ci(deps): update ghcr.io/renovatebot/renovate docker tag to v43.6.2

| datasource | package                      | from   | to     |
| ---------- | ---------------------------- | ------ | ------ |
| docker     | ghcr.io/renovatebot/renovate | 43.6.0 | 43.6.2 |

.eslintrc.js

@@ -1,44 +0,0 @@
-module.exports = {
-  root: true,
-  env: {
-    es2020: true,
-    node: true,
-  },
-  plugins: ['@typescript-eslint', 'json'],
-  rules: {
-    'sort-imports': 'error',
-  },
-  ignorePatterns: [
-    '.git/',
-    '.vscode',
-    'build/',
-    'dist/',
-    'coverage/',
-    'LICENSE.md',
-    'modules/',
-    'node_modules/',
-    '!.*',
-  ],
-  overrides: [
-    {
-      files: ['*.ts', '*.tsx', '*.js', '*.jsx'],
-      parser: '@typescript-eslint/parser',
-      parserOptions: {
-        ecmaVersion: 2019,
-        sourceType: 'module',
-        project: ['./tsconfig.eslint.json'],
-      },
-      extends: [
-        'eslint:recommended',
-        'plugin:@typescript-eslint/recommended',
-        'plugin:@typescript-eslint/recommended-requiring-type-checking',
-        'prettier',
-      ],
-      rules: {},
-    },
-    {
-      files: ['*.json'],
-      extends: ['plugin:json/recommended', 'prettier'],
-    },
-  ],
-};

.github/actions/setup-node/action.yml

@@ -0,0 +1,60 @@
+name: 'Setup Node.js'
+description: 'Setup Node and install dependencies using cache'
+inputs:
+  save-cache:
+    description: 'Save cache when needed'
+    required: false
+    default: 'false'
+
+runs:
+  using: 'composite'
+
+  steps:
+    - name: ⚙️ Calculate `CACHE_KEY`
+      shell: bash
+      run: |
+        echo 'CACHE_KEY=node_modules-${{
+          hashFiles('.node-version', 'pnpm-lock.yaml')
+        }}' >> "$GITHUB_ENV"
+
+    - name: ♻️ Restore `node_modules`
+      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      id: node-modules-restore
+      with:
+        path: node_modules
+        key: ${{ env.CACHE_KEY }}
+        enableCrossOsArchive: true
+
+    - name: Calculate `CACHE_HIT`
+      shell: bash
+      run: |
+        echo 'CACHE_HIT=${{
+          (steps.node-modules-restore.outputs.cache-hit == 'true') && 'true' || ''
+        }}' >> "$GITHUB_ENV"
+
+    - name: ⚙️ Setup pnpm
+      uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      with:
+        standalone: true
+
+    - name: ⚙️ Setup Node.js ${{ inputs.node-version }}
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      with:
+        node-version-file: .node-version
+        cache: ${{ env.CACHE_HIT != 'true' && 'pnpm' || '' }}
+
+    - name: 📥 Install dependencies
+      if: env.CACHE_HIT != 'true'
+      shell: bash
+      run: pnpm install --frozen-lockfile
+      env:
+        # Other environment variables
+        HUSKY: '0' # By default do not run HUSKY install
+
+    - name: ♻️ Write `node_modules` cache
+      if: inputs.save-cache == 'true' && env.CACHE_HIT != 'true'
+      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      with:
+        path: node_modules
+        key: ${{ env.CACHE_KEY }}
+        enableCrossOsArchive: true

.github/renovate.json

@@ -3,39 +3,73 @@
   "extends": ["github>renovatebot/.github", ":pinDependencies"],
   "packageRules": [
     {
-      "description": "Automerge Renovate updates",
-      "packageNames": ["renovate/renovate"],
-      "updateTypes": ["major", "minor", "patch"],
-      "semanticCommitType": "fix"
+      "description": "Use build semantic type for some deps",
+      "matchPackageNames": ["@vercel/ncc", "typescript"],
+      "semanticCommitType": "build"
     },
     {
-      "description": "Update references in markdown files weekly",
-      "matchPaths": [".md"],
-      "extends": ["schedule:weekly"],
-      "automerge": true,
-      "stabilityDays": 0,
-      "separateMajorMinor": false,
-      "commitMessageTopic": "references to {{{depName}}}",
-      "semanticCommitType": "docs",
-      "semanticCommitScope": null,
-      "additionalBranchPrefix": "docs-"
+      "description": "Use `build` semantic commit scope for lockfile maintenance",
+      "matchUpdateTypes": ["lockFileMaintenance"],
+      "semanticCommitType": "build"
+    },
+    {
+      "description": "Use ci semantic type for some deps",
+      "matchFileNames": [".github/workflows/**"],
+      "semanticCommitType": "ci"
+    },
+    {
+      "description": "Don't require approval for renovate",
+      "matchPackageNames": [
+        "ghcr.io/renovatebot/renovate",
+        "renovatebot/github-action"
+      ],
+      "dependencyDashboardApproval": false
+    },
+    {
+      "description": "Don't pin renovate updates",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "pinDigests": false
+    },
+    {
+      "description": "Use feat! semantic type for renovate major",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(deps)!:",
+      "additionalBranchPrefix": "renovate-major"
     }
   ],
-  "regexManagers": [
+  "customManagers": [
     {
-      "fileMatch": ["^src/docker\\.ts$"],
-      "matchStrings": [
-        "// renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>.+?)(?: versioning=(?<versioning>[a-z-]+?))?\\s+readonly\\s+tag\\s+=\\s+'(?<currentValue>.+?)';"
-      ],
-      "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
-    },
-    {
-      "fileMatch": ["^README\\.md$"],
+      "customType": "regex",
+      "managerFilePatterns": ["README.md"],
       "matchStrings": [
         "uses: renovatebot/github-action@(?<currentValue>[^\\s]+)"
       ],
       "depNameTemplate": "renovatebot/github-action",
       "datasourceTemplate": "github-releases"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["README.md"],
+      "matchStrings": ["renovate-version: (?<currentValue>[^\\s]+)"],
+      "depNameTemplate": "ghcr.io/renovatebot/renovate",
+      "datasourceTemplate": "docker"
+    },
+    {
+      "description": "Update renovate version in action.yml",
+      "customType": "regex",
+      "managerFilePatterns": ["action.yml"],
+      "matchStrings": ["default: '(?<currentValue>[^\\s]+)' # renovate"],
+      "depNameTemplate": "ghcr.io/renovatebot/renovate",
+      "datasourceTemplate": "docker"
+    },
+    {
+      "description": "Update renovate version in src/docker.ts",
+      "customType": "regex",
+      "managerFilePatterns": ["src/docker.ts"],
+      "matchStrings": ["version = '(?<currentValue>[^\\s]+)'; // renovate"],
+      "depNameTemplate": "ghcr.io/renovatebot/renovate",
+      "datasourceTemplate": "docker"
     }
   ]
 }

