slsa-framework / slsa-github-generator

Language-agnostic SLSA provenance generation for Github Actions
Apache License 2.0
385 stars 115 forks source link

[bug] Renovate seems broken #3634

Closed ianlewis closed 4 weeks ago

ianlewis commented 4 weeks ago

Renovate seems to not be working properly since #3019 was merged. All the PRs were closed and the Dependency Dashboard (#408) hasn't been updated.

ianlewis commented 4 weeks ago

Is the config:base preset even a thing anymore? I can't find a reference to it at all. https://docs.renovatebot.com/presets-config/

ianlewis commented 4 weeks ago

Running renovate-config-validator on the current renovate.json in main results in the following errors. It mentions that we need to migrate the config:base preset to config:recommended and that the schedule setting is invalid.

$ npx --yes --package renovate -- renovate-config-validator --strict                                                                      
 INFO: Validating renovate.json
 WARN: Config migration necessary
       "oldConfig": {               
         "$schema": "https://docs.renovatebot.com/renovate-schema.json",
         "extends": ["config:base", ":gitSignOff"],       
         "schedule": ["before 4 am on the first day of the month"],
         "vulnerabilityAlerts": {"schedule": "before 4am"},
         "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],                                                                                        
         "packageRules": [
           {
             "matchManagers": ["github-actions"],
             "excludePackageNames": ["slsa-framework/slsa-github-generator"],
             "groupName": "github-actions",
             "pinDigests": true
           },
           {
             "matchManagers": ["github-actions"],
             "matchPackageNames": ["slsa-framework/slsa-github-generator"],
             "groupName": "github-actions",
             "pinDigests": false
           },
           {
             "matchManagers": ["dockerfile"],
             "matchPackageNames": ["golang"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "golang"
           },
           {
             "matchManagers": ["gomod"],
             "matchPackageNames": ["go"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "golang"
           },
           {
             "matchManagers": ["gomod"],
             "excludePackageNames": ["go", "github.com/in-toto/in-toto-golang"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "go"
           },
           {
             "matchManagers": ["npm"],
             "matchDepTypes": ["dependencies"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "npm"
           },
           {
             "matchManagers": ["npm"],
             "matchDepTypes": ["devDependencies"],
             "groupName": "npm dev"
           }
         ]
       },
       "newConfig": {               
         "$schema": "https://docs.renovatebot.com/renovate-schema.json",
         "extends": ["config:recommended", ":gitSignOff"],
         "schedule": ["before 4 am on the first day of the month"],
         "vulnerabilityAlerts": {"schedule": "before 4am"},
         "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],                                                                                        
         "packageRules": [
           {
             "matchManagers": ["github-actions"],
             "excludePackageNames": ["slsa-framework/slsa-github-generator"],
             "groupName": "github-actions",
             "pinDigests": true
           },
           {
             "matchManagers": ["github-actions"],
             "matchPackageNames": ["slsa-framework/slsa-github-generator"],
             "groupName": "github-actions",
             "pinDigests": false
           },
           {
             "matchManagers": ["dockerfile"],
             "matchPackageNames": ["golang"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "golang"
           },
           {
             "matchManagers": ["gomod"],
             "matchPackageNames": ["go"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "golang"
           },
           {
             "matchManagers": ["gomod"],
             "excludePackageNames": ["go", "github.com/in-toto/in-toto-golang"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "go"
           },
           {
             "matchManagers": ["npm"],
             "matchDepTypes": ["dependencies"],
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "npm"
           },
           {
             "matchManagers": ["npm"],
             "matchDepTypes": ["devDependencies"],
             "groupName": "npm dev"
           }
         ]
       }
ERROR: Found errors in configuration
       "file": "renovate.json",
       "errors": [
         {
           "topic": "Configuration Error",
           "message": "Invalid schedule: `Invalid schedule: Failed to parse \"before 4 am on the first day of the month\"`"
         }
       ]
ianlewis commented 4 weeks ago

It seems that renovate will reopen the same issue (#404) if the config is invalid rather than creating a new issue. That may be one reason that this went unnoticed.

ramonpetgrave64 commented 4 weeks ago

Fixed the schedule https://github.com/slsa-framework/slsa-github-generator/pull/3638#issuecomment-2112977732