Commit 26170bd7 authored by xuwang's avatar xuwang
Browse files

feat(renovate): add RENOVATE_TOKEN_VAULT_PATH to the token resolution chain 



renovate-run.sh now resolves the token as:
  RENOVATE_TOKEN > RENOVATE_TOKEN_FILE > RENOVATE_TOKEN_VAULT_PATH (vault-read.sh)
  > GITLAB_TOKEN > ~/.gitlab-token
This closes the loop with renovate-bot sa-create's RENOVATE_BOT_TOKEN_VAULT_PATH
(write -> read), so a fleet can run with no token files on disk. The vault var is
scrubbed from Renovate's env; a failed read warns and falls through.

Changelog: added
Co-Authored-By: default avatarClaude Opus 4.8 <noreply@anthropic.com>
parent b393242f

docs/renovate.md

+4 −2
Original line number Diff line number Diff line
@@ -84,8 +84,10 @@ running it). 


**Token.** Renovate authenticates with a GitLab token for **the repo's own

server**, resolved by precedence:

`RENOVATE_TOKEN` → `RENOVATE_TOKEN_FILE` → `GITLAB_TOKEN` → `~/.gitlab-token`.

Scope depends on the action:

`RENOVATE_TOKEN` → `RENOVATE_TOKEN_FILE` → `RENOVATE_TOKEN_VAULT_PATH` (read via

`vault-read.sh`) → `GITLAB_TOKEN` → `~/.gitlab-token`. The Vault path reads back

exactly what `renovate-bot-sa-create` stored (`RENOVATE_BOT_TOKEN_VAULT_PATH`),

so a fleet can run with no token files on disk. Scope depends on the action:



| Action | Required token scope |

| --- | --- |

makefiles/renovate.mk

+9 −5
Original line number Diff line number Diff line
@@ -31,13 +31,17 @@ RENOVATE_ENDPOINT ?= 
RENOVATE_CONFIG    ?= renovate.json

RENOVATE_REPO      ?=

RENOVATE_ARGS      ?=

# Dedicated token file for the repo's server. Set this when the project's

# GITLAB_TOKEN points at a different GitLab (e.g. a code.stanford.edu Terraform

# backend) than where this repo lives.

# Dedicated token for the repo's server. Set when the project's GITLAB_TOKEN

# points at a different GitLab (e.g. a code.stanford.edu Terraform backend) than

# where this repo lives. Precedence: RENOVATE_TOKEN > RENOVATE_TOKEN_FILE >

# RENOVATE_TOKEN_VAULT_PATH > GITLAB_TOKEN > ~/.gitlab-token. The Vault path reads

# back what renovate-bot's sa-create stored (RENOVATE_BOT_TOKEN_VAULT_PATH).

RENOVATE_TOKEN_FILE       ?=

RENOVATE_TOKEN_VAULT_PATH ?=



export RENOVATE_CMD RENOVATE_PLATFORM RENOVATE_ENDPOINT \

       RENOVATE_CONFIG RENOVATE_REPO RENOVATE_ARGS RENOVATE_TOKEN_FILE

       RENOVATE_CONFIG RENOVATE_REPO RENOVATE_ARGS \

       RENOVATE_TOKEN_FILE RENOVATE_TOKEN_VAULT_PATH



.PHONY: renovate-check

renovate-check: ## verify a Renovate runtime is available (renovate | npx | docker)

scripts/renovate-run.sh

+17 −5
Original line number Diff line number Diff line
@@ -20,10 +20,13 @@ 
#                          controls which repos get scanned

