feat(renovate): migrate beats version bumps from workflow to Renovate - #8386
Open
gurevichdmitry wants to merge 3 commits into
Open
feat(renovate): migrate beats version bumps from workflow to Renovate#8386gurevichdmitry wants to merge 3 commits into
gurevichdmitry wants to merge 3 commits into
Conversation
Replace the bump-beats-version.yml GitHub Actions workflow (which used updatecli) with a Renovate-based approach: - Add a Renovate annotation comment in go.mod above the beats dependency so the new regex customManager can track the SHA. - Add a customManager in renovate.json that uses git-refs datasource to detect new commits on the elastic/beats main branch. - Add a packageRule that runs `make generate` as a postUpgradeTask to update the go.mod pseudo-version whenever Renovate detects a new SHA. - Add Makefile with a `generate` target that reads the SHA from the go.mod annotation and runs go get + go mod tidy. - Delete .github/workflows/bump-beats-version.yml (now superseded). The existing `enabled: false` packageRule for github.com/elastic/beats/v7 is intentionally kept to prevent the gomod manager from also managing it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…fig on beats update - Delete `.ci/updatecli/updatecli.d/update-beats.yml` and `.ci/updatecli/scripts/update-beats.sh`; no workflow invokes them and they reference a deleted workflow env var (BRANCH_NAME). - Add `mage config || true` to `make generate` so beats-version bumps regenerate committed config YAMLs (cloudbeat*.yml) via the beats template tooling. - Expand `postUpgradeTasks.fileFilters` to include `cloudbeat*.yml` so Renovate commits those regenerated files in beats-update PRs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove redundant beats-sha from annotation comment since the 12-char SHA is already embedded in the go.mod pseudo-version. The customManager regex now spans both the annotation line (for branch name) and the module line (for currentDigest), keeping the annotation minimal. Also drop mage config from make generate (not available in Renovate runner) and fix SHA reading to use sed on the module line directly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates
elastic/beats/v7version bumps from.github/workflows/bump-beats-version.ymlto Renovate, eliminating the last custom workflow that handles dependency updates.How it works
A minimal annotation comment is added to
go.modabove the beats dependency declaring which beats branch to track:Renovate's
git-refscustom manager reads the branch name from the annotation and the current SHA from the pseudo-version itself (the 12-char suffix). When the beats branch HEAD changes, Renovate opens a PR that updates both lines — putting the new full SHA into the pseudo-version — then runsmake generateviapostUpgradeTasks. TheMakefile'sgeneratetarget reads the SHA from the pseudo-version line and runsgo get github.com/elastic/beats/v7@<sha> && go mod tidy, which rewrites the entry with the correct timestamp and truncated SHA.make generateis on theallowedPostUpgradeCommandsallowlist in the self-hosted Renovate instance — no new GH Actions workflow required.Changes
go.mod— annotation comment// renovate: beats-branch=<branch>added above the beats entryMakefile(new) —generatetarget: reads SHA from the pseudo-version line, runsgo get+go mod tidyrenovate.json— addedgit-refscustom manager spanning both the annotation and module lines ingo.mod; added packageRule withpostUpgradeTasks: make generateandautomerge: truescoped to beats; keptenabled: falsefor thegomodmanager ongithub.com/elastic/beats/v7.github/workflows/bump-beats-version.yml— deleted.ci/updatecli/updatecli.d/update-beats.ymland.ci/updatecli/scripts/update-beats.sh— deleted (orphaned after updatecli deprecation in feat(renovate): deprecate updatecli, enable pre-commit manager #8351)Related
Closes https://github.com/elastic/security-team/issues/19259
Depends on / follow-up to #8351
🤖 Generated with Claude Code