Commit b393242f authored by xuwang's avatar xuwang
Browse files

feat(renovate): sa-create can store the bot token in Vault 



Add RENOVATE_BOT_TOKEN_VAULT_PATH — renovate-bot-sa-create also writes the created
token to Vault via vault-write.sh, defaulting to
${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH is set. Retrieve with
vault-read.sh <path>. Named TOKEN (not ADMIN_TOKEN) to avoid colliding with the
creator-admin-token vars.

Changelog: added
Co-Authored-By: default avatarClaude Opus 4.8 <noreply@anthropic.com>
parent 7883a91f

docs/renovate.md

+5 −0
Original line number Diff line number Diff line
@@ -276,6 +276,11 @@ make renovate-bot-add-groups RENOVATE_BOT_USER=<sa-username> # groups inferr 
make renovate-admin-run RENOVATE_TOKEN_FILE=~/.otica-tokens/renovate.token

```



`sa-create` also stores the token in **Vault** when `RENOVATE_BOT_TOKEN_VAULT_PATH`

is set — or automatically at `${SEC_PATH}/gitlab/renovate_bot/<user>/token` when

`SEC_PATH` is defined (via `vault-write.sh`). Retrieve it anywhere with

`vault-read.sh <path>` (e.g. to feed the `RENOVATE_TOKEN` CI variable from Vault).



If you can't create a service account (the API is admin-only — it returns 404 to

non-admins), the equivalent is any **dedicated user** added to those groups; just

store its PAT at `RENOVATE_BOT_TOKEN_FILE`. Either way, one identity that's a

makefiles/renovate-admin.mk

+5 −1
Original line number Diff line number Diff line
@@ -44,10 +44,14 @@ RENOVATE_BOT_EXPIRES ?= 
RENOVATE_BOT_USER            ?=

RENOVATE_BOT_GROUPS          ?=

RENOVATE_BOT_ADMIN_TOKEN_FILE ?=

# Optionally also store the created bot token in Vault (sa-create). Empty =

# derive ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH is set.

RENOVATE_BOT_TOKEN_VAULT_PATH ?=

export RENOVATE_AUTODISCOVER_FILTER RENOVATE_ADMIN_CONFIG \

       RENOVATE_BOT_GROUP RENOVATE_BOT_REPO RENOVATE_BOT_TOKEN_FILE \

       RENOVATE_BOT_ACCESS_LEVEL RENOVATE_BOT_EXPIRES \

       RENOVATE_BOT_USER RENOVATE_BOT_GROUPS RENOVATE_BOT_ADMIN_TOKEN_FILE

       RENOVATE_BOT_USER RENOVATE_BOT_GROUPS RENOVATE_BOT_ADMIN_TOKEN_FILE \

       RENOVATE_BOT_TOKEN_VAULT_PATH



.PHONY: renovate-admin-update

renovate-admin-update: ## regenerate ${RENOVATE_ADMIN_CONFIG} repos from ${SUB_REPOS_FILE} (tf/docker only)

scripts/renovate-bot.sh

+15 −0
Original line number Diff line number Diff line
@@ -27,6 +27,10 @@ 
#   RENOVATE_BOT_TOKEN_FILE   where to store the token (default ~/.otica-tokens/renovate.token)

#   RENOVATE_BOT_ACCESS_LEVEL 30=Developer (default) | 40=Maintainer (for automerge)

#   RENOVATE_BOT_EXPIRES      YYYY-MM-DD (default +365 days)

#   RENOVATE_BOT_TOKEN_VAULT_PATH  also store the created token in Vault at this path

#                             (sa-create); defaults to

#                             ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH set.

#                             Read it back with: vault-read.sh <path>

###############################################################################

THIS_DIR=$(cd "$(dirname "$0")" && pwd)

source "${THIS_DIR}/functions.sh"
@@ -135,6 +139,17 @@ cmd_sa_create() { 
    printf '%s' "${tok}" > "${TOKEN_FILE}"; chmod 600 "${TOKEN_FILE}"

    echo "Created service account: ${suser} (id=${sid})"

    echo "  token stored: ${TOKEN_FILE}  (expires ${EXPIRES})"

    # Optionally also store the token in Vault. Enabled by RENOVATE_BOT_TOKEN_VAULT_PATH,

    # which defaults to ${SEC_PATH}/gitlab/renovate_bot/<user>/token when SEC_PATH is set.

    local vpath="${RENOVATE_BOT_TOKEN_VAULT_PATH:-}"

    [ -z "${vpath}" ] && [ -n "${SEC_PATH:-}" ] && vpath="${SEC_PATH}/gitlab/renovate_bot/${suser}/token"

    if [ -n "${vpath}" ]; then

        if "${THIS_DIR}/vault-write.sh" "${vpath}" "${tok}" >/dev/null; then

            echo "  vault:   ${vpath}  (read with: vault-read.sh ${vpath})"

        else

            echo "  vault:   FAILED to write ${vpath} (check vault login / VAULT_ADDR)" >&2

        fi

    fi

    echo "  next: renovate-bot.sh add-groups   RENOVATE_BOT_USER=${suser}"

    echo "        then point scans at RENOVATE_TOKEN_FILE=${TOKEN_FILE}"

}