.github/workflows/build.yml

@@ -9,54 +9,81 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  RENOVATE_VERSION: 43.6.2 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
+
 jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: false
+
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
+        with:
+          save-cache: true
+
   commitlint:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || github.repository_owner != github.event.pull_request.head.repo.owner.login }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          show-progress: false
+          filter: blob:none # we don't need all blobs, only the full tree
+
       - name: Lint commit messages
-        uses: wagoid/commitlint-github-action@d608cb14eff8344e2ecf456e89f03f5c172884b3 # tag=v4.1.12
+        uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
         continue-on-error: true
 
   lint:
+    needs:
+      - prepare
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || github.repository_owner != github.event.pull_request.head.repo.owner.login }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
-      - name: Setup node
-        uses: actions/setup-node@17f8bd926464a1afa4c6a11669539e9c1ba77048 # tag=v3.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          node-version: '16.x'
-          cache: 'yarn'
+          show-progress: false
+
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
 
-      - name: Install project
-        run: yarn install --frozen-lockfile
       - name: Lint
-        run: yarn lint
+        run: pnpm lint
 
   e2e:
+    needs:
+      - prepare
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || github.repository_owner != github.event.pull_request.head.repo.owner.login }}
 
     strategy:
       fail-fast: false
       matrix:
-        configurationFile: [example/renovate-config.js, example/renovate.json]
+        configurationFile:
+          - example/renovate-config.js
+          - example/renovate-config.json
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: false
+
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
 
-      - name: Install project
-        run: yarn install --frozen-lockfile
       - name: Build
-        run: yarn build
+        run: pnpm build
 
       - name: Configure renovate token
         run: |
@@ -76,68 +103,80 @@ jobs:
         with:
           configurationFile: ${{ matrix.configurationFile }}
 
-  build:
-    needs: [lint, commitlint, e2e]
+      - name: Renovate test with entrypoint
+        uses: ./
+        env:
+          LOG_LEVEL: debug
+        with:
+          configurationFile: ${{ matrix.configurationFile }}
+          renovate-version: ${{ env.RENOVATE_VERSION }}
+          docker-cmd-file: example/entrypoint.sh
+          docker-user: root
+
+  renovate-config-validator:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    container:
+      image: ghcr.io/renovatebot/renovate:43.6.2@sha256:3e6c3ffc4b9aba64563adf2f96dd53c58f0a557ab5675ddb7e8652177ac57fbc
+      # github hosted runners are running as `1001:127` (ubuntu:docker)
+      options: -u 1001:0 --group-add 1000 --group-add 12021 --group-add 127
+
     steps:
-      - run: echo 'dummy'
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: false
+
+      - name: Validate Renovate configuration
+        working-directory: example
+        run: |
+          renovate-config-validator renovate-config.js renovate-config.json
 
   release:
-    needs: [build]
+    needs:
+      - lint
+      - commitlint
+      - e2e
+      - renovate-config-validator
     runs-on: ubuntu-latest
-    if: |
-      (
-        startsWith(github.event.commits[0].message, 'fix(deps): update renovate/renovate docker tag ')
-        || startsWith(github.event.commits[0].message, 'fix(deps): update dependency renovate/renovate ')
-        || github.event_name == 'workflow_dispatch'
-      )
-      && github.ref == 'refs/heads/main'
     steps:
-      - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
-        with:
-          fetch-depth: 0
-          ref: 'release'
-      - name: Fetch tags
-        run: git fetch --tags
       - name: Setup Git user
+        shell: bash
         run: |
-          git config --local user.name "github-actions[bot]"
-          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
-      - name: Merge main
-        run: |
-          git merge -m 'chore(release): merge main (${{ github.sha }})' ${{ github.sha }}
-      - name: Setup node
-        uses: actions/setup-node@17f8bd926464a1afa4c6a11669539e9c1ba77048 # tag=v3.2.0
-        with:
-          node-version: '16.x'
-      - name: Install project
-        run: yarn install --frozen-lockfile --ignore-scripts
-      - name: Get version
-        id: release
-        run: yarn release:version
-      - name: Release
-        run: yarn release -- "${{ steps.release.outputs.version }}"
-      - name: Get changelog section
-        id: changelog
-        run: |
-          changelog="$(git show --unified=0 CHANGELOG.md \
-              | tail +12 \
-              | sed -e 's/^\+//' \
-              | sed -z 's/\n/%0A/g;s/\r/%0D/g')"
-          echo "::set-output name=changelog::${changelog}"
-      - name: Publish release
-        run: git push --follow-tags
-      - name: Publish GitHub release
-        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # renovate: tag=v1.1.4
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: v${{ steps.release.outputs.version }}
-          release_name: v${{ steps.release.outputs.version }}
-          body: |
-            *See the the [changelog](
-              https://github.com/${{ github.repository }}/blob/release/CHANGELOG.md
-            ) for changes in all releases.*
+          git config --global core.autocrlf false
+          git config --global core.symlinks true
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-            ${{ steps.changelog.outputs.changelog }}
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0 # required for semantic release
+          ref: 'release'
+          show-progress: false
+          filter: blob:none # we don't need all blobs, only the full tree
+
+      - name: fetch pr
+        if: ${{github.event_name == 'pull_request'}}
+        run: git fetch origin +${{ github.sha }}:${{ github.ref }}
+
+      - name: Merge main
+        id: merge
+        run: |
+          git merge --no-ff -Xtheirs -m 'skip: merge (${{ github.sha }}) [skip release]' ${{ github.sha }}
+          commit=$(git rev-parse HEAD)
+
+      - name: 📥 Setup Node.js
+        uses: ./.github/actions/setup-node
+
+      - name: Push release branch
+        run: git push origin release:release
+        if: ${{ github.ref_name == github.event.repository.default_branch }}
+
+      - name: Release
+        run: |
+          # override for semantic-release
+          export GITHUB_REF=refs/heads/release GITHUB_SHA=${{ steps.merge.outputs.commit }}
+          pnpm release
+        if: ${{ github.ref_name == github.event.repository.default_branch }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/pr-auto.yml

