ci: self-hosted renovate by matthewelwell · Pull Request #7690 · Flagsmith/flagsmith

matthewelwell · 2026-06-02T18:27:03Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Adds a workflow to run a renovate docker container in GH actions directly in order to authenticate with CodeArtifact and generate uv.lock correctly.

Some pre-requisites:

Create a Github App for authentication

... and updates to complete after merge:

Disable Cloud Renovate from Flagsmith/flagsmith

How did you test this code?

With much much pain. Here is the evidence.

Result: a successfully generated PR by Renovate to update pytest dependency here.

Replaces the hosted Renovate GitHub App with a self-hosted workflow so that uv.lock can be updated correctly when private CodeArtifact packages are involved. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replaces the GH_PRIVATE_ACCESS_TOKEN PAT with a GitHub App token so that Renovate PRs and issues are attributed to the app bot identity rather than a personal account. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Prevents security PRs from being silently dropped when manually closed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Avoids pulling the Renovate Docker image on every run, which was adding significant overhead. Running via npx is faster and cacheable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

UV_INDEX_* env vars are not forwarded to uv subprocesses inside Renovate's container. RENOVATE_HOST_RULES is the correct mechanism — Renovate embeds the credentials when invoking uv lock. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vercel · 2026-06-02T18:27:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Jun 3, 2026 9:40am
flagsmith-frontend-preview	Ignored	Preview	Jun 3, 2026 9:40am
flagsmith-frontend-staging	Ignored	Preview	Jun 3, 2026 9:40am

github-actions · 2026-06-02T18:28:32Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-api-test:pr-7690`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-e2e:pr-7690`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-frontend:pr-7690`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-7690`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api:pr-7690`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-7690`	Finished ✅	Results ✅

github-actions · 2026-06-02T18:34:35Z

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
40.7 seconds
ccfed35
🔄 Run: #17204 (attempt 1)

2 tests across 2 suites
57 seconds
ee19f8e
🔄 Run: #17219 (attempt 1)

github-actions · 2026-06-02T18:35:29Z

Visual Regression

19 screenshots compared. See report for details.
View full report

codecov · 2026-06-02T18:35:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.52%. Comparing base (9cfd7ce) to head (ee19f8e).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7690      +/-   ##
==========================================
- Coverage   98.52%   98.52%   -0.01%     
==========================================
  Files        1444     1444              
  Lines       55090    54971     -119     
==========================================
- Hits        54280    54161     -119     
  Misses        810      810

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

khvn26

LGTM — I expect RENOVATE_APP_ID and RENOVATE_APP_PRIVATE_KEY to be set to our flagsmith-engineering app, though.

khvn26

2 questions

matthewelwell and others added 11 commits June 2, 2026 18:04

ci: Add self-hosted Renovate workflow with CodeArtifact authentication

c046a4c

Replaces the hosted Renovate GitHub App with a self-hosted workflow so that uv.lock can be updated correctly when private CodeArtifact packages are involved. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci: Fix renovatebot/github-action version to v46.1.14

c4850ce

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci: Configure Renovate repository and git author

a7698ea

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci: Use GitHub App token for Renovate authentication

89ddc60

Replaces the GH_PRIVATE_ACCESS_TOKEN PAT with a GitHub App token so that Renovate PRs and issues are attributed to the app bot identity rather than a personal account. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci: Use depot runner for Renovate workflow

821234f

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci: Recreate closed Renovate PRs automatically

da0ca70

Prevents security PRs from being silently dropped when manually closed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci: Run Renovate via npx instead of Docker action

063bcaa

Avoids pulling the Renovate Docker image on every run, which was adding significant overhead. Running via npx is faster and cacheable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

LOG_LEVEL=DEBUG

f2c08b4

revert claude hallucination

ad8c60d

ci: Always rebase Renovate branches to prevent stale branch deadlock

ccfed35

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

matthewelwell requested a review from a team as a code owner June 2, 2026 18:27

matthewelwell requested review from khvn26 and removed request for a team June 2, 2026 18:27

flagsmith-engineering Bot assigned khvn26 Jun 2, 2026

matthewelwell changed the title ~~Ci/self hosted renovate~~ ci: self-hosted renovate Jun 2, 2026

Remove temporary changes to workflow

008d96d

github-actions Bot added the ci-cd Build, test and deployment related label Jun 2, 2026

khvn26 previously approved these changes Jun 3, 2026

View reviewed changes

Update to use Flagsmith Engineering GH app

ee19f8e

matthewelwell dismissed khvn26’s stale review via ee19f8e June 3, 2026 09:40

github-actions Bot added ci-cd Build, test and deployment related and removed ci-cd Build, test and deployment related labels Jun 3, 2026

khvn26 approved these changes Jun 3, 2026

View reviewed changes

khvn26 reviewed Jun 3, 2026

View reviewed changes

Comment thread .github/workflows/renovate.yml

Comment thread .github/workflows/renovate.yml

matthewelwell merged commit 1946ec5 into main Jun 3, 2026
34 checks passed

matthewelwell deleted the ci/self-hosted-renovate branch June 3, 2026 09:53

flagsmithdev mentioned this pull request Jun 3, 2026

chore(main): release 2.239.0 #7675

Open

matthewelwell mentioned this pull request Jun 3, 2026

ci: Renovate semantic commit scopes #7691

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: self-hosted renovate#7690

ci: self-hosted renovate#7690
matthewelwell merged 13 commits into
mainfrom
ci/self-hosted-renovate

matthewelwell commented Jun 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

khvn26 left a comment

Uh oh!

khvn26 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

matthewelwell commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

How did you test this code?

Uh oh!

vercel Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

github-actions Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Uh oh!

github-actions Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual Regression

Uh oh!

codecov Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

khvn26 left a comment

Choose a reason for hiding this comment

Uh oh!

khvn26 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

matthewelwell commented Jun 2, 2026 •

edited

Loading

vercel Bot commented Jun 2, 2026 •

edited

Loading

github-actions Bot commented Jun 2, 2026 •

edited

Loading

github-actions Bot commented Jun 2, 2026 •

edited

Loading

github-actions Bot commented Jun 2, 2026 •

edited

Loading

codecov Bot commented Jun 2, 2026 •

edited

Loading