Commit 1f372ca0 authored by xuwang's avatar xuwang
Browse files

docs(renovate): document Terraform-provisioned bot via Vault token path 



Recommend handing GitLab bot-identity creation to a SA-provisioning Terraform
project (creates external-user SA + group memberships + token in Vault, CE-safe),
with Renovate consuming only RENOVATE_TOKEN_VAULT_PATH. renovate-bot-* targets are
the alternative for consumers without such a project.

Changelog: changed
Co-Authored-By: default avatarClaude Opus 4.8 <noreply@anthropic.com>
parent aff5ae4f

docs/renovate.md

+24 −0
Original line number Diff line number Diff line
@@ -299,6 +299,30 @@ it ahead of `RENOVATE_BOT_EXPIRES`. If the token feeds a CI variable, re-run 
`renovate-bot-ci-set` after rotating (or read it from Vault in CI so there's

nothing to update). Tear down entirely with `renovate-bot-revoke`.



### Terraform-provisioned bot (recommended for managed orgs)



If you already manage GitLab identities with Terraform, let *that* own the bot and

have Renovate consume only a Vault token path — clean separation, and it works on

GitLab **CE** (where service accounts aren't available) by using an **external

user**. Example with a SA-provisioning project (`provision-gitlab-sa`):



1. Add a service-account entry (creates the user + token, adds it to the groups

   Renovate scans, stores the token in Vault):

   ```hcl

   { name = "sa_renovate", note = "Renovate bot",

     vault_path_prefix = "secret/projects/<proj>/gitlab/sa",

     token_scopes = ["api", "write_repository"],

     groups = [ { full_path = "gcp", access_level = "maintainer" },

                { full_path = "irt-dcs", access_level = "maintainer" } ] }

   ```

   `terraform apply` → token at `…/sa/sa_renovate/access_token`.

2. Point Renovate at it — nothing else needed:

   ```make

   RENOVATE_TOKEN_VAULT_PATH = secret/projects/<proj>/gitlab/sa/sa_renovate/access_token

   ```

The `renovate-bot-*` targets below are the alternative for consumers *without* such

a project.



### Cross-group bot (sub-repos in several top-level groups)



A group/project access token only covers **one** group, and Renovate uses **one