Jiri Daněk
def09c2661
* fix(github): use base_tree in pushFiles to avoid org ruleset file-path restrictions (#42554) pushFiles sent the entire repo tree to POST /git/trees without base_tree. GitHub validates all file paths against org rulesets, rejecting the tree when it contains protected files (e.g. semgrep.yaml) — even if Renovate only changed unrelated paths. Use base_tree (parent commit's tree) with only the changed files from git diff-tree, so unchanged protected files are inherited without validation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test(git): add coverage for getCommitTreeSha and diffCommitTree Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(test): assert specific files instead of hardcoding diff count The test fixture creates 2 known files between develop and defaultBranch (master_file, file_to_delete), but CI produces 3 changed files — likely a .gitattributes from the CI environment. Assert on the known files rather than the total count. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(git): handle renames, copies, and submodules in diffCommitTree - Regex now matches multi-char status codes (R100, C100) and tab-separated source/target paths for renames and copies. - Renames emit a deletion for the source path + addition for target. - Derive tree item type from mode: 160000→commit, 040000→tree, otherwise blob. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor(git): address review comments in diffCommitTree Keep git utility types centralized and make diff status handling easier to follow. Made-with: Cursor * test(git): cover rename handling in diffCommitTree Verify that renamed files are emitted as a deletion for the old path and an addition for the new path, matching the tree delta expected by GitHub. Made-with: Cursor * fix(git): validate parsed tree SHA Fail fast when commit output cannot be parsed into a tree SHA so pushFiles does not propagate an invalid base_tree, and cover the failure path in tests. Made-with: Cursor * fix(git): enable rename detection and cover remaining diffCommitTree branches Add -M to diff-tree so Git emits R status for renames, exercising the existing case 'R' handler. Add focused tests for rename parsing, submodule mode (160000), and tree mode (040000). Made-with: Cursor * fix(git): clarify copy vs rename comment in diffCommitTree R uses both tab-separated paths (delete old + add new), while C falls through to default where only the target path matters. Made-with: Cursor * refactor(git): remove dead listCommitTree and TreeItem Nothing imports listCommitTree after the switch to diffCommitTree with base_tree. Remove the function, its regex, its test, and the TreeItem interface. Made-with: Cursor * refactor(git): tighten DiffTreeItem.type to GitObjectType union Define GitObjectType = 'blob' | 'tree' | 'commit' and use it in DiffTreeItem and treeTypeFromMode instead of plain string. Made-with: Cursor * fix(git): remove unreachable nullish coalescing in getCommitTreeSha split()[0] on a non-empty string is always defined, so the ?? '' fallback was unreachable and caused an uncovered branch in Codecov. Made-with: Cursor * fix(git): add v8 ignore for partial branch on throw template literal v8 reports template literal interpolations inside throw as partial branch coverage even when the line is tested. Use the established v8 ignore pattern to suppress the false positive. Made-with: Cursor * fix(github): guard pushFiles against empty diff from diffCommitTree GitHub's POST /git/trees rejects an empty tree array with 422 "Invalid tree info". While prepareCommit already prevents no-op commits from reaching pushFiles, add a defensive early return so the failure mode is a clear log message instead of a swallowed 422. Made-with: Cursor * docs(github): document hybrid git/REST commit strategy in pushFiles Restore architectural knowledge from PRs #13824 and #14271 that was lost when the old "for reasons unknown" comments were replaced. The push-then-recreate pattern exists because custom refs avoid CI triggers, REST-created commits get GitHub signing, and GraphQL lacks force-push and file mode support. Made-with: Cursor * fix(git): wrap bare regex literals in regEx() in tests Use the project's regEx() helper instead of bare /pattern/ in toMatch and stringMatching calls, consistent with repo conventions. Made-with: Cursor * fix(git): revert regEx() in expect.stringMatching (only accepts bare RegExp) expect.stringMatching() is a Vitest/Jest API that requires a native RegExp, not the wrapped object from Renovate's regEx() helper. Made-with: Cursor * fix(git): drop line count from v8 ignore next Vitest uses ast-v8-to-istanbul which is AST-aware: it ignores the entire next AST node (here the whole throw statement), making the line count unnecessary. Made-with: Cursor * refactor(git): replace magic mode strings with GitTreeMode enum Introduce a documented GitTreeMode enum in types.ts and use it in treeTypeFromMode, replacing raw '160000'/'040000' literals with named members linked to the git data model documentation. Made-with: Cursor * fix(git): use const object instead of enum for GitTreeMode Node's TypeScript strip-only mode does not support enum syntax. Use `as const` object pattern consistent with the rest of the codebase. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
GitHub and GitHub Enterprise Server
Most of the information on this page is meant for users who want to self-host Renovate on GitHub or GitHub Enterprise Server.
Easiest way to run Renovate
For users on GitHub Cloud (github.com), the easiest way to get started is to install the Mend Renovate app from the GitHub marketplace.
