfile -t versions < <(
|
|
sed -n "s/^ MATRIX_RENOVATE_VERSION: '\([^']*\)'$/\1/p" \
|
|
"$repo_dir/.github/workflows/renovate.yml"
|
|
)
|
|
if (( ${#versions[@]} != 1 )) || [[ -z "${versions[0]}" ]]; then
|
|
echo 'Could not resolve exactly one pinned Renovate version' >&2
|
|
exit 1
|
|
fi
|
|
version="${1:-${versions[0]}}"
|
|
image="ghcr.io/renovatebot/renovate:$version"
|
|
log_file="$(mktemp)"
|
|
trap 'rm -f -- "$log_file"' EXIT
|
|
|
|
# Use the image's normal entrypoint for extraction, loading the real runtime.
|
|
# No credentials or network are needed for validation and dependency extraction.
|
|
docker_args=(
|
|
--rm
|
|
--network none
|
|
--volume "$repo_dir:/workspace:ro"
|
|
--workdir /workspace
|
|
--env NODE_OPTIONS=--unhandled-rejections=strict
|
|
)
|
|
|
|
echo "Validating configuration with $image"
|
|
docker run "${docker_args[@]}" \
|
|
--entrypoint renovate-config-validator \
|
|
"$image" --strict
|
|
|
|
echo "Extracting dependencies with $image"
|
|
docker run "${docker_args[@]}" \
|
|
--env LOG_LEVEL=info \
|
|
--env LOG_FORMAT=json \
|
|
"$image" --platform=local --dry-run=extract \
|
|
| tee "$log_file"
|
|
|
|
# Exit status alone is insufficient: 44.64.0 crashed at startup but exited 0.
|
|
# Require completion and useful results from every manager used by this repository.
|
|
# The missing-token warning is expected: extraction needs no GitHub API access.
|
|
if ! jq --slurp --exit-status '
|
|
all(.[]; .level < 50)
|
|
and any(.[]; .msg == "Repository finished" and .repository == "local")
|
|
and any(.[];
|
|
.msg == "Dependency extraction complete"
|
|
and (.stats.managers as $managers
|
|
| all(["ansible-galaxy", "dockerfile", "github-actions", "mise", "nix", "pip_requirements", "pre-commit", "regex"][];
|
|
$managers[.].depCount > 0))
|
|
)
|
|
and any(.[];
|
|
.msg == "Extracted dependencies"
|
|
and any(.packageFiles["ansible-galaxy"][]?;
|
|
.packageFile == "requirements.yml" and (.deps | length) > 0)
|
|
and any(.packageFiles.regex[]?;
|
|
(.packageFile | startswith("roles/custom/")) and (.deps | length) > 0)
|
|
and any(.packageFiles.regex[]?;
|
|
.packageFile == "molecule-shared/vars.yml" and (.deps | length) > 0)
|
|
and any(.packageFiles.regex[]?.deps[]?;
|
|
.depName == "matrix-renovate-runner" and .datasource == "docker")
|
|
)
|
|
' "$log_file"; then
|
|
echo 'Renovate did not complete dependency extraction successfully' >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Renovate $version passed configuration validation and dependency extraction"
|