mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-10-14 10:24:16 +00:00
Slavi PantaleevandClaude Opus 5.5
4baf6d8f73
docs/ansible.md pins a ghcr.io/devture/ansible tag in its `docker run` examples, which used to be bumped by hand. devture/docker-ansible now tags releases automatically, so Renovate can propose them. The devcontainer's Dockerfile, already seen by the dockerfile manager, gets updated in the same pull request. The image's tags (`<Alpine ansible package version>-<release>`) need regex versioning: Docker versioning would treat `-r0-3` as a compatibility suffix and never offer `-r0-4`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
80 lines
2.9 KiB
Bash
Executable File
80 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
set -euo pipefail
|
|
|
|
repo_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
|
|
# An optional image version lets maintainers reproduce failures before changing the pin.
|
|
mapfile -t versions < <(
|
|
sed -n "s/^ MATRIX_RENOVATE_VERSION: '\([^']*\)'$/\1/p" \
|
|
"$repo_dir/.github/workflows/renovate.yml"
|
|
)
|
|
if (( ${#versions[@]} != 1 )) || [[ -z "${versions[0]}" ]]; then
|
|
echo 'Could not resolve exactly one pinned Renovate version' >&2
|
|
exit 1
|
|
fi
|
|
version="${1:-${versions[0]}}"
|
|
image="ghcr.io/renovatebot/renovate:$version"
|
|
log_file="$(mktemp)"
|
|
trap 'rm -f -- "$log_file"' EXIT
|
|
|
|
# Use the image's normal entrypoint for extraction, loading the real runtime.
|
|
# No credentials or network are needed for validation and dependency extraction.
|
|
docker_args=(
|
|
--rm
|
|
--network none
|
|
--volume "$repo_dir:/workspace:ro"
|
|
--workdir /workspace
|
|
--env NODE_OPTIONS=--unhandled-rejections=strict
|
|
)
|
|
|
|
echo "Validating configuration with $image"
|
|
docker run "${docker_args[@]}" \
|
|
--entrypoint renovate-config-validator \
|
|
"$image" --strict
|
|
|
|
echo "Extracting dependencies with $image"
|
|
docker run "${docker_args[@]}" \
|
|
--env LOG_LEVEL=info \
|
|
--env LOG_FORMAT=json \
|
|
"$image" --platform=local --dry-run=extract \
|
|
| tee "$log_file"
|
|
|
|
# Exit status alone is insufficient: 44.64.0 crashed at startup but exited 0.
|
|
# Require completion and useful results from every manager used by this repository.
|
|
# The missing-token warning is expected: extraction needs no GitHub API access.
|
|
if ! jq --slurp --exit-status '
|
|
all(.[]; .level < 50)
|
|
and any(.[]; .msg == "Repository finished" and .repository == "local")
|
|
and any(.[];
|
|
.msg == "Dependency extraction complete"
|
|
and (.stats.managers as $managers
|
|
| all(["ansible-galaxy", "dockerfile", "github-actions", "mise", "nix", "pip_requirements", "pre-commit", "regex"][];
|
|
$managers[.].depCount > 0))
|
|
)
|
|
and any(.[];
|
|
.msg == "Extracted dependencies"
|
|
and any(.packageFiles["ansible-galaxy"][]?;
|
|
.packageFile == "requirements.yml" and (.deps | length) > 0)
|
|
and any(.packageFiles.regex[]?;
|
|
(.packageFile | startswith("roles/custom/")) and (.deps | length) > 0)
|
|
and any(.packageFiles.regex[]?;
|
|
.packageFile == "molecule-shared/vars.yml" and (.deps | length) > 0)
|
|
and any(.packageFiles.regex[]?.deps[]?;
|
|
.depName == "matrix-renovate-runner" and .datasource == "docker")
|
|
)
|
|
and any(.[];
|
|
.msg == "Extracted dependencies"
|
|
and any(.packageFiles.regex[]?.deps[]?;
|
|
.depName == "ghcr.io/devture/ansible" and .datasource == "docker")
|
|
)
|
|
' "$log_file"; then
|
|
echo 'Renovate did not complete dependency extraction successfully' >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Renovate $version passed configuration validation and dependency extraction"
|