[hedinasr]

BUILD-13269: add a renovate action that runs self-hosted Renovate on the current repository.

Repositories whose lockfiles pin the production Edge can't keep using the Mend-hosted Renovate app. Mend can't reach repox-internal.sonar.build, so its lockfile updates fail or write SaaS URLs back (for example SonarSource/sonarqube-cli#1113). This action packages the workflow validated in SonarSource/sonarqube-cli#1120, so other repositories can reuse it.

• Install: Node.js (node-version, default 24.11.0) comes from mise, which also installs the repository's own tools, such as Bun, for binarySource: global. The renovate npm package (renovate-version, default 43.257.5) is installed from the selected Repox, using a temporary npm user config.
• Tokens: the GitHub token comes from the repository's renovate GitHub App token in Vault, unless github-token is set. The SaaS reader is exposed as the REPOX_TOKEN Renovate secret, which the shared SonarSource/renovate-config host rules use.
• Commands Renovate runs: they get the selected Repox reader through customEnvVariables: ARTIFACTORY_URL, ARTIFACTORY_USERNAME, ARTIFACTORY_ACCESS_TOKEN, BUN_CONFIG_REGISTRY and BUN_CONFIG_TOKEN. Callers can add to RENOVATE_SECRETS and RENOVATE_CUSTOM_ENV_VARIABLES.
• Options: global-only Renovate options (allowedCommands, force, …) are set as RENOVATE_* environment variables on the step. RENOVATE_REPOSITORIES, RENOVATE_ONBOARDING and RENOVATE_BINARY_SOURCE default to the current repository, false and global.

Test plan:

• spec/renovate_spec.sh covers the install command and npm config, the defaults, merging of caller values, and the failure without a GitHub token.
• BUILD-13269: Run Renovate self-hosted so lockfile updates resolve from the Edge sonarqube-cli#1120 calls this commit on sonar-xs (run 40531344523):
  • Installing renovate@43.257.5 from https://repox-internal.sonar.build/artifactory/api/npm/npm/ succeeded.
  • Renovate ran bun install --ignore-scripts and the bun install post-upgrade task (Bun 1.4.4 from the repository's mise.toml). It opened Update dependency @sentry/cli to v3.8.2 - autoclosed sonarqube-cli#1122 (@sentry/cli 3.8.2) and Update dependency @toon-format/toon to v4 sonarqube-cli#1123 (@toon-format/toon 4).
  • Every URL changed in their bun.lock points to repox-internal.sonar.build: 18 in #1122 and 2 in #1123.

[hashicorp-vault-sonar-prod]

BUILD-13269

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
90.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review 👍 Approved with suggestions 0 closed / 2 findings

🟡 Medium risk · The new action runs Renovate with repository write credentials and registry secrets, so misconfiguration could create unintended dependency or workflow changes.

Adds a renovate action that runs self-hosted Renovate against the current repository, with Repox-backed installs and tokens sourced from Vault. Approved with suggestions: the README usage example omits contents: read in its job permissions, which would break checkout on private repos, and the Edge section does not yet mention renovate in its runner-based repox-url guidance.

💡 Bug: Usage example omits contents: read, so checkout fails on private repos

📄 README.md:1634-1638 📄 README.md:1659-1665

The usage example's job-level permissions: block grants only id-token: write. Once any permission is listed, every permission that isn't listed is set to none. That leaves the job's GITHUB_TOKEN without contents: read, so the actions/checkout step fails on private repositories. Private repos are a primary target here, since private-reader is the default role. The action needs that checkout because mise installs tools from the repository's mise config. Other examples in this README that run checkout grant contents: read alongside id-token: write. Add it here as well, and list it under Required GitHub Permissions.

Grant contents: read so actions/checkout can clone the repository

permissions:
  id-token: write
  contents: read

💡 Quality: Edge section still scopes runner-based Repox selection to config-/build-

📄 README.md:74 📄 README.md:84-86 📄 README.md:1681 📄 renovate/action.yml:19-22

The renovate inputs table sends readers to the Edge section for the repox-url default (README.md:1681), and renovate/action.yml:22 uses the same runner-based default. The Edge section still says only "the config-* and build-* actions" pick the endpoint from runner.environment (README.md:74). It also tells self-hosted runners without Edge connectivity to set repox-url: https://repox.jfrog.io on every affected config-* and build-* action (README.md:84-86). An operator who follows that guidance will skip renovate, which still defaults to repox-internal.sonar.build on self-hosted runners, so its install from the Edge fails. Mention renovate in that section.