@@ -0,0 +1,18 @@
+name: auto-pr
+
+on:
+  pull_request_target:
+    types:
+      - opened
+
+jobs:
+  review:
+    if: github.event.action == 'opened' && !endsWith(github.event.pull_request.user.login, '[bot]')
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: hkusu/review-assign-action@5bee595fdb9765d4a0bd35724b6302fa15569158 # v1.4.0
+        with:
+          reviewers: ${{ vars.REVIEWERS }}
+          max-num-of-reviewers: 2

.gitignore

@@ -187,7 +187,7 @@ typings/
 # nuxt.js build output
 .nuxt
 
-# react / gatsby 
+# react / gatsby
 public/
 
 # vuepress build output
@@ -300,3 +300,6 @@ dkms.conf
 *.exe
 *.out
 *.app
+
+
+/.pnpm-store

.husky/commit-msg

@@ -1,4 +1,3 @@
 #!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
 
-yarn commitlint --edit $1
+commitlint --edit "$1"

.husky/pre-commit

@@ -1,4 +1,3 @@
 #!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
 
-yarn lint-staged
+lint-staged

.lintstagedrc.js

@@ -1,4 +0,0 @@
-module.exports = {
-  '*.{ts,tsx,js,jsx,json}': ['yarn lint-es:file:fix'],
-  '*.{js,jsx,ts,tsx,md,yml,yaml,json}': ['yarn format:file'],
-};

.lintstagedrc.json

@@ -0,0 +1,7 @@
+{
+  "*.{ts,tsx,js,jsx,json}": [
+    "eslint --cache --fix",
+    "prettier --cache --write"
+  ],
+  "!*.{ts,tsx,js,jsx,json}": "prettier --cache --ignore-unknown --write"
+}

.node-version

@@ -0,0 +1 @@
+24.13.1

.npmrc

@@ -1 +1,6 @@
 save-exact=true
+save-prefix =
+
+# pnpm run settings
+# https://pnpm.io/cli/run
+shell-emulator = true

.prettierignore

@@ -6,3 +6,6 @@ coverage/
 LICENSE.md
 modules/
 node_modules/
+
+/.pnpm-store
+/pnpm-lock.yaml

.prettierrc.json

@@ -1,4 +1,5 @@
 {
   "singleQuote": true,
-  "trailingComma": "es5"
+  "trailingComma": "all",
+  "plugins": ["prettier-plugin-packagejson"]
 }

.releaserc.json

@@ -0,0 +1,96 @@
+{
+  "branches": ["release"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/npm",
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["dist", "package.json"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]"
+      }
+    ],
+    [
+      "@semantic-release/github",
+      {
+        "releasedLabels": false,
+        "successComment": false
+      }
+    ]
+  ],
+  "analyzeCommits": {
+    "releaseRules": [
+      {
+        "type": "docs",
+        "scope": "readme.md",
+        "release": "patch"
+      },
+      {
+        "type": "build",
+        "release": "patch"
+      },
+      {
+        "type": "skip",
+        "release": false
+      }
+    ]
+  },
+  "preset": "conventionalcommits",
+  "presetConfig": {
+    "types": [
+      {
+        "type": "feat",
+        "section": "Features"
+      },
+      {
+        "type": "feature",
+        "section": "Features"
+      },
+      {
+        "type": "fix",
+        "section": "Bug Fixes"
+      },
+      {
+        "type": "perf",
+        "section": "Performance Improvements"
+      },
+      {
+        "type": "revert",
+        "section": "Reverts"
+      },
+      {
+        "type": "docs",
+        "section": "Documentation"
+      },
+      {
+        "type": "style",
+        "section": "Styles"
+      },
+      {
+        "type": "chore",
+        "section": "Miscellaneous Chores"
+      },
+      {
+        "type": "refactor",
+        "section": "Code Refactoring"
+      },
+      {
+        "type": "test",
+        "section": "Tests"
+      },
+      {
+        "type": "build",
+        "section": "Build System"
+      },
+      {
+        "type": "ci",
+        "section": "Continuous Integration"
+      },
+      {
+        "type": "skip",
+        "hidden": true
+      }
+    ]
+  }
+}

.versionrc.js

@@ -1,7 +0,0 @@
-module.exports = {
-  scripts: {
-    prerelease:
-      'if [ "$(git branch --show-current)" != "release" ]; then exit 1; fi',
-  },
-  commitAll: true,
-};

CHANGELOG.md

@@ -1,3 +1,3 @@
 # Changelog
 
-The changelog is only available on the `releases` branch. Please refer to [CHANGELOG.md](https://github.com/renovatebot/github-action/blob/releases/CHANGELOG.md) there.
+You can find the changelogs on the [GitHub releases page for `renovatebot/github-action`](https://github.com/renovatebot/github-action/releases/).

README.md

@@ -2,6 +2,8 @@
 
 GitHub Action to run Renovate self-hosted.
 
+<!-- markdownlint-disable no-inline-html -->
+
 <a name="toc"></a>
 
 ## Table of contents
@@ -9,56 +11,263 @@ GitHub Action to run Renovate self-hosted.
 - [Badges](#badges)
 - [Options](#options)
   - [`configurationFile`](#configurationfile)
+  - [`docker-cmd-file`](#docker-cmd-file)
+  - [`docker-network`](#docker-network)
+  - [`docker-socket-host-path`](#docker-socket-host-path)
+  - [`docker-user`](#docker-user)
+  - [`docker-volumes`](#docker-volumes)
+  - [`env-regex`](#env-regex)
+  - [`mount-docker-socket`](#mount-docker-socket)
   - [`token`](#token)
+  - [`renovate-image`](#renovate-image)
+  - [`renovate-version`](#renovate-version)
 - [Example](#example)
+- [Environment Variables](#environment-variables)
+  - [Passing other environment variables](#passing-other-environment-variables)
+- [Persisting the Repository Cache](#persisting-the-repository-cache)
 - [Troubleshooting](#troubleshooting)
   - [Debug Logging](#debug-logging)
   - [Special token requirements when using the `github-actions` manager](#special-token-requirements-when-using-the-github-actions-manager)
 
