Support GITHUB_COM_TOKEN

Reviewed-on: #24

README.md

@@ -5,27 +5,3 @@
 A robot who upgrades our configurations.
 
 See [config.js](./config.js.tmpl) for the configured repositories.
-
-<!-- metadata -->
-* **Category**: Development
-* **Status**: ?
-* **Image**: [`renovate/renovate`](https://hub.docker.com/r/renovate/renovate), ❶💚, upstream
-* **Healthcheck**: No
-* **Backups**: ?
-* **Email**: ?
-* **Tests**: ❷💛
-* **SSO**: ?
-<!-- endmetadata -->
-
-## Basic usage
-
-1. Set up Docker Swarm and [`abra`][abra]
-2. Deploy [`coop-cloud/traefik`][cc-traefik]
-3. `abra app new renovate-bot --secrets` (optionally with `--pass` if you'd like
-   to save secrets in `pass`)
-4. `abra app YOURAPPDOMAIN config` - be sure to change `$DOMAIN` to something that resolves to
-   your Docker swarm box
-5. `abra app YOURAPPDOMAIN deploy`
-
-[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
-[`coop-cloud/traefik`]: https://git.autonomic.zone/coop-cloud/traefik

compose.yml

@@ -1,24 +1,31 @@
 version: "3.8"
 services:
   app:
-    image: "renovate/renovate:24.98.9-slim"
+    image: "renovate/renovate:24.119.22-slim"
     environment:
       LOG_LEVEL: info
+      GITHUB_COM_TOKEN_FILE: /run/secrets/github_token
     configs:
       - source: config_js
         target: /usr/src/app/config.js
+      - source: entrypoint
+        target: /docker-entrypoint.sh
+        mode: 0555
+    entrypoint: /docker-entrypoint.sh
+    command: renovate
     secrets:
       - api_token
+      - github_token
     healthcheck:
       disable: true
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
     deploy:
       mode: replicated
       replicas: 0
       labels:
         - "swarm.cronjob.enable=true"
-        - "swarm.cronjob.schedule=0 9 * * 1-5"
+        # Note(decentral1se): every minute, testing
+        # - "swarm.cronjob.schedule=* * * * *"
+        - "swarm.cronjob.schedule=0 9 * * 1-5" # office hours
         - coop-cloud.${STACK_NAME}.app.version=24.98.9-slim-d3db1c25
       restart_policy:
         condition: none
@@ -31,3 +38,6 @@ secrets:
   api_token:
     name: api_token_v1
     external: true
+  github_token:
+    name: github_token_v1
+    external: true

config.js.tmpl

@@ -7,6 +7,14 @@ module.exports = {
   "docker-compose": {
     fileMatch: "(^|/)compose[^/]*\.ya?ml$",
   },
+  "requiredStatusChecks": null,
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true
+    }
+  ],
   repositories: [
     "autonomic-cooperative/autonomic.zone",
     "autonomic-cooperative/backup-bot",

entrypoint.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -e
+
+file_env() {
+   local var="$1"
+   local fileVar="${var}_FILE"
+   local def="${2:-}"
+
+   if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+      echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+      exit 1
+   fi
+
+   local val="$def"
+
+   if [ "${!var:-}" ]; then
+      val="${!var}"
+   elif [ "${!fileVar:-}" ]; then
+      val="$(< "${!fileVar}")"
+   fi
+
+   export "$var"="$val"
+   unset "$fileVar"
+}
+
+file_env "GITHUB_COM_TOKEN"
+
+exec "$@"