ci: add GitHub actions for dependency update and release

.github/renovate.json5

@@ -0,0 +1,77 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [ // default presets see https://docs.renovatebot.com/presets-default/
+    "config:recommended",
+    "helpers:pinGitHubActionDigestsToSemver",
+    "security:openssf-scorecard",
+    ":disableDependencyDashboard",
+    ":disableRateLimiting",
+    "group:allNonMajor",
+    ":enableVulnerabilityAlertsWithLabel(security)",
+    // ":semanticCommitTypeAll(fix)"
+  ],
+  labels: [
+    "renovate",
+    "renovate/{{updateType}}",
+  ],
+  packageRules: [
+    {
+      description: "Ignore frequent renovate updates",
+      enabled: false,
+      matchPackageNames: ["renovatebot/github-action"],
+      matchUpdateTypes: ["patch"],
+    },
+    {
+      description: "Update renovatebot/github-action minor updates on Sundays",
+      matchPackageNames: ["renovatebot/github-action"],
+      matchUpdateTypes: ["minor"],
+      schedule: ["* * * * 0"],
+    },
+    {
+      description: "Update to action dependencies use fix commits to trigger a release",
+      matchFileNames: ["action.yml"],
+      // semanticCommitType: "fix",
+      // extends: [":semanticCommitType(fix)"]
+      extends: [":semanticCommitTypeAll(fix)"]
+    },
+  ],
+  prBodyTemplate: "{{{table}}}{{{notes}}}{{{changelogs}}}",
+  customManagers: [
+    {
+      description: "Update semantic-release in GitHub Action workflows",
+      customType: "regex",
+      fileMatch: ["^\\.github\\/(actions|workflows)\\/.+\\.ya?ml$"],
+      matchStrings: [
+        "\
+semantic_version\\s*:\\s*(\"|')?(?<currentValue>.+)(\"|')?\
+(\\s+|\\s+.*)"
+      ],
+      datasourceTemplate: "npm",
+      depNameTemplate: "semantic-release"
+    },
+    {
+      description: "Any other file with dependencies",
+      customType: "regex",
+      fileMatch: [
+        "(^workflow-templates|\\.github/workflows)/[^/]+\\.ya?ml$",
+      ],
+      matchStrings: [
+        "\
+.*renovate:\
+\\sdatasource=(?<datasource>.*?)\
+\\sdepName=(?<depName>.*?)\
+(\\sversioning=(?<versioning>.*?))?\
+\n.*(version|Version|VERSION)\\s*(:=|=|:)\\s*\"?(?<currentValue>.*?)\
+(@(?<currentDigest>sha256:[a-f0-9]+))?\"?\
+(\\s+|\\s+.*)"
+      ],
+      versioningTemplate: "\
+{{#if versioning}}\
+{{{versioning}}}\
+{{else}}\
+semver-coerced\
+{{/if}}"
+    },
+  ],
+  separateMinorPatch: false,
+}

.github/workflows/release.yml

@@ -0,0 +1,69 @@
+---
+name: Release
+
+"on":
+  workflow_dispatch:
+  push:
+    branches: [master]
+
+env:
+  # renovate: datasource=npm depName=@semantic-release/changelog
+  SEMANTIC_RELEASE_CHANGELOG_VERSION: 6.0.3
+
+  # renovate: datasource=npm depName=@semantic-release/git
+  SEMANTIC_RELEASE_GIT_VERSION: 10.0.1
+
+  # renovate: datasource=npm depName=conventional-changelog-conventionalcommits
+  CONVENTIONAL_CHANGELOG_CONVENTIONALCOMMITS_VERSION: 7.0.2
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    concurrency: ${{ github.workflow }}-release
+
+    outputs:
+      release-published: ${{ steps.release.outputs.new_release_published }}
+      release-version: ${{ steps.release.outputs.new_release_version }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          token: ${{ secrets.SEMANTIC_RELEASE_GITHUB_TOKEN }}
+          # Note: special permissions for push to protected branch required
+          # Credentials required for semantic-release-github-actions-tags
+          # persist-credentials: false
+
+      - name: Install NodeJs
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        with:
+          node-version-file: '.node-version'
+
+      - name: Release
+        id: release
+        uses: cycjimmy/semantic-release-action@cb425203a562475bca039ba4dbf90c7f9ac790f4 # v4.1.0
+        env:
+          # Permissions needed
+          #   contents: write
+          #   issues: write
+          #   pull-requests: write
+          GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GITHUB_TOKEN }}
+          GIT_AUTHOR_NAME: wetransform Bot
+          GIT_AUTHOR_EMAIL: 113353961+wetransformer@users.noreply.github.com
+          GIT_COMMITTER_NAME: wetransform Bot
+          GIT_COMMITTER_EMAIL: 113353961+wetransformer@users.noreply.github.com
+          RUNNER_DEBUG: 1
+        with:
+          # dry_run: true
+          semantic_version: 23.0.5
+
+          extra_plugins:
+            "@semantic-release/changelog@\
+            ${{ env.SEMANTIC_RELEASE_CHANGELOG_VERSION }} \
+            @semantic-release/git@\
+            ${{ env.SEMANTIC_RELEASE_GIT_VERSION }} \
+            conventional-changelog-conventionalcommits@\
+            ${{ env.CONVENTIONAL_CHANGELOG_CONVENTIONALCOMMITS_VERSION }} \
+            semantic-release-github-actions-tags@\
+            "

.github/workflows/renovate.yml

@@ -0,0 +1,63 @@
+---
+name: renovate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        type: boolean
+        description: "Dry-Run"
+      logLevel:
+        type: choice
+        description: "Log-Level"
+        default: debug
+        options:
+          - info
+          - debug
+          - trace
+  push:
+    branches:
+      - master
+      - ci/renovate
+      - "!renovate/*"
+  schedule:
+    - cron: "0 0,2,4 * * 0"
+
+env:
+  # https://docs.renovatebot.com/troubleshooting/#log-debug-levels
+  LOG_LEVEL: "${{ inputs.logLevel || 'debug' }}"
+  # https://docs.renovatebot.com/self-hosted-configuration/#repositories
+  RENOVATE_REPOSITORIES: ${{ github.repository }}
+  # https://docs.renovatebot.com/self-hosted-configuration/#username
+  RENOVATE_USERNAME: ${{ github.repository_owner }}
+  # https://docs.renovatebot.com/configuration-options/#platformcommit
+  RENOVATE_PLATFORM_COMMIT: "true"
+  # https://docs.renovatebot.com/self-hosted-configuration/#dryrun
+  # Run renovate in dry-run mode if executed in branches other than master - prevents versions in PRs/branches from being updated
+  RENOVATE_DRY_RUN: "${{ inputs.dryRun || ( github.head_ref || github.ref_name ) != 'master' || false }}"
+  # Renovate Automerge
+  # RENOVATE_AUTOMERGE_TYPE: "branch"
+  # RENOVATE_AUTOMERGE: "true"
+
+permissions: read-all
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - uses: actions/create-github-app-token@f2acddfb5195534d487896a656232b016a682f3c # v1.9.0
+        id: app-token
+        with:
+          # see https://github.com/renovatebot/renovate/blob/47c8501c412c2f53f61ca292a5039f5939c32c5d/lib/modules/platform/github/readme.md?plain=1#L28
+          app-id: ${{ secrets.WE_RENOVATE_GITHUB_APP_ID }}
+          private-key: "${{ secrets.WE_RENOVATE_GITHUB_PRIVATE_KEY }}"
+
+      - name: 💡 Self-hosted Renovate
+        uses: renovatebot/github-action@2d90417499f45ff78a09586f7b9874b19817dba3 # v40.1.0
+        with:
+          token: "${{ steps.app-token.outputs.token }}"

.node-version

@@ -0,0 +1 @@
+20

.releaserc.yml

@@ -0,0 +1,13 @@
+---
+preset: conventionalcommits
+branches: master
+
+plugins:
+  - - "@semantic-release/commit-analyzer"
+  - - "@semantic-release/release-notes-generator"
+  - "@semantic-release/changelog"
+  - - "@semantic-release/git"
+    - assets:
+        - CHANGELOG.md
+  - "@semantic-release/github"
+  - 'semantic-release-github-actions-tags'