Skip to content

ci: regenerate dockerflags on Renovate docker/cli updates - #218

Merged
nozaq merged 4 commits into
mainfrom
claude/optimistic-dijkstra-dch0lr
Oct 31, 2026
Merged

nozaq merged 4 commits into
mainfrom
claude/optimistic-dijkstra-dch0lr

Conversation

@nozaq

@nozaq nozaq commented Oct 29, 2026 •

Copy link
Copy Markdown
Member

Summary

Every Renovate docker/cli bump (#210, #217) fails the CI dockerflags job: Renovate updates cmd/dockerflagsgen/go.mod/go.sum but cannot run make dockerflags, so dockerargs/runflags.go is left stale. Renovate's postUpgradeTasks would fix this, but it is only available on self-hosted Renovate.

This adds .github/workflows/dockerflags-regen.yml, which on Renovate pull requests touching cmd/dockerflagsgen/go.mod:

  1. generate (contents: read, no secrets): checks out the PR head, runs make dockerflags, and outputs the runflags.go diff.
  2. push (only if the diff is non-empty): applies the diff and pushes it to the Renovate branch with a GitHub App token. It runs none of the PR's code, so docker/cli's code never runs alongside a write credential. The App token is needed because a push made with GITHUB_TOKEN does not trigger CI on the new commit.

renovate.jsonc adds the commit author to gitIgnoredAuthors, so Renovate keeps rebasing and updating the branch instead of treating it as edited.

Setup required before merging

The push job reads the housekeeper GitHub App's credentials from repository secrets. The App needs Contents: read & write on this repository.

  • HOUSEKEEPER_CLIENT_ID: the App's Client ID.
  • HOUSEKEEPER_PRIVATE_KEY: the App's private key.

Testing

🤖 Generated with Claude Code

Renovate cannot run make dockerflags on the hosted app, so every docker/cli
bump fails the CI dockerflags job until someone regenerates
dockerargs/runflags.go by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nozaq
nozaq marked this pull request as ready for review October 30, 2026 14:06
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Editing the workflow now runs it, so changes to it can be verified before
merging without pushing to the pull request's branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nozaq
nozaq merged commit d446f15 into main Oct 31, 2026
11 checks passed
@nozaq
nozaq deleted the claude/optimistic-dijkstra-dch0lr branch October 31, 2026 01:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants