Fix Renovate

Author: fdevans

.github/workflows/gradle.yml

@@ -2,6 +2,10 @@ name: CI Tests
 
 on: [push]
 
+concurrency:
+  group: ci-${{ github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   build-verify:
     runs-on: ubuntu-latest

.github/workflows/update-dependency-verification.yml

@@ -0,0 +1,67 @@
+name: Update dependency verification
+
+# Regenerates Gradle dependency verification on Renovate branches and pushes
+# the result. Uses RENOVATE_PUSH_TOKEN (not GITHUB_TOKEN) so the follow-up
+# push can trigger CI Tests. Create a fine-grained PAT (or GitHub App token)
+# with contents:write on this repo and store it as that secret.
+on:
+  push:
+    branches:
+      - 'renovate/**'
+    paths-ignore:
+      - 'gradle/verification-metadata.xml'
+      - 'gradle/verification-keyring.keys'
+      - 'gradle/verification-keyring.gpg'
+
+concurrency:
+  group: update-dep-verification-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require RENOVATE_PUSH_TOKEN
+        env:
+          RENOVATE_PUSH_TOKEN: ${{ secrets.RENOVATE_PUSH_TOKEN }}
+        run: |
+          if [ -z "$RENOVATE_PUSH_TOKEN" ]; then
+            echo "::error::Repository secret RENOVATE_PUSH_TOKEN is required so verification commits can trigger CI. Create a fine-grained PAT with Contents: Read and write for this repository."
+            exit 1
+          fi
+
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+          token: ${{ secrets.RENOVATE_PUSH_TOKEN }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          java-version: '17'
+          distribution: 'zulu'
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Regenerate dependency verification metadata
+        run: ./gradlew --write-verification-metadata pgp,sha256 --export-keys help
+
+      - name: Commit and push verification updates
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add \
+            gradle/verification-metadata.xml \
+            gradle/verification-keyring.keys \
+            gradle/verification-keyring.gpg
+          if git diff --staged --quiet; then
+            echo "No verification metadata changes"
+            exit 0
+          fi
+          git commit -m "chore: update dependency verification metadata"
+          git push

README.md

@@ -58,7 +58,10 @@ rundeck-cli-VERS-all.jar (shadowed jar)
 
 ## Update Dependency Verification
 
-Dependency verification is automatically updated by Renovate when dependencies change.
+Dependency verification is automatically updated on Renovate branches by the
+`Update dependency verification` GitHub Actions workflow. That workflow needs a
+repository secret `RENOVATE_PUSH_TOKEN` (fine-grained PAT with Contents read/write)
+so its commit can trigger CI.
 
 **If you manually update a dependency**, you must regenerate verification metadata:
 

renovate.json

@@ -1,17 +1,49 @@
 {
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
   ],
-  "postUpgradeTasks": {
-    "commands": [
-      "./gradlew --write-verification-metadata pgp,sha256 --export-keys help"
-    ],
-    "fileFilters": [
-      "gradle/verification-metadata.xml",
-      "gradle/verification-keyring.keys"
-    ]
-  },
-  "allowedCommands": [
-    "^./gradlew --write-verification-metadata pgp,sha256 --export-keys help$"
+  "minimumReleaseAge": "7 days",
+  "dependencyDashboard": true,
+  "packageRules": [
+    {
+      "description": "Defer major updates to manual selection from the Dependency Dashboard",
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "Group low-risk GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "groupName": "github actions"
+    },
+    {
+      "description": "Spock's version suffix encodes the Groovy variant; review lockstep with groovy",
+      "matchPackageNames": ["/^org\\.spockframework:/"],
+      "groupName": "spock (manual review - groovy variant)",
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "Group routine Gradle minor/patch dependency bumps",
+      "matchManagers": ["gradle"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "gradle minor/patch dependencies"
+    },
+    {
+      "description": "org.rundeck artifacts also need the Sonatype Central snapshots feed",
+      "matchPackageNames": ["/^org\\.rundeck[.:]/"],
+      "registryUrls": [
+        "https://repo1.maven.org/maven2/",
+        "https://central.sonatype.com/repository/maven-snapshots/"
+      ]
+    },
+    {
+      "description": "Gradle plugin marker artifacts resolve via the Gradle Plugin Portal",
+      "matchManagers": ["gradle"],
+      "matchDepTypes": ["plugin"],
+      "registryUrls": [
+        "https://plugins.gradle.org/m2/",
+        "https://repo1.maven.org/maven2/"
+      ]
+    }
   ]
 }