🤖 Prompt for agents

Code Review: Adds a `renovate` action that runs self-hosted Renovate against the current repository, with Repox-backed installs and tokens sourced from Vault. Approved with suggestions: the README usage example omits `contents: read` in its job permissions, which would break checkout on private repos, and the Edge section does not yet mention `renovate` in its runner-based `repox-url` guidance.

1. 💡 Bug: Usage example omits contents: read, so checkout fails on private repos
   Files: README.md:1634-1638, README.md:1659-1665

   The usage example's job-level `permissions:` block grants only `id-token: write`. Once any permission is listed, every permission that isn't listed is set to `none`. That leaves the job's `GITHUB_TOKEN` without `contents: read`, so the `actions/checkout` step fails on private repositories. Private repos are a primary target here, since `private-reader` is the default role. The action needs that checkout because mise installs tools from the repository's mise config. Other examples in this README that run checkout grant `contents: read` alongside `id-token: write`. Add it here as well, and list it under Required GitHub Permissions.

   Fix (Grant contents: read so actions/checkout can clone the repository):
   permissions:
     id-token: write
     contents: read

2. 💡 Quality: Edge section still scopes runner-based Repox selection to config-*/build-*
   Files: README.md:74, README.md:84-86, README.md:1681, renovate/action.yml:19-22

   The `renovate` inputs table sends readers to the Edge section for the `repox-url` default (README.md:1681), and `renovate/action.yml:22` uses the same runner-based default. The Edge section still says only "the `config-*` and `build-*` actions" pick the endpoint from `runner.environment` (README.md:74). It also tells self-hosted runners without Edge connectivity to set `repox-url: https://repox.jfrog.io` on every affected `config-*` and `build-*` action (README.md:84-86). An operator who follows that guidance will skip `renovate`, which still defaults to `repox-internal.sonar.build` on self-hosted runners, so its install from the Edge fails. Mention `renovate` in that section.

Verification Rules 2/2 met Repos 2 inspected · PRs 3 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 2 inspected PRs 3 inspected

Cross-repo 2 repositories inspected 0 open impacts

SonarSource/renovate-config Inspected
SonarSource/sonarqube-cli Inspected

Cross-PR 3 PRs inspected 0 open impacts

PR 1120: BUILD-13269: Run Renovate self-hosted so lockfile updates resolve from the Edge Inspected
PR 1111: BUILD-13251: Resolve Bun dependencies from the production Edge Inspected
PR 133: BUILD-11448 Set rebaseWhen to conflicted org-wide Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

💡 Bug: Usage example omits contents: read, so checkout fails on private repos

The usage example's job-level permissions: block grants only id-token: write. Once any permission is listed, every permission that isn't listed is set to none. That leaves the job's GITHUB_TOKEN without contents: read, so the actions/checkout step fails on private repositories. Private repos are a primary target here, since private-reader is the default role. The action needs that checkout because mise installs tools from the repository's mise config. Other examples in this README that run checkout grant contents: read alongside id-token: write. Add it here as well, and list it under Required GitHub Permissions.

Grant contents: read so actions/checkout can clone the repository:

permissions:
  id-token: write
  contents: read

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

💡 Quality: Edge section still scopes runner-based Repox selection to config-/build-

The renovate inputs table sends readers to the Edge section for the repox-url default (README.md:1681), and renovate/action.yml:22 uses the same runner-based default. The Edge section still says only "the config-* and build-* actions" pick the endpoint from runner.environment (README.md:74). It also tells self-hosted runners without Edge connectivity to set repox-url: https://repox.jfrog.io on every affected config-* and build-* action (README.md:84-86). An operator who follows that guidance will skip renovate, which still defaults to repox-internal.sonar.build on self-hosted runners, so its install from the Edge fails. Mention renovate in that section.

_{Was this helpful? React with 👍 / 👎}

[hedinasr]

Not needed anymore: with split-horizon DNS, repox.sonar.build has a public answer, so Mend-hosted Renovate can reach the Edge without self-hosting (BUILD-13269).