Sebastian Poxhofer
ac0407bdee
* feat(lint): add renovate/zod-schema-location and renovate/prefer-json-pipe rules Backlog item #23: reviewers repeatedly ask for consistent Zod schema structure. Two new oxlint JS-plugin rules, both at "warn": - renovate/zod-schema-location flags `export const X = <zod schema>` at module scope in lib/modules/**/ files that aren't schema.ts (or a colocated schema/ directory), reusing the leftmost-identifier schema detection from zod-schema-naming.js / prefer-nullish-util.js. Only exported top-level schemas are flagged — non-exported ones are treated as intentionally local/trivial (e.g. tightly coupled to file-local helpers), which keeps the rule's signal high. - renovate/prefer-json-pipe flags `Schema.parse(JSON.parse(x))` / `Schema.safeParse(JSON.parse(x))` and suggests `Json.pipe(Schema)` from lib/util/schema-utils instead. A third mined slice (require a matching `z.infer` type export for every exported schema) was evaluated and skipped: ~275+ exported schema-like consts in schema.ts files vs. 231 existing z.infer exports repo-wide is too high a mismatch to flag mechanically without heavy per-site judgment, so it would be mostly false positives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: fix a clean subset of renovate/zod-schema-location and renovate/prefer-json-pipe violations renovate/prefer-json-pipe: fixed all 5 safe `.parse(JSON.parse(...))` call sites (bazel datasource, generate-mise-registry script, a hook spec) by switching to `Json.pipe(Schema).parse(...)`. Left the 2 `.safeParse(JSON.parse(...))` sites (pretooluse-check.ts, github-query-items.ts) unfixed: JSON.parse throwing before safeParse is reached today crashes the script, whereas Json.pipe folds the bad-JSON case into a graceful `{ success: false }`, which is an observable behavior change, not just a mechanical rewrite. renovate/zod-schema-location: fixed the one clean, self-contained violation (platform/github's GithubIssue schema, moved into the already-existing platform/github/schema.ts) as a representative example. Left the other 20: they require moving exported schemas out of files where they're built from local helper functions/config tables (manager/github-actions/community.ts) or restructuring an entire directory into a new schema.ts with import-graph updates across many files (manager/bazel/rules/*.ts, manager/bazel-module/parser/*.ts) — real refactors needing per-site judgment, not mechanical fixes. Both rules stay at "warn": renovate/prefer-json-pipe has 2 remaining violations that shouldn't be auto-fixed, and renovate/zod-schema-location has 20. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: resolve remaining prefer-json-pipe and zod-schema-location findings - github-actions: move the derived `CommunityActions` union into the existing colocated `schema.ts`; the action config table and the `actionSchema` builder stay in `community.ts` and are now exported. - tools/docs: fold `JSON.parse` + `safeParse`/rethrow of the `gh` CLI output into `Json.pipe(...)`. Invalid JSON now surfaces as a ZodError instead of a SyntaxError; the only consumer catches generically, so behavior is preserved. - tools/agents/hooks: keep `JSON.parse` + `safeParse` with a reasoned disable comment — hook scripts must stay dependency-light, and the `Json` helper lives in lib/util/schema-utils, which drags in the full lib import graph (logger, yaml, toml). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(lint): enforce zod-schema-location and prefer-json-pipe as errors Narrow `renovate/zod-schema-location` to files whose directory already contains a colocated `schema.ts`. The mined reviewer feedback ("move this to schema.ts") presumes the module follows that convention and the schema leaked into a logic file. Modules that deliberately export schemas from differently-named schema-only files — bazel `rules/*.ts` Target schemas, bazel-module `parser/fragments.ts` — are a different, accepted layout, not "schema mixed into logic", and are no longer flagged. With that narrowing and the preceding migrations, both rules are clean repo-wide, so promote them from "warn" to "error". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: drop GithubIssue re-export from issue.ts Consumers now import the schema directly from schema.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(lint): register zod-schema-location rule The rule registration was lost while merging main, so oxlint failed to parse .oxlintrc.json with "Rule 'zod-schema-location' not found in plugin 'renovate'". Re-add the import and rules entry, and restore alphabetical ordering for prefer-json-pipe. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(lint): allow sync fs in zod-schema-location rule ESLint rules execute synchronously, so the sibling `schema.ts` lookup cannot use async fs. Silence `no-sync` with a justification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
GitHub and GitHub Enterprise Server
Most of the information on this page is meant for users who want to self-host Renovate on GitHub or GitHub Enterprise Server.
Easiest way to run Renovate
For users on GitHub Cloud (github.com), the easiest way to get started is to install the Mend Renovate app from the GitHub marketplace.
When you use the app, Mend will:
- authenticate the Renovate app to GitHub
- keep the tokens safe
- maintain and update the Renovate version used
If you self-host Renovate you must do the things listed above yourself. Self-hosting is meant for users with advanced use cases, or who want to be in full control of the bot and the environment it runs in. We recommend most users install the Mend Renovate app.
