From 636fbed7452b66574207039e19c94bdf33d95652 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Fri, 16 Oct 2026 14:01:40 +0200 Subject: [PATCH 1/3] Allow Renovate to write commit statuses --- .github/workflows/renovate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 051f59c..90706f8 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -35,7 +35,7 @@ jobs: permission-issues: write permission-workflows: write permission-checks: read - permission-statuses: read + permission-statuses: write - name: Run Renovate uses: renovatebot/github-action@f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 # v46.3.8 with: From 38e0adb35c86b5b8be35fab09fd53b8a669d9f0e Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Fri, 16 Oct 2026 14:06:13 +0200 Subject: [PATCH 2/3] Inherit Renovate App permissions --- .github/workflows/renovate.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 90706f8..3c5fdb6 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -24,18 +24,12 @@ jobs: persist-credentials: false - name: Create Renovate App token id: app-token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 # zizmor: ignore[github-app] App grants, restricted to this repository. with: client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }} private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: stackstate-backup-cli - permission-contents: write - permission-pull-requests: write - permission-issues: write - permission-workflows: write - permission-checks: read - permission-statuses: write - name: Run Renovate uses: renovatebot/github-action@f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 # v46.3.8 with: From fe304e156f73c3e21776c1e165f20dce066b12ac Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Fri, 16 Oct 2026 14:11:04 +0200 Subject: [PATCH 3/3] Scope Renovate status and vulnerability access --- .github/workflows/renovate.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 3c5fdb6..f4cfb10 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -24,12 +24,19 @@ jobs: persist-credentials: false - name: Create Renovate App token id: app-token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 # zizmor: ignore[github-app] App grants, restricted to this repository. + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }} private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: stackstate-backup-cli + permission-contents: write + permission-pull-requests: write + permission-issues: write + permission-workflows: write + permission-checks: read + permission-statuses: write + permission-vulnerability-alerts: read - name: Run Renovate uses: renovatebot/github-action@f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 # v46.3.8 with: