feat(renovate): migrate beats version bumps from workflow to Renovate - #8386
Open
gurevichdmitry wants to merge 7 commits into
Open
gurevichdmitry wants to merge 7 commits into
gurevichdmitry wants to merge 7 commits into
Conversation
Replace the bump-beats-version.yml GitHub Actions workflow (which used updatecli) with a Renovate-based approach: - Add a Renovate annotation comment in go.mod above the beats dependency so the new regex customManager can track the SHA. - Add a customManager in renovate.json that uses git-refs datasource to detect new commits on the elastic/beats main branch. - Add a packageRule that runs `make generate` as a postUpgradeTask to update the go.mod pseudo-version whenever Renovate detects a new SHA. - Add Makefile with a `generate` target that reads the SHA from the go.mod annotation and runs go get + go mod tidy. - Delete .github/workflows/bump-beats-version.yml (now superseded). The existing `enabled: false` packageRule for github.com/elastic/beats/v7 is intentionally kept to prevent the gomod manager from also managing it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…fig on beats update - Delete `.ci/updatecli/updatecli.d/update-beats.yml` and `.ci/updatecli/scripts/update-beats.sh`; no workflow invokes them and they reference a deleted workflow env var (BRANCH_NAME). - Add `mage config || true` to `make generate` so beats-version bumps regenerate committed config YAMLs (cloudbeat*.yml) via the beats template tooling. - Expand `postUpgradeTasks.fileFilters` to include `cloudbeat*.yml` so Renovate commits those regenerated files in beats-update PRs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
gurevichdmitry
added
backport-skip
dependencies
Remove redundant beats-sha from annotation comment since the 12-char SHA is already embedded in the go.mod pseudo-version. The customManager regex now spans both the annotation line (for branch name) and the module line (for currentDigest), keeping the annotation minimal. Also drop mage config from make generate (not available in Renovate runner) and fix SHA reading to use sed on the module line directly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Renovate exposes {{baseBranch}} in template context, which matches
the beats branch 1:1 (same naming convention as the old workflow
which passed BRANCH_NAME=${{ matrix.branch }} to updatecli).
No annotation comment needed in go.mod — the pseudo-version line
is the only touch point.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
olegsu
approved these changes
Sep 16, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
This pull request is now in conflicts. Could you fix it? 🙏 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates
elastic/beats/v7version bumps from.github/workflows/bump-beats-version.ymlto Renovate, eliminating the last custom workflow that handles dependency updates.How it works
Renovate's
git-refscustom manager matches the beats pseudo-version line ingo.moddirectly — no annotation comment needed:The regex extracts the 12-char SHA (
currentDigest) and the timestamp.currentValueTemplate: "{{baseBranch}}"tells Renovate to check the beats branch with the same name as the current base branch — mirroring exactly what the old workflow did withBRANCH_NAME: ${{ matrix.branch }}. SincebaseBranchesis already defined as["main", "9.5", "9.4", "8.19"], each base branch automatically tracks the corresponding beats branch.When the beats branch HEAD changes, Renovate opens a PR updating the pseudo-version, then runs
make generateviapostUpgradeTasks. TheMakefile'sgeneratetarget reads the SHA from the pseudo-version line (sed 's/.*-//') and runsgo get github.com/elastic/beats/v7@<sha> && go mod tidy, which rewrites the entry with the correct timestamp and truncated SHA.make generateis on theallowedPostUpgradeCommandsallowlist in the self-hosted Renovate instance — no new GH Actions workflow required.Changes
Makefile(new) —generatetarget: reads SHA from the pseudo-version line, runsgo get+go mod tidyrenovate.json— addedgit-refscustom manager for the beats pseudo-version ingo.modwithcurrentValueTemplate: "{{baseBranch}}"; added packageRule withpostUpgradeTasks: make generateandautomerge: truescoped to beats; keptenabled: falsefor thegomodmanager ongithub.com/elastic/beats/v7.github/workflows/bump-beats-version.yml— deleted.ci/updatecli/updatecli.d/update-beats.ymland.ci/updatecli/scripts/update-beats.sh— deleted (orphaned after updatecli deprecation in feat(renovate): deprecate updatecli, enable pre-commit manager #8351)Related
Closes https://github.com/elastic/security-team/issues/19259
Depends on / follow-up to #8351
🤖 Generated with Claude Code