 ## Badges
 
-| Badge                                                                                                                                                                                                         | Description  | Service              |
-| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------------------- |
-| <a href="https://github.com/prettier/prettier#readme"><img alt="code style" src="https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square"></a>                                          | Code style   | Prettier             |
-| <a href="https://conventionalcommits.org"><img alt="Conventional Commits: 1.0.0" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg?style=flat-square"></a>                            | Commit style | Conventional Commits |
-| <a href="https://renovatebot.com"><img alt="Renovate enabled" src="https://img.shields.io/badge/renovate-enabled-brightgreen.svg?style=flat-square"></a>                                                      | Dependencies | Renovate             |
-| <a href="https://github.com/renovatebot/github-action/actions"><img alt="GitHub workflow status" src="https://img.shields.io/github/workflow/status/renovatebot/github-action/Build?style=flat-square"></a>   | Build        | GitHub Actions       |
-| <a href="https://github.com/renovatebot/github-action/actions"><img alt="GitHub workflow status" src="https://img.shields.io/github/workflow/status/renovatebot/github-action/Example?style=flat-square"></a> | Example      | GitHub Actions       |
+| Badge                                                                                                                                                                                                                   | Description  | Service              |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------------------- |
+| <a href="https://github.com/prettier/prettier#readme"><img alt="code style" src="https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square"></a>                                                    | Code style   | Prettier             |
+| <a href="https://conventionalcommits.org"><img alt="Conventional Commits: 1.0.0" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg?style=flat-square"></a>                                      | Commit style | Conventional Commits |
+| <a href="https://renovatebot.com"><img alt="Renovate enabled" src="https://img.shields.io/badge/renovate-enabled-brightgreen.svg?style=flat-square"></a>                                                                | Dependencies | Renovate             |
+| <a href="https://github.com/renovatebot/github-action/actions"><img alt="GitHub workflow status" src="https://img.shields.io/github/actions/workflow/status/renovatebot/github-action/build.yml?style=flat-square"></a> | Build        | GitHub Actions       |
 
 ## Options
 
-Options can be passed using the inputs of this action or the corresponding environment variables. When both are passed, the input takes precedence over the environment variable. For the available environment variables see the Renovate [Self-Hosted Configuration](https://docs.renovatebot.com/self-hosted-configuration/) docs.
+Options can be passed using the inputs of this action or the corresponding environment variables.
+When both are passed, the input takes precedence over the environment variable.
+For the available environment variables, see the Renovate [Self-Hosted Configuration](https://docs.renovatebot.com/self-hosted-configuration/) docs.
 
-## `configurationFile`
+### `configurationFile`
 
-Configuration file to configure Renovate. The supported configurations files can be one of the configuration files listed in the Renovate Docs for [Configuration Options](https://docs.renovatebot.com/configuration-options/) or a JavaScript file that exports a configuration object. For both of these options, an example can be found in the [example](./example) directory.
+Configuration file to configure Renovate ("global" config) in JavaScript or JSON format.
+It is recommended to not name it one of the repository configuration filenames listed in the Renovate Docs for [Configuration Options](https://docs.renovatebot.com/configuration-options/).
 
-The configurations that can be done in this file consists of two parts, as listed below. Refer to the links to the [Renovate Docs](https://docs.renovatebot.com/) for all options.
+Config examples can be found in the [example](./example) directory.
+
+The configurations that can be done in this file consists of two parts, as listed below.
+Refer to the links to the [Renovate Docs](https://docs.renovatebot.com/) for all options.
 
 1. [Self-Hosted Configuration Options](https://docs.renovatebot.com/self-hosted-configuration/)
 2. [Configuration Options](https://docs.renovatebot.com/configuration-options/)
 
 The [`branchPrefix`](https://docs.renovatebot.com/configuration-options/#branchprefix) option is important to configure and should be configured to a value other than the default to prevent interference with e.g. the Renovate GitHub App.
 
-If you want to use this with just the single configuration file, make sure to include the following two configuration lines. This disables the requirement of a configuration file for the repository and disables onboarding.
+If you want to use this with just the single configuration file, make sure to include the following two configuration lines.
+This disables the requirement of a configuration file for the repository and disables onboarding.
 
 ```js
   onboarding: false,
-  requireConfig: false,
+  requireConfig: 'optional',
 ```
 
-## `token`
+### `docker-cmd-file`
 
-[Generate a personal access token](https://github.com/settings/tokens), with the `repo:public_repo` scope for only public repositories or the `repo` scope for public and private repositories, and add it to _Secrets_ (repository settings) as `RENOVATE_TOKEN`. You can also create a token without a specific scope, which gives read-only access to public repositories, for testing. This token is only used by Renovate, see the [token configuration](https://docs.renovatebot.com/self-hosted-configuration/#token), and gives it access to the repositories. The name of the secret can be anything as long as it matches the argument given to the `token` option.
+Specify a command to run when the image start.
+By default the image run
+`renovate`.
+This option is useful to customize the image before running `renovate`.
+It must be an existing executable file on the local system.
+It will be mounted to the docker container.
 
-Note that the [`GITHUB_TOKEN`](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#permissions-for-the-github_token) secret can't be used for authenticating Renovate.
+For example you can create a simple script like this one (let's call it
+`renovate-entrypoint.sh`).
+
+```sh
+#!/bin/bash
+
+apt update
+
+apt install -y build-essential libpq-dev
+
+runuser -u ubuntu renovate
+```
+
+Now use this action
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          docker-cmd-file: .github/renovate-entrypoint.sh
+          docker-user: root
+          token: ${{ secrets.RENOVATE_TOKEN }}
+```
+
+### `docker-network`
+
+Specify a network to run container in.
+
+You can use `${{ job.container.network }}` to run renovate container [in the same network as other containers for this job](https://docs.github.com/en/actions/learn-github-actions/contexts#job-context),
+or set it to `host` to run in the same network as github runner, or specify any custom network.
+
+### `docker-socket-host-path`
+
+Allows the overriding of the host path for the Docker socket that is mounted into the container.
+Useful on systems where the host Docker socket is located somewhere other than `/var/run/docker.sock` (the default).
+Only applicable when `mount-docker-socket` is true.
+
+### `docker-user`
+
+Specify a user (or user-id) to run docker command.
+
+You can use it with [`docker-cmd-file`](#docker-cmd-file) in order to start the
+image as root, do some customization and switch back to a unprivileged user.
+
+### `docker-volumes`
+
+Specify volume mounts. Defaults to `/tmp:/tmp`.
+The volume mounts are separated through `;`.
+
+This sample will mount `/tmp:/tmp` and `/foo:/bar`.
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+          docker-volumes: |
+            /tmp:/tmp ;
+            /foo:/bar
+```
+
+### `env-regex`
+
+Allows to configure the regex to define which environment variables are passed to the renovate container.
+See [Passing other environment variables](#passing-other-environment-variables) section for more details.
+
+## `mount-docker-socket`
+
+Default to `false`. If set to `true` the action will mount the Docker socket
+inside the renovate container so that the commands can use Docker. Can be useful
+for `postUpgradeTasks`'s commands. Also add the user inside the renovate
+container to the docker group for socket permissions.
+
+### `token`
+
+[Generate a Personal Access Token (classic)](https://github.com/settings/tokens), with the `repo:public_repo` scope for only public repositories or the `repo` scope for public and private repositories, and add it to _Secrets_ (repository settings) as `RENOVATE_TOKEN`.
+You can also create a token without a specific scope, which gives read-only access to public repositories, for testing.
+This token is only used by Renovate, see the [token configuration](https://docs.renovatebot.com/self-hosted-configuration/#token), and gives it access to the repositories.
+The name of the secret can be anything as long as it matches the argument given to the `token` option.
+
+Note that Renovate _cannot_ currently use [Fine-grained Personal Access Tokens](https://github.com/settings/tokens?type=beta) since they do not support the GitHub GraphQL API, yet.
+
+Note that the [`GITHUB_TOKEN`](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#permissions-for-the-github_token) secret can't be used for authenticating Renovate because it has too restrictive permissions.
+In particular, using the `GITHUB_TOKEN` to create a new `Pull Request` from more types of Github Workflows results in `Pull Requests` that [do not trigger your `Pull Request` and `Push` CI events](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow).
 
 If you want to use the `github-actions` manager, you must setup a [special token](#special-token-requirements-when-using-the-github-actions-manager) with some requirements.
 
+### `renovate-image`
+
+The Renovate Docker image name to use.
+If omitted the action will use the `ghcr.io/renovatebot/renovate:<renovate-version>` Docker image name otherwise.
+If a Docker image name is defined, the action will use that name to pull the image.
+
+This sample will use `myproxyhub.domain.com/renovate/renovate:<renovate-version>` image.
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          renovate-image: myproxyhub.domain.com/renovate/renovate
+          token: ${{ secrets.RENOVATE_TOKEN }}
+```
+
+This sample will use `ghcr.io/renovatebot/renovate:<renovate-version>` image.
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+```
+
+### `renovate-version`
+
+The Renovate version to use.
+If omitted the action will use the [`default version`](./action.yml#L28) Docker tag.
+Check [the available tags on Docker Hub](https://hub.docker.com/r/renovate/renovate/tags).
+
+This sample will use `ghcr.io/renovatebot/renovate:43.6.2` image.
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          renovate-version: 43.6.2
+          token: ${{ secrets.RENOVATE_TOKEN }}
+```
+
+This sample will use `ghcr.io/renovatebot/renovate:full` image.
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          renovate-version: full
+          token: ${{ secrets.RENOVATE_TOKEN }}
+```
+
+We recommend you pin the version of Renovate to a full version or a full checksum, and use Renovate's regex manager to create PRs to update the pinned version.
+See `.github/workflows/build.yml` for an example of how to do this.
+
 ## Example
 
-This example uses a personal access token and will run every 15 minutes. The personal access token is configured as a GitHub secret named `RENOVATE_TOKEN`. This example uses the [`example/renovate-config.js`](./example/renovate-config.js) file as configuration.
-You can also see a live example of this action in my [github-renovate](https://github.com/vidavidorra/github-renovate) repository, which also includes a more [advanced configuration](https://github.com/vidavidorra/github-renovate/blob/master/src/renovate-config.ts) for updating GitHub Action workflows.
+This example uses a Personal Access Token and will run every 15 minutes.
+The Personal Access token is configured as a GitHub secret named `RENOVATE_TOKEN`.
+This example uses the [`example/renovate-config.js`](./example/renovate-config.js) file as configuration.
+Live examples with more advanced configurations of this action can be found in the following repositories:
+
+- [vidavidorra/renovate](https://github.com/vidavidorra/renovate/blob/main/.github/renovate.json)
+- [jenkinsci/helm-charts](https://github.com/jenkinsci/helm-charts/blob/main/.github/renovate-config.json5)
 
 **Remark** Update the action version to the most current, see [here](https://github.com/renovatebot/github-action/releases/latest) for latest release.
 
@@ -74,31 +283,41 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.0.0
+        uses: actions/checkout@v6.0.2
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v32.0.1
+        uses: renovatebot/github-action@v46.0.2
         with:
           configurationFile: example/renovate-config.js
           token: ${{ secrets.RENOVATE_TOKEN }}
 ```
 
-## Example with GitHub App
+### Example for GitHub Enterprise
 
-Instead of using a Personal Access Token (PAT) that is tied to a particular user you can use a [GitHub App](https://docs.github.com/en/developers/apps/building-github-apps) where permissions can be even better tuned. [Create a new app](https://docs.github.com/en/developers/apps/creating-a-github-app) and give it the following permissions:
+If you want to use the Renovate Action on a GitHub Enterprise instance you have to add the following environment variable:
 
-| Permission      | Level          |
-| --------------- | -------------- |
-| `Contents`      | `Read & write` |
-| `Metadata`      | `Read-only`    |
-| `Pull requests` | `Read & write` |
-
-Store the app ID as a secret with name `APP_ID` and generate a new private key for the app and add it as a secret to the repository as `APP_PEM` in the repository where the action will run from. Note that `APP_PEM` needs to be base64 encoded. You can encode your private key file like this from the terminal:
-
-```bash
-cat your_app_key.pem | base64 -w 0 && echo
+```yml
+....
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          configurationFile: example/renovate-config.js
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_ENDPOINT: "https://git.your-company.com/api/v3"
 ```
 
-Going forward we will be using the [machine-learning-apps/actions-app-token](https://github.com/machine-learning-apps/actions-app-token) action in order to exchange the GitHub App certificate for an access token that renovate can use.
+### Example with GitHub App
+
+Instead of using a Personal Access Token (PAT) that is tied to a particular user you can use a [GitHub App](https://docs.github.com/en/developers/apps/building-github-apps) where permissions can be even better tuned.
+[Create a new app](https://docs.github.com/en/developers/apps/creating-a-github-app) and configure the app permissions and your `config.js` as described in the [Renovate documentation](https://docs.renovatebot.com/modules/platform/github/#running-as-a-github-app).
+
+Generate and download a new private key for the app, adding the contents of the downloaded `.pem` file to _Secrets_ (repository settings) with the name `private_key` and app ID as a secret with name `app_id`.
+
+Adjust your Renovate configuration file to specify the username of your bot.
+
+From the Github app configuration page, install the app in your account or your organization's account, and configure the repository access.
+
+Going forward we will be using the [`actions/create-github-app-token` action](https://github.com/actions/create-github-app-token) in order to exchange the GitHub App certificate for an access token that Renovate can use.
 
 The final workflow will look like this:
 
@@ -115,19 +334,211 @@ jobs:
     steps:
       - name: Get token
         id: get_token
-        uses: machine-learning-apps/actions-app-token@master
+        uses: actions/create-github-app-token@v1
         with:
-          APP_PEM: ${{ secrets.APP_PEM }}
-          APP_ID: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.private_key }}
+          app-id: ${{ secrets.app_id }}
+          owner: ${{ github.repository_owner }}
+          repositories: 'repo1,repo2'
 
       - name: Checkout
-        uses: actions/checkout@v2.0.0
+        uses: actions/checkout@v6.0.2
 
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v32.0.1
+        uses: renovatebot/github-action@v46.0.2
         with:
           configurationFile: example/renovate-config.js
-          token: 'x-access-token:${{ steps.get_token.outputs.app_token }}'
+          token: '${{ steps.get_token.outputs.token }}'
+```
+
+### Commit signing with GitHub App
+
+Renovate can sign commits when deployed as a GitHub App by utilizing GitHub's API-based commits.
+To activate this, ensure that `platformCommit` is set to `true` in global config.
+If a configuration file is defined, include `platformCommit: true` to activate this feature.
+For example:
+
+```yaml
+- name: Self-hosted Renovate
+  uses: renovatebot/github-action@v46.0.2
+  with:
+    token: '${{ steps.get_token.outputs.token }}'
+  env:
+    RENOVATE_PLATFORM_COMMIT: 'true'
+```
+
+## Environment Variables
+
+If you wish to pass through environment variables through to the Docker container that powers this action you need to prefix the environment variable with `RENOVATE_`.
+
+For example if you wish to pass through some credentials for a [host rule](https://docs.renovatebot.com/configuration-options/#hostrules) to the `config.js` then you should do so like this.
+
+1. In your workflow pass in the environment variable
+
+   ```yml
+   ....
+   jobs:
+     renovate:
+       runs-on: ubuntu-latest
+       steps:
+         - name: Checkout
+           uses: actions/checkout@v6.0.2
+         - name: Self-hosted Renovate
+           uses: renovatebot/github-action@v46.0.2
+           with:
+             configurationFile: example/renovate-config.js
+             token: ${{ secrets.RENOVATE_TOKEN }}
+           env:
+             RENOVATE_TFE_TOKEN: ${{ secrets.MY_TFE_TOKEN }}
+   ```
+
+1. In `example/renovate-config.js` include the hostRules block
+
+   ```js
+   module.exports = {
+     hostRules: [
+       {
+         hostType: 'terraform-module',
+         matchHost: 'app.terraform.io',
+         token: process.env.RENOVATE_TFE_TOKEN,
+       },
+     ],
+   };
+   ```
+
+### Passing other environment variables
+
+If you want to pass other variables to the Docker container use the `env-regex` input to override the regular expression that is used to allow environment variables.
+
+In your workflow pass the environment variable and whitelist it by specifying the `env-regex`:
+
+```yml
+....
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          configurationFile: example/renovate-config.js
+          token: ${{ secrets.RENOVATE_TOKEN }}
+          env-regex: "^(?:RENOVATE_\\w+|LOG_LEVEL|GITHUB_COM_TOKEN|NODE_OPTIONS|AWS_TOKEN)$"
+        env:
+          AWS_TOKEN: ${{ secrets.AWS_TOKEN }}
+```
+
+## Persisting the repository cache
+
+In some cases, Renovate can update PRs more frequently than you expect. The [repository cache](https://docs.renovatebot.com/self-hosted-configuration/#repositorycache) can help with this issue. You need a few things to persist this cache in GitHub actions:
+
+1. Enable the `repositoryCache` [option](https://docs.renovatebot.com/self-hosted-configuration/#repositorycache) via env vars or renovate.json.
+2. Persist `/tmp/renovate/cache/renovate/repository` as an artifact.
+3. Restore the artifact before renovate runs.
+
+Below is a workflow example with caching.
+
+Note that while archiving and compressing the cache is more performant, especially if you need to handle lots of files within the cache, it's not strictly necessary. You could simplify this workflow and only upload and download a single artifact file (or directory) with a direct path (e.g. `/tmp/renovate/cache/renovate/repository/github/$org/$repo.json`). However, you'll still need to set the correct permissions with `chown` as shown in the example.
+
+```yml
+name: Renovate
+on:
+  # This lets you dispatch a renovate job with different cache options if you want to reset or disable the cache manually.
+  workflow_dispatch:
+    inputs:
+      repoCache:
+        description: 'Reset or disable the cache?'
+        type: choice
+        default: enabled
+        options:
+          - enabled
+          - disabled
+          - reset
+  schedule:
+    # Run every 30 minutes:
+    - cron: '0,30 * * * *'
+
+# Adding these as env variables makes it easy to re-use them in different steps and in bash.
+env:
+  cache_archive: renovate_cache.tar.gz
+  # This is the dir renovate provides -- if we set our own directory via cacheDir, we can run into permissions issues.
+  # It is also possible to cache a higher level of the directory, but it has minimal benefit. While renovate execution
+  # time gets faster, it also takes longer to upload the cache as it grows bigger.
+  cache_dir: /tmp/renovate/cache/renovate/repository
+  # This can be manually changed to bust the cache if neccessary.
+  cache_key: renovate-cache
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      # This third party action allows you to download the cache artifact from different workflow runs
+      # Note that actions/cache doesn't work well because the cache key would need to be computed from
+      # a file within the cache, meaning there would never be any data to restore. With other keys, the
+      # cache wouldn't necessarily upload when it changes. actions/download-artifact also doesn't work
+      # because it only handles artifacts uploaded in the same run, and we want to restore from the
+      # previous successful run.
+      - uses: dawidd6/action-download-artifact@v2
+        if: github.event.inputs.repoCache != 'disabled'
+        continue-on-error: true
+        with:
+          name: ${{ env.cache_key }}
+          path: cache-download
+
+      # Using tar to compress and extract the archive isn't strictly necessary, but it can improve
+      # performance significantly when uploading artifacts with lots of files.
+      - name: Extract renovate cache
+        run: |
+          set -x
+          # Skip if no cache is set, such as the first time it runs.
+          if [ ! -d cache-download ] ; then
+            echo "No cache found."
+            exit 0
+          fi
+
+          # Make sure the directory exists, and extract it there. Note that it's nested in the download directory.
+          mkdir -p $cache_dir
+          tar -xzf cache-download/$cache_archive -C $cache_dir
+
+          # Unfortunately, the permissions expected within renovate's docker container
+          # are different than the ones given after the cache is restored. We have to
+          # change ownership to solve this. We also need to have correct permissions in
+          # the entire /tmp/renovate tree, not just the section with the repo cache.
+          sudo chown -R 12021:0 /tmp/renovate/
+          ls -R $cache_dir
+
+      - uses: renovatebot/github-action@v46.0.2
+        with:
+          configurationFile: renovate.json5
+          token: ${{ secrets.RENOVATE_TOKEN }}
+          renovate-version: 43.6.2
+        env:
+          # This enables the cache -- if this is set, it's not necessary to add it to renovate.json.
+          RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}
+
+      # Compression helps performance in the upload step!
+      - name: Compress renovate cache
+        run: |
+          ls $cache_dir
+          # The -C is important -- otherwise we end up extracting the files with
+          # their full path, ultimately leading to a nested directory situation.
+          # To solve *that*, we'd have to extract to root (/), which isn't safe.
+          tar -czvf $cache_archive -C $cache_dir .
+
+      - uses: actions/upload-artifact@v3
+        if: github.event.inputs.repoCache != 'disabled'
+        with:
+          name: ${{ env.cache_key }}
+          path: ${{ env.cache_archive }}
+          # Since this is updated and restored on every run, we don't need to keep it
+          # for long. Just make sure this value is large enough that multiple renovate
+          # runs can happen before older cache archives are deleted.
+          retention-days: 1
 ```
 
 ## Troubleshooting
@@ -139,7 +550,7 @@ To enable debug logging, add the environment variable `LOG_LEVEL: 'debug'` to th
 
