Commit 21f751c1 authored by xuwang's avatar xuwang
Browse files

refactor(renovate): one RENOVATE_TOKEN_VAULT_PATH for both write and read 



Collapse RENOVATE_BOT_TOKEN_VAULT_PATH (sa-create write) into the read var
RENOVATE_TOKEN_VAULT_PATH — they must be the same path for the loop to work, so a
single var removes the drift hazard. sa-create writes the token to it,
renovate-run reads from it. Declared in renovate.mk; renovate-admin.mk no longer
declares a separate write var.

Changelog: changed
Co-Authored-By: default avatarClaude Opus 4.8 <noreply@anthropic.com>
parent 26170bd7

docs/renovate.md

+5 −4
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ running it). 
server**, resolved by precedence:

`RENOVATE_TOKEN` → `RENOVATE_TOKEN_FILE` → `RENOVATE_TOKEN_VAULT_PATH` (read via

`vault-read.sh`) → `GITLAB_TOKEN` → `~/.gitlab-token`. The Vault path reads back

exactly what `renovate-bot-sa-create` stored (`RENOVATE_BOT_TOKEN_VAULT_PATH`),

exactly what `renovate-bot-sa-create` stored (same `RENOVATE_TOKEN_VAULT_PATH`),

so a fleet can run with no token files on disk. Scope depends on the action:



