Cool Renovate Bot Features
12 Feb 2024 | ci azure devops nugetLast month I wrote about how cool Renovate Bot is, updating the dependencies in your repositories. It works anywhere, I got it to work in Azure DevOps Pipelines running every night at 3 AM, while everyone is sleeping and no one else is using the build agents for important stuff.
I initially did a couple of things, that I changed later on, after getting a bit more familiar with how Renovate Bot works. I will go through some of the discoveries I did and how I configure it in the end, in this blog post. Hopefully you find this useful đ
Configuration and pipeline can live in its own repo
Initially I had the renovate bot configuration and pipeline living in the same repository of the code I wanted it to run against. This is entirely not necessary and it can live in its own repository and have a base configuration, for things such as authentication in this repository.
So now I have a repository called RenovateBot with two files in it:
azure-pipelines.ymlthe pipeline for running the bot (see the previous post on how I set that up)config.jsthe configuration for the bot
When running, Renovate already knows how to check out files in the repositories you tell it to scan, in the config file. So you donât need to run it in the code repositories, you want to scan for updates.
In the config.js file I now simply have something like:
module.exports = {
hostRules: [
{
hostType: 'nuget',
matchHost: 'https://pkgs.dev.azure.com/myorg/',
username: 'user',
password: process.env.NUGET_TOKEN
},
],
repositories: [
'myorg/repo1',
'myorg/repo2',
'myorg/repo3'
]
};
It will scan all those repositories defined in the repositories collection.
Neat!
You can have repository specific configs
For each repository you define, apart from the basic configuration you provide for renovate, you can add additional configuration. I use this to add tags and group Pull Requests made by Renovate for dependencies that group together. For instance for Unit Test dependencies.
So in each repository you can add a renovate.json file with additional configuration. This is the same file that Renovate creates initially on a repository on the first Pull Request it makes.
Here is an example of what a configuration for one of my repositories looks like:
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"azureWorkItemId": 123456,
"prHourlyLimit": 0,
"labels": ["dependencies"],
"automerge": true,
"packageRules": [
{
"matchPackagePatterns": [
"Cake.*",
"dotnet-sonarscanner",
"dotnet-reportgenerator-globaltool"
],
"groupName": "CI",
"addLabels": [
"CI"
]
},
{
"matchPackagePatterns": [
".*xunit.*",
"Moq.*",
"AutoFixture.*",
"liquidtestreports.*",
"Microsoft.NET.Test.SDK",
"Microsoft.Reactive.Testing",
"MvvmCross.Tests",
"Xamarin.UITest",
"coverlet.*",
"MSTest.*",
"System.IO.Abstractions.*"
],
"groupName": "Unit Test",
"addLabels": [
"Unit Test"
]
}
}
Letâs go through some of the options here.
azureWorkItemIdwill add the specific work item Id to every Pull Request it creates. This is especially useful if you have a policy set on your Pull Request to always link a work itemprHourlyLimitIâve set this one to 0, such that Renovate Bot can create as many Pull Requests it wants on a repository. Otherwise, I think the default is 2. So if you wonder why it didnât update all dependencies, this could by whylabelsThis option lets you set default labels on pull requests, so for each of my Pull Requests made by Renovate it will have thedependencieslabel on itautomergeThis option will set Auto Complete in Azure DevOps on a Pull Request using the default merge strategy, such that you can have Pull Requests automatically merge when all checks are completedpackageRulesIs super powerful. Here you can limit which packages you want to be grouped together, in the case above I have two groups.Unit TestandCI, which will look for specific regex patterns of package names to include in the groups. I also add additional labels for these two groups usingaddLabelsand assigngroupNamesuch that when Renovate creates a Pull Request for a group, the title will beUpdate <group name>. There are many more options you can set onpackageRules, you should refer to the docs if you want more info.
You can scan many types of project types
So far I have scanned .NET projects and Kotlin projects with Renovate Bot and it handles these very well without any issues. I simply add additional repositories in the config.js file and on next run or when I run the pipeline manually it adds a renovate.json file to the repository and it is good to go.
Some Azure DevOps annoyances
When using System.AccessToken as your Renovate Token, the Pull Requests are opened by the user Project Collection Build Service (myorg). This user is built into Azure DevOps and does not have any e-mail assigned to it and you cannot change it either. If you have âCommit author email validationâ enabled on a repo, you will need to add both the renovate bot email (or the one youâve defined in your config) along with the Project Collection user like so: [email protected]; Project Collection Build Service (myorg) to the allowed commit author email patterns. Otherwise auto completion on Pull Requests will not work as it will violate one of the repository policies.