 ```yml
 - name: Self-hosted Renovate
-  uses: renovatebot/github-action@v32.0.1
+  uses: renovatebot/github-action@v46.0.2
   with:
     configurationFile: example/renovate-config.js
     token: ${{ secrets.RENOVATE_TOKEN }}
@@ -150,4 +561,4 @@ To enable debug logging, add the environment variable `LOG_LEVEL: 'debug'` to th
 ### Special token requirements when using the `github-actions` manager
 
 If you want to use the `github-actions` [manager](https://docs.renovatebot.com/modules/manager/github-actions/) in Renovate, ensure that the `token` you provide contains the `workflow` scope.
-Otherwise, GitHub does not allow Renovate to update worklow files and therefore it will be unable to create update PRs for affected packages (like `actions/checkout` or `renovatebot/github-action` itself).
+Otherwise, GitHub does not allow Renovate to update workflow files and therefore it will be unable to create update PRs for affected packages (like `actions/checkout` or `renovatebot/github-action` itself).

action.yml

@@ -1,4 +1,4 @@
-name: 'Self-Hosted Renovate'
+name: 'Renovate Bot GitHub Action'
 description: 'GitHub Action to run self-hosted Renovate.'
 author: 'Jeroen de Bruijn'
 branding:
@@ -16,6 +16,52 @@ inputs:
       configured using a Secret. Either use this input or the 'RENOVATE_TOKEN'
       environment variable.
     required: false
+  env-regex:
+    description: |
+      Override the environment variables which will be passsed into the renovate container.
+      Defaults to `^(?:RENOVATE_\\w+|LOG_LEVEL|GITHUB_COM_TOKEN|NODE_OPTIONS|(?:HTTPS?|NO)_PROXY|(?:https?|no)_proxy)$`
+    required: false
+  renovate-version:
+    description: |
+      Renovate version to use.
+    required: false
+    default: '43' # renovate
+  renovate-image:
+    description: |
+      Renovate docker image name.
+    required: false
+    default: ghcr.io/renovatebot/renovate
+  mount-docker-socket:
+    description: |
+      Mount the Docker socket inside the renovate container so that the commands
+      can use Docker. Also add the user inside the renovate container to the
+      docker group for socket permissions.
+    required: false
+  docker-socket-host-path:
+    description: |
+      Allows the overriding of the host path for the Docker socket that is mounted into the container.
+      Useful on systems where the host Docker socket is located somewhere other than '/var/run/docker.sock' (the default).
+      Only applicable when 'mount-docker-socket' is true.
+    required: false
+    default: /var/run/docker.sock
+  docker-cmd-file:
+    description: |
+      Override docker command. Default command is `renovate`
+    required: false
+  docker-network:
+    description: |
+      Docker network.
+    required: false
+  docker-user:
+    description: |
+      Docker user. Default to an unprivileged user
+    required: false
+  docker-volumes:
+    description: |
+      Docker volume mounts. Default to /tmp:/tmp
+    default: /tmp:/tmp
+    required: false
+
 runs:
-  using: node16
+  using: node24
   main: dist/index.js

commitlint.config.js

@@ -1,3 +1,3 @@
-module.exports = {
+export default {
   extends: ['@commitlint/config-conventional'],
 };

eslint.config.js

@@ -0,0 +1,64 @@
+/* eslint-disable @typescript-eslint/no-unsafe-member-access */
+/* eslint-disable @typescript-eslint/no-unsafe-argument */
+import eslintConfigPrettier from 'eslint-config-prettier';
+import globals from 'globals';
+import js from '@eslint/js';
+import json from 'eslint-plugin-json';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  {
+    ignores: [
+      '**/.git/',
+      '**/.vscode',
+      '**/build/',
+      '**/dist/',
+      '**/coverage/',
+      '**/LICENSE.md',
+      '**/modules/',
+      '**/node_modules/',
+      '!**/.*',
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked.map((config) => ({
+    ...config,
+    files: ['**/*.{ts,js,mjs,cjs}'],
+  })),
+  ...tseslint.configs.stylisticTypeChecked.map((config) => ({
+    ...config,
+    files: ['**/*.{ts,js,mjs,cjs}'],
+  })),
+  {
+    files: ['**/*.{ts,js,mjs,cjs}'],
+
+    linterOptions: {
+      reportUnusedDisableDirectives: true,
+    },
+
+    languageOptions: {
+      globals: {
+        ...globals.node,
+      },
+      ecmaVersion: 'latest',
+      sourceType: 'module',
+
+      parserOptions: {
+        projectService: true,
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+
+    rules: {
+      'sort-imports': 'error',
+    },
+  },
+  json.configs.recommended,
+  {
+    files: ['**/tsconfig.json', '**/tsconfig.*.json'],
+    rules: {
+      'json/*': ['error', { allowComments: true }],
+    },
+  },
+  eslintConfigPrettier,
+);

example/entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+install-apt sl
+
+exec runuser -u ubuntu renovate