When you use the app, Mend will:
- authenticate the Renovate app to GitHub
- keep the tokens safe
- maintain and update the Renovate version used
If you self-host Renovate you must do the things listed above yourself. Self-hosting is meant for users with advanced use cases, or who want to be in full control of the bot and the environment it runs in. We recommend most users install the Mend Renovate app.
Read the Security and Permissions page to learn about the Security and Permissions needed for the Mend Renovate app.
After you installed the hosted app, please read the reading list to learn how to use and configure Renovate.
Authentication
First, create a fine-grained or a classic PAT.
The PAT must have the repo scope.
If you want Renovate to also update your GitHub Action files, you must grant the workflow scope.
Read the GitHub Docs, about Personal Access Tokens to learn more about PATs.
Let Renovate use your PAT by doing one of the following:
- Set your PAT as a
tokenin yourconfig.jsfile - Set your PAT as an environment variable
RENOVATE_TOKEN - Set your PAT when you run Renovate in the CLI with
--token=
Remember to set platform=github somewhere in your Renovate config file.
If you use GitHub Enterprise Server then endpoint must point to https://github-enterprise.example.com/api/v3/.
You can choose where you want to set endpoint:
- In your
config.jsfile - In a environment variable
- In a CLI parameter
!!! tip "Labels and forking mode"
If you're self-hosting Renovate on GitHub.com with GitHub Actions in forking mode, and want Renovate to apply labels then you must give the PAT triage level rights on issues.
The triage level allows the PAT to apply/dismiss existing labels.
Running using a fine-grained token
Permissions
A fine-grained token must have these permissions:
| Permission | Access | Level |
|---|---|---|
Members |
Read-only |
Organization |
Commit statuses |
Read and write |
Repository or Organization |
Contents |
Read and write |
Repository or Organization |
Dependabot alerts |
Read-only |
Repository or Organization |
Issues |
Read and write |
Repository or Organization |
Pull requests |
Read and write |
Repository or Organization |
Workflows |
Read and write |
Repository or Organization |
!!! tip "Use a bot role account" Consider creating a GitHub App to use instead of using your own GitHub user account.
Running as a GitHub App
Instead of a bot account with a Personal Access Token you can run renovate as a self-hosted GitHub App.
When creating the GitHub App give it the following permissions:
| Permission | Scope |
|---|---|
| Checks | read + write |
| Commit statuses | read + write |
| Contents | read + write |
| Issues | read + write |
| Pull requests | read + write |
| Workflows | read + write |
| Administration | read |
| Dependabot alerts | read |
| Members | read |
| Metadata | read |
Other values like Homepage URL, User authorization callback URL and webhooks can be disabled or filled with dummy values.
Inside your config.js you need to set the following values, assuming the name of your app is self-hosted-renovate:
token:"ghs_123exampletoken"
You must use a GitHub App Installation token.
Previously, the token had to be prefixed with x-access-token:.
We recommend you replace any prefixed tokens with normal tokens.
We will drop support for prefixed tokens in the future.
Any tokens that do not start with ghs_ (for example tokens from GitHub Enterprise Server versions before version 3.2) must be prefixed with x-access-token:.
!!! note
The installation tokens expire after 1 hour and need to be regenerated regularly.
Alternatively as environment variable RENOVATE_TOKEN, or via CLI --token=.
!!! tip "Third-party tools to regenerate installation tokens"
If you're self-hosting Renovate within a GitHub Actions workflow, then you can use the actions/create-github-app-token action.
If you use Node.js/CLI, then you can use the github-app-installation-token package.
If you use Docker, then you can use the mshekow/github-app-installation-token image.
repositories: ["orgname/repo-1","orgname/repo-2"]
List of repositories to run on.
Alternatively as comma-separated environment variable RENOVATE_REPOSITORIES.
The GitHub App installation token is scoped at most to a single organization and running on multiple organizations requires multiple invocations of renovate with different token and repositories parameters.
username:"self-hosted-renovate[bot]" (optional, autodetected if not supplied)
The slug name of your app with [bot] appended
gitAuthor:"Self-hosted Renovate Bot <123456+self-hosted-renovate[bot]@users.noreply.github.enterprise.com>" (optional, autodetected if not supplied)
The GitHub App associated email to match commits to the bot.
It needs to have the user id and the username followed by the users.noreply.-domain of either github.com or the GitHub Enterprise Server.
A way to get the user id of a GitHub app is to query the user API at api.github.com/users/self-hosted-renovate[bot] (github.com) or github.enterprise.com/api/v3/users/self-hosted-renovate[bot] (GitHub Enterprise Server).
Package Registry Credentials
When Renovate runs against repositories on github.com, and the environment variable RENOVATE_X_GITHUB_HOST_RULES is set, then Renovate automatically provisions hostRules for these GitHub Packages registries using the platform token:
ghcr.iomaven.pkg.github.comnpm.pkg.github.comnuget.pkg.github.comrubygems.pkg.github.com
!!! warning We reverted the Package Registry Credentials feature to experimental mode, because users reported it's not working correctly with app tokens.