| Action | Required token scope |
@@ -278,10 +278,11 @@ make renovate-bot-add-groups RENOVATE_BOT_USER=<sa-username> # groups inferr 
make renovate-admin-run RENOVATE_TOKEN_FILE=~/.otica-tokens/renovate.token

```



`sa-create` also stores the token in **Vault** when `RENOVATE_BOT_TOKEN_VAULT_PATH`

`sa-create` also stores the token in **Vault** when `RENOVATE_TOKEN_VAULT_PATH`

is set — or automatically at `${SEC_PATH}/gitlab/renovate_bot/<user>/token` when

`SEC_PATH` is defined (via `vault-write.sh`). Retrieve it anywhere with

`vault-read.sh <path>` (e.g. to feed the `RENOVATE_TOKEN` CI variable from Vault).

`SEC_PATH` is defined (via `vault-write.sh`). It's the **same** variable the scan

reads from, so set it once and the token never lands on disk: `sa-create` writes

it, `renovate-admin-run` reads it back with `vault-read.sh`.



If you can't create a service account (the API is admin-only — it returns 404 to

non-admins), the equivalent is any **dedicated user** added to those groups; just

makefiles/renovate-admin.mk

+3 −5
Original line number Diff line number Diff line
@@ -44,14 +44,12 @@ RENOVATE_BOT_EXPIRES ?= 
RENOVATE_BOT_USER            ?=

RENOVATE_BOT_GROUPS          ?=

RENOVATE_BOT_ADMIN_TOKEN_FILE ?=

# Optionally also store the created bot token in Vault (sa-create). Empty =

# derive ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH is set.

RENOVATE_BOT_TOKEN_VAULT_PATH ?=

# sa-create can also store the token in Vault via RENOVATE_TOKEN_VAULT_PATH (the

# same var the scan reads from) — declared in renovate.mk.

export RENOVATE_AUTODISCOVER_FILTER RENOVATE_ADMIN_CONFIG \

       RENOVATE_BOT_GROUP RENOVATE_BOT_REPO RENOVATE_BOT_TOKEN_FILE \

       RENOVATE_BOT_ACCESS_LEVEL RENOVATE_BOT_EXPIRES \

       RENOVATE_BOT_USER RENOVATE_BOT_GROUPS RENOVATE_BOT_ADMIN_TOKEN_FILE \

       RENOVATE_BOT_TOKEN_VAULT_PATH

       RENOVATE_BOT_USER RENOVATE_BOT_GROUPS RENOVATE_BOT_ADMIN_TOKEN_FILE



.PHONY: renovate-admin-update

renovate-admin-update: ## regenerate ${RENOVATE_ADMIN_CONFIG} repos from ${SUB_REPOS_FILE} (tf/docker only)

makefiles/renovate.mk

+1 −1
Original line number Diff line number Diff line
@@ -35,7 +35,7 @@ RENOVATE_ARGS ?= 
# points at a different GitLab (e.g. a code.stanford.edu Terraform backend) than

# where this repo lives. Precedence: RENOVATE_TOKEN > RENOVATE_TOKEN_FILE >

# RENOVATE_TOKEN_VAULT_PATH > GITLAB_TOKEN > ~/.gitlab-token. The Vault path reads

# back what renovate-bot's sa-create stored (RENOVATE_BOT_TOKEN_VAULT_PATH).

# back what renovate-bot sa-create stored (same RENOVATE_TOKEN_VAULT_PATH).

RENOVATE_TOKEN_FILE       ?=

RENOVATE_TOKEN_VAULT_PATH ?=

scripts/renovate-bot.sh

+5 −4
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ 
#   RENOVATE_BOT_TOKEN_FILE   where to store the token (default ~/.otica-tokens/renovate.token)

#   RENOVATE_BOT_ACCESS_LEVEL 30=Developer (default) | 40=Maintainer (for automerge)

#   RENOVATE_BOT_EXPIRES      YYYY-MM-DD (default +365 days)

#   RENOVATE_BOT_TOKEN_VAULT_PATH  also store the created token in Vault at this path

#   RENOVATE_TOKEN_VAULT_PATH  also store the created token in Vault at this path

#                             (sa-create); defaults to

#                             ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH set.

#                             Read it back with: vault-read.sh <path>
@@ -139,9 +139,10 @@ cmd_sa_create() { 
    printf '%s' "${tok}" > "${TOKEN_FILE}"; chmod 600 "${TOKEN_FILE}"

    echo "Created service account: ${suser} (id=${sid})"

    echo "  token stored: ${TOKEN_FILE}  (expires ${EXPIRES})"

    # Optionally also store the token in Vault. Enabled by RENOVATE_BOT_TOKEN_VAULT_PATH,

    # which defaults to ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH is set.

    local vpath="${RENOVATE_BOT_TOKEN_VAULT_PATH:-}"

    # Optionally also store the token in Vault. Enabled by RENOVATE_TOKEN_VAULT_PATH

    # (the SAME var the scan reads from), defaulting to

    # ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH is set.

    local vpath="${RENOVATE_TOKEN_VAULT_PATH:-}"

    [ -z "${vpath}" ] && [ -n "${SEC_PATH:-}" ] && vpath="${SEC_PATH}/gitlab/renovate_bot/${suser}/token"

    if [ -n "${vpath}" ]; then

        if "${THIS_DIR}/vault-write.sh" "${vpath}" "${tok}" >/dev/null; then

scripts/renovate-run.sh

+2 −2
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ 
#   RENOVATE_TOKEN_FILE   file holding that token; use when the project's

#                         GITLAB_TOKEN targets a different server than this repo

#   RENOVATE_TOKEN_VAULT_PATH  Vault path to read the token from (vault-read.sh);

#                         pairs with renovate-bot's RENOVATE_BOT_TOKEN_VAULT_PATH

#                         the same path renovate-bot sa-create writes it to

#   GITLAB_SERVER         default: the origin remote's host (else code.stanford.edu)

#   GITLAB_TOKEN[_FILE]   consumer GitLab token / file (default ~/.gitlab-token)

#
@@ -83,7 +83,7 @@ case "${GITLAB_SERVER}" in *://*) ;; *) GITLAB_SERVER="https://${GITLAB_SERVER}" 
# A project's GITLAB_TOKEN may target a DIFFERENT GitLab server than this repo

# (e.g. a code.stanford.edu Terraform backend while the code lives on gitlab.med),

# so a dedicated Renovate token for the repo's own server wins over it. The Vault

# path pairs with renovate-bot's RENOVATE_BOT_TOKEN_VAULT_PATH (write -> read).

# path is the same one renovate-bot sa-create writes the token to (write -> read).

RENOVATE_TOKEN="${RENOVATE_TOKEN:-}"

RENOVATE_TOKEN_FILE="${RENOVATE_TOKEN_FILE:-}"

RENOVATE_TOKEN_VAULT_PATH="${RENOVATE_TOKEN_VAULT_PATH:-}"