Add Renovate GitHub Actions workflow for manual triggering

[marek-veber]

Summary

• Adds a new GitHub Actions workflow (.github/workflows/renovate.yaml) to run Renovate on demand via workflow_dispatch
• Includes a dry-run option to test without creating PRs
• Requires a RENOVATE_TOKEN repository secret (PAT or GitHub App token)

Test plan

• Add RENOVATE_TOKEN secret to the repository
• Trigger the workflow manually from Actions tab with dry-run set to full
• Verify Renovate runs and logs appear correctly
• Trigger again with dry-run set to false and verify PRs are created as expected

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added new automated workflow for dependency management with flexible execution options—manual triggers for on-demand runs and dry-run mode for testing proposed changes
  • Teams can now control update timing directly and preview modifications before they're applied to the repository

[coderabbitai]

Warning

Rate limit exceeded

@marek-veber has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 30 minutes and 54 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 7b7672d3-baa1-42b1-9c7a-745842c42570

📥 Commits

Reviewing files that changed from the base of the PR and between 3a0fd84 and 6207913.

📒 Files selected for processing (1)

• .github/workflows/renovate.yaml

📝 Walkthrough

Walkthrough

A GitHub Actions workflow for Renovate was added to enable manual dependency updates. The workflow accepts a dry-run input parameter and executes the renovatebot action, reading configuration from renovate.json and using a Renovate token for authentication.

Changes

Renovate Workflow Setup

Layer / File(s)	Summary
Workflow Configuration .github/workflows/renovate.yaml	New manually-triggered workflow with dry-run input choice ("false" or "full", default "false"). Checks out repo and runs renovatebot/github-action@v42 with configurationFile: renovate.json and RENOVATE_DRY_RUN environment variable wired to the input.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• stolostron/cluster-api-provider-azure#240: Directly related—this PR adds the Renovate workflow invocation, while the referenced PR modifies renovate.json configuration that this workflow consumes.

Suggested labels

lgtm, approved

Poem

🐰 A rabbit's ode to automation—

Dependencies hop through the night,
Renovate keeps packages bright,
With a dry-run first, to check what's right,
Then merge with might, all's well in sight!
thump-thump 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description provided does not follow the required template structure with sections like 'What type of PR is this', 'What this PR does / why we need it', and other mandatory sections.	Restructure the description to match the template: add PR kind label, clarify the rationale and benefits, include issue references if applicable, and complete the TODO checklist and release note sections.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a Renovate GitHub Actions workflow for manual triggering, which matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/renovate.yaml:
- Line 27: The environment variable assignment for RENOVATE_DRY_RUN uses invalid
dot notation to access a hyphenated input key; update the expression that
references github.event.inputs to use bracket notation for the hyphenated input
name (i.e., access 'dry-run' via github.event.inputs['dry-run']) so the action
reads the input correctly while preserving the existing default fallback logic.
- Around line 19-21: Replace the mutable action tags with pinned commit SHAs:
update the two steps that currently use "uses: actions/checkout@v4" and "uses:
renovatebot/github-action@v42" to reference the full-length immutable commit
SHAs for those releases (and add the tag comment like "# tag=v4.0.0" or "#
tag=v42.0.0" to match the repo convention); locate the lines containing those
exact "uses:" strings and substitute each tag with its corresponding full commit
SHA while preserving the comment describing the semantic tag.
- Around line 15-17: Add an explicit permissions block for the renovate job to
follow least-privilege practice: add a permissions stanza (either top-level or
inside the renovate job) that at minimum grants contents: read so
actions/checkout@v4 can read the repo, and also grant pull-requests: write (or
repository-related write scopes renovate requires) so the renovate job can
open/update PRs; update the renovate job definition named "renovate" to include
this permissions block.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: ba1007c0-3fb8-44b7-b1dd-d5db0af0505a

📥 Commits

Reviewing files that changed from the base of the PR and between 5379860 and 3a0fd84.

📒 Files selected for processing (1)

• .github/workflows/renovate.yaml

[RadekCap]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: marek-veber, RadekCap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [RadekCap,marek-veber]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment