renovatebot/github-action

To prevent Renovate from updating PRs too frequently and to speed up execution, you can persist the repository cache using actions/cache.

Steps:

1. Enable RENOVATE_REPOSITORY_CACHE (via env var or config).
2. Use actions/cache/restore to restore the directory /tmp/renovate/cache/renovate/repository.
3. Crucial: Run sudo chown -R 12021:0 /tmp/renovate/ to fix ownership, as Renovate runs inside a container as user 12021.
4. Use actions/cache/save to save the updated directory.

env:
  cache_dir: /tmp/renovate/cache/renovate/repository
  cache_key: renovate-cache

jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6.1.0

      - name: Restore renovate cache
        id: cache-restore
        uses: actions/cache/restore@v6.1.0
        with:
          path: ${{ env.cache_dir }}
          key: ${{ env.cache_key }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: | 
            ${{ env.cache_key }}-

      - name: Fix restored cache ownership
        if: steps.cache-restore.outputs.cache-matched-key != ''
        run: |
          sudo chown -R 12021:0 /tmp/renovate/

      - uses: renovatebot/github-action@v46.2.1
        with:
          configurationFile: renovate.json5
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          RENOVATE_REPOSITORY_CACHE: enabled

      - name: Save renovate cache
        if: steps.cache-restore.outputs.cache-hit != 'true'
        uses: actions/cache/save@v6.1.0
        with:
          path: ${{ env.cache_dir }}
          key: ${{ env.cache_key }}-${{ github.run_id }}-${{ github.run_attempt }}

Using a GitHub App is preferred over a PAT for better permission tuning. This workflow uses actions/create-github-app-token to exchange the app's private key for a temporary access token.

Prerequisites:

1. Create a GitHub App and install it in your account/org.
2. Add the app's private key to GitHub Secrets as private_key.
3. Add the app ID to GitHub Secrets as app_id.
4. Configure your Renovate config to specify the bot's username.

name: Renovate
on:
  schedule:
    - cron: '0/15 * * * *'
jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - name: Get token
        id: get_token
        uses: actions/create-github-app-token@v1
        with:
          private-key: ${{ secrets.private_key }}
          app-id: ${{ secrets.app_id }}
          owner: ${{ github.repository_owner }}
          repositories: 'repo1,repo2'

      - name: Checkout
        uses: actions/checkout@v6.1.0

      - name: Self-hosted Renovate
        uses: renovatebot/github-action@v46.2.1
        with:
          configurationFile: example/renovate-config.js
          token: '${{ steps.get_token.outputs.token }}'

You can control which Renovate image and version the action uses:

• renovate-image: The full Docker image name. If omitted, it defaults to ghcr.io/renovatebot/renovate:<renovate-version>.
• renovate-version: The specific version/tag of Renovate. If omitted, it uses the default version. You can use the full tag to use the full image.

Recommendation: Pin the version to a specific version or a full checksum to ensure stability.

# Using a custom image
- name: Self-hosted Renovate
  uses: renovatebot/github-action@v46.2.1
  with:
    renovate-image: myproxyhub.domain.com/renovate/renovate
    token: ${{ secrets.RENOVATE_TOKEN }}

# Using a specific version
- name: Self-hosted Renovate
  uses: renovatebot/github-action@v46.2.1
  with:
    renovate-version: 44.11.6
    token: ${{ secrets.RENOVATE_TOKEN }}

# Using the 'full' image
- name: Self-hosted Renovate
  uses: renovatebot/github-action@v46.2.1
  with:
    renovate-version: full
    token: ${{ secrets.RENOVATE_TOKEN }}

Environment variables prefixed with RENOVATE_ are automatically passed to the Docker container. To pass other custom variables (e.g., for hostRules), you must whitelist them using the env-regex input. The regex defines which environment variables are allowed through to the container.

      - name: Self-hosted Renovate
        uses: renovatebot/github-action@v46.2.1
        with:
          configurationFile: example/renovate-config.js
          token: ${{ secrets.RENOVATE_TOKEN }}
          env-regex: "^(?:RENOVATE_\\w+|LOG_LEVEL|GITHUB_COM_TOKEN|NODE_OPTIONS|NO_COLOR|(?:HTTPS?|NO)_PROXY|(?:https?|no)_proxy|CUSTOM_TFE_TOKEN)$"
        env:
          CUSTOM_TFE_TOKEN: ${{ secrets.MY_TFE_TOKEN }}

Then in your renovate-config.js:

module.exports = {
  hostRules: [
    {
      hostType: 'terraform-module',
      matchHost: 'app.terraform.io',
      token: process.env.CUSTOM_TFE_TOKEN,
    },
  ],
};