Read the Security and Permissions page to learn about the Security and Permissions needed for the Mend Renovate app.
After you installed the hosted app, please read the reading list to learn how to use and configure Renovate.
Authentication
First, create a fine-grained or a classic PAT.
The PAT must have the repo scope.
If you want Renovate to also update your GitHub Action files, you must grant the workflow scope.
Read the GitHub Docs, about Personal Access Tokens to learn more about PATs.
Let Renovate use your PAT by doing one of the following:
- Set your PAT as a
tokenin yourconfig.jsfile - Set your PAT as an environment variable
RENOVATE_TOKEN - Set your PAT when you run Renovate in the CLI with
--token=
Remember to set platform=github somewhere in your Renovate config file.
If you use GitHub Enterprise Server then endpoint must point to https://github-enterprise.example.com/api/v3/.
You can choose where you want to set endpoint:
- In your
config.jsfile - In a environment variable
- In a CLI parameter
!!! tip "Labels and forking mode"
If you're self-hosting Renovate on GitHub.com with GitHub Actions in forking mode, and want Renovate to apply labels then you must give the PAT triage level rights on issues.
The triage level allows the PAT to apply/dismiss existing labels.
Running using a fine-grained token
Permissions
A fine-grained token must have these permissions:
| Permission | Access | Level |
|---|---|---|
Members |
Read-only |
Organization |
Commit statuses |
Read and write |
Repository or Organization |
Contents |
Read and write |
Repository or Organization |
Dependabot alerts |
Read-only |
Repository or Organization |
Issues |
Read and write |
Repository or Organization |
Pull requests |
Read and write |
Repository or Organization |
Workflows |
Read and write |
Repository or Organization |
!!! tip "Use a bot role account" Consider creating a GitHub App to use instead of using your own GitHub user account.
Running as a GitHub App
Instead of a bot account with a Personal Access Token you can run renovate as a self-hosted GitHub App.
When creating the GitHub App give it the following permissions:
| Permission | Scope |
|---|---|
| Checks | read + write |
| Commit statuses | read + write |
| Contents | read + write |
| Issues | read + write |
| Pull requests | read + write |
| Workflows | read + write |
| Administration | read |
| Dependabot alerts | read |
| Members | read |
| Metadata | read |
Other values like Homepage URL, User authorization callback URL and webhooks can be disabled or filled with dummy values.
Inside your config.js you need to set the following values, assuming the name of your app is self-hosted-renovate:
token:"ghs_123exampletoken"
You must use a GitHub App Installation token.
Previously, the token had to be prefixed with x-access-token:.
We recommend you replace any prefixed tokens with normal tokens.
We will drop support for prefixed tokens in the future.
Any tokens that do not start with ghs_ (for example tokens from GitHub Enterprise Server versions before version 3.2) must be prefixed with x-access-token:.
!!! note
The installation tokens expire after 1 hour and need to be regenerated regularly.
Alternatively as environment variable RENOVATE_TOKEN, or via CLI --token=.
!!! tip "Third-party tools to regenerate installation tokens"
If you're self-hosting Renovate within a GitHub Actions workflow, then you can use the actions/create-github-app-token action.
If you use Node.js/CLI, then you can use the github-app-installation-token package.
If you use Docker, then you can use the mshekow/github-app-installation-token image.
repositories: ["orgname/repo-1","orgname/repo-2"]
List of repositories to run on.
Alternatively as comma-separated environment variable RENOVATE_REPOSITORIES.
The GitHub App installation token is scoped at most to a single organization and running on multiple organizations requires multiple invocations of renovate with different token and repositories parameters.
username:"self-hosted-renovate[bot]" (optional, autodetected if not supplied)
The slug name of your app with [bot] appended
gitAuthor:"Self-hosted Renovate Bot <123456+self-hosted-renovate[bot]@users.noreply.github.enterprise.com>" (optional, autodetected if not supplied)
The GitHub App associated email to match commits to the bot.
It needs to have the user id and the username followed by the users.noreply.-domain of either github.com or the GitHub Enterprise Server.
A way to get the user id of a GitHub app is to query the user API at api.github.com/users/self-hosted-renovate[bot] (github.com) or github.enterprise.com/api/v3/users/self-hosted-renovate[bot] (GitHub Enterprise Server).
Package Registry Credentials
When Renovate runs against repositories on github.com, and the environment variable RENOVATE_X_GITHUB_HOST_RULES is set, then Renovate automatically provisions hostRules for these GitHub Packages registries using the platform token:
ghcr.iomaven.pkg.github.comnpm.pkg.github.comnuget.pkg.github.comrubygems.pkg.github.com
!!! warning We reverted the Package Registry Credentials feature to experimental mode, because users reported it's not working correctly with app tokens.