#   RENOVATE_DOCKER_IMAGE default: renovate/renovate

#   RENOVATE_TOKEN        GitLab token for the repo's server (scope: 'api' real,

#                         'read_api' dry-run). Precedence:

#                         RENOVATE_TOKEN > RENOVATE_TOKEN_FILE > GITLAB_TOKEN > ~/.gitlab-token

#                         'read_api' dry-run). Precedence: RENOVATE_TOKEN >

#                         RENOVATE_TOKEN_FILE > RENOVATE_TOKEN_VAULT_PATH >

#                         GITLAB_TOKEN > ~/.gitlab-token

#   RENOVATE_TOKEN_FILE   file holding that token; use when the project's

#                         GITLAB_TOKEN targets a different server than this repo

#   RENOVATE_TOKEN_VAULT_PATH  Vault path to read the token from (vault-read.sh);

#                         pairs with renovate-bot's RENOVATE_BOT_TOKEN_VAULT_PATH

#   GITLAB_SERVER         default: the origin remote's host (else code.stanford.edu)

#   GITLAB_TOKEN[_FILE]   consumer GitLab token / file (default ~/.gitlab-token)

#
@@ -74,15 +77,23 @@ fi 
# OTICA's GITLAB_SERVER convention (gitlab-server.sh) is a bare host with no

# scheme; Renovate requires a full URL, so ensure one is present.

case "${GITLAB_SERVER}" in *://*) ;; *) GITLAB_SERVER="https://${GITLAB_SERVER}" ;; esac

# Token precedence: RENOVATE_TOKEN > RENOVATE_TOKEN_FILE > GITLAB_TOKEN > ~/.gitlab-token.

# Token precedence:

#   RENOVATE_TOKEN > RENOVATE_TOKEN_FILE > RENOVATE_TOKEN_VAULT_PATH

#     > GITLAB_TOKEN > ~/.gitlab-token

# A project's GITLAB_TOKEN may target a DIFFERENT GitLab server than this repo

# (e.g. a code.stanford.edu Terraform backend while the code lives on gitlab.med),

# so a dedicated RENOVATE_TOKEN[_FILE] for the repo's own server wins over it.

# so a dedicated Renovate token for the repo's own server wins over it. The Vault

# path pairs with renovate-bot's RENOVATE_BOT_TOKEN_VAULT_PATH (write -> read).

RENOVATE_TOKEN="${RENOVATE_TOKEN:-}"

RENOVATE_TOKEN_FILE="${RENOVATE_TOKEN_FILE:-}"

RENOVATE_TOKEN_VAULT_PATH="${RENOVATE_TOKEN_VAULT_PATH:-}"

if [ -z "${RENOVATE_TOKEN}" ] && [ -n "${RENOVATE_TOKEN_FILE}" ] && [ -f "${RENOVATE_TOKEN_FILE}" ]; then

    RENOVATE_TOKEN="$(cat "${RENOVATE_TOKEN_FILE}")"

fi

if [ -z "${RENOVATE_TOKEN}" ] && [ -n "${RENOVATE_TOKEN_VAULT_PATH}" ]; then

    RENOVATE_TOKEN="$("${THIS_DIR}/vault-read.sh" "${RENOVATE_TOKEN_VAULT_PATH}" 2>/dev/null)" \

        || echo "renovate: warning — could not read RENOVATE_TOKEN_VAULT_PATH=${RENOVATE_TOKEN_VAULT_PATH} (vault login / VAULT_ADDR?)" >&2

fi

GITLAB_TOKEN_FILE="${GITLAB_TOKEN_FILE:-${HOME}/.gitlab-token}"

GITLAB_TOKEN="${GITLAB_TOKEN:-}"

if [ -z "${GITLAB_TOKEN}" ] && [ -f "${GITLAB_TOKEN_FILE}" ]; then
@@ -112,7 +123,8 @@ log_context() { 
invoke() {

    (

        unset RENOVATE_CMD RENOVATE_ARGS RENOVATE_CONFIG RENOVATE_REPO \

              RENOVATE_DOCKER_IMAGE RENOVATE_AUTODISCOVER_FILTER RENOVATE_TOKEN_FILE

              RENOVATE_DOCKER_IMAGE RENOVATE_AUTODISCOVER_FILTER \

              RENOVATE_TOKEN_FILE RENOVATE_TOKEN_VAULT_PATH

        export RENOVATE_TOKEN RENOVATE_PLATFORM RENOVATE_ENDPOINT

        exec "$@"

    )