example/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

example/renovate-config.js

@@ -1,16 +1,12 @@
 module.exports = {
   branchPrefix: 'test-renovate/',
-  dryRun: true,
   username: 'renovate-release',
   gitAuthor: 'Renovate Bot <bot@renovateapp.com>',
   onboarding: false,
   platform: 'github',
-  includeForks: true,
-  repositories: [
-    'renovatebot/github-action',
-    'renovate-tests/cocoapods1',
-    'renovate-tests/gomod1',
-  ],
+  forkProcessing: 'enabled',
+  dryRun: 'full',
+  repositories: ['renovate-tests/cocoapods1', 'renovate-tests/gomod1'],
   packageRules: [
     {
       description: 'lockFileMaintenance',
@@ -23,7 +19,7 @@ module.exports = {
         'lockFileMaintenance',
       ],
       dependencyDashboardApproval: false,
-      stabilityDays: 0,
+      minimumReleaseAge: null,
     },
   ],
 };

example/renovate-config.json

@@ -1,11 +1,11 @@
 {
   "branchPrefix": "test-renovate/",
-  "dryRun": true,
+  "dryRun": "full",
   "username": "renovate-release",
   "gitAuthor": "Renovate Bot <bot@renovateapp.com>",
   "onboarding": false,
   "platform": "github",
-  "includeForks": true,
+  "forkProcessing": "enabled",
   "repositories": [
     "renovatebot/github-action",
     "renovate-tests/cocoapods1",
@@ -23,7 +23,7 @@
         "lockFileMaintenance"
       ],
       "dependencyDashboardApproval": false,
-      "stabilityDays": 0
+      "minimumReleaseAge": "1 day"
     }
   ]
 }

package.json

@@ -1,60 +1,82 @@
 {
   "name": "github-action",
   "version": "0.0.0-PLACEHOLDER",
-  "description": "GitHub Action to run Renovate self-hosted.",
   "private": true,
-  "main": "src/index.ts",
-  "engines": {
-    "node": " >=16.0.0",
-    "yarn": "^1.22.0"
-  },
-  "scripts": {
-    "format": "prettier --ignore-unknown --write \"**/*.*\"",
-    "format:file": "prettier --write",
-    "lint": "run-s lint-es",
-    "lint:fix": "run-s lint-es:fix",
-    "lint-es": "eslint .",
-    "lint-es:file": "eslint",
-    "lint-es:fix": "eslint --fix .",
-    "lint-es:file:fix": "eslint --fix",
-    "release:version": "ts-node src/get-version",
-    "release:commit": "git add --force dist",
-    "release:standard-version": "standard-version --release-as",
-    "release": "run-s build release:commit \"release:standard-version -- {1}\" --",
-    "build": "ncc build -o dist --target es2021",
-    "start": "run-s build && node dist",
-    "prepare": "husky install"
+  "description": "GitHub Action to run Renovate self-hosted.",
+  "homepage": "https://github.com/renovatebot/github-action#readme",
+  "bugs": {
+    "url": "https://github.com/renovatebot/github-action/issues"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/renovatebot/github-action.git"
   },
-  "author": "Jeroen de Bruijn",
   "license": "GPL-3.0-or-later",
-  "bugs": {
-    "url": "https://github.com/renovatebot/github-action/issues"
+  "author": "Jeroen de Bruijn",
+  "type": "module",
+  "main": "src/index.ts",
+  "scripts": {
+    "build": "run-s clean compile",
+    "clean": "rimraf dist/",
+    "compile": "node tools/compile.js",
+    "lint": "run-s lint-es prettier",
+    "lint:fix": "run-s lint-es:fix prettier-fix",
+    "lint-es": "eslint .",
+    "lint-es:file": "eslint",
+    "lint-es:file:fix": "eslint --fix",
+    "lint-es:fix": "eslint --fix .",
+    "prepare": "husky",
+    "prettier": "prettier --cache --check --ignore-unknown \"{**/*,*}.*\"",
+    "prettier-fix": "prettier --cache --write --ignore-unknown \"{**/*,*}.*\"",
+    "release": "run-s clean build semantic-release",
+    "semantic-release": "semantic-release",
+    "start": "run-s build && node dist"
   },
-  "homepage": "https://github.com/renovatebot/github-action#readme",
   "dependencies": {
-    "@actions/core": "1.8.2",
-    "@actions/exec": "1.1.1"
+    "@actions/core": "3.0.0",
+    "@actions/exec": "3.0.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "16.3.0",
-    "@commitlint/config-conventional": "16.2.4",
-    "@types/node": "16.11.36",
-    "@typescript-eslint/eslint-plugin": "5.25.0",
-    "@typescript-eslint/parser": "5.25.0",
-    "@vercel/ncc": "0.33.4",
-    "eslint": "8.16.0",
-    "eslint-config-prettier": "8.5.0",
-    "eslint-plugin-json": "3.1.0",
-    "husky": "7.0.4",
-    "lint-staged": "12.4.1",
-    "npm-run-all": "4.1.5",
-    "prettier": "2.6.2",
-    "standard-version": "9.5.0",
-    "ts-node": "10.8.0",
-    "typescript": "4.6.4"
+    "@commitlint/cli": "20.4.1",
+    "@commitlint/config-conventional": "20.4.1",
+    "@eslint/js": "9.39.2",
+    "@semantic-release/git": "10.0.1",
+    "@semantic-release/github": "12.0.3",
+    "@semantic-release/npm": "13.1.3",
+    "@tsconfig/node24": "24.0.4",
+    "@tsconfig/strictest": "2.0.8",
+    "@types/eslint-config-prettier": "6.11.3",
+    "@types/node": "24.10.10",
+    "conventional-changelog-conventionalcommits": "9.1.0",
+    "esbuild": "0.27.2",
+    "eslint": "9.39.2",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-json": "4.0.1",
+    "globals": "17.3.0",
+    "husky": "9.1.7",
+    "lint-staged": "16.2.7",
+    "npm-run-all2": "8.0.4",
+    "prettier": "3.8.1",
+    "prettier-plugin-packagejson": "3.0.0",
+    "rimraf": "6.1.2",
+    "semantic-release": "25.0.3",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.54.0"
+  },
+  "packageManager": "pnpm@10.28.2",
+  "engines": {
+    "node": ">=24.11.0",
+    "pnpm": "^10.0.0"
+  },
+  "pnpm": {
+    "supportedArchitectures": {
+      "cpu": [
+        "x64"
+      ],
+      "os": [
+        "linux",
+        "win32"
+      ]
+    }
   }
 }

src/docker.ts

@@ -1,16 +1,31 @@
-class Docker {
-  readonly repository = 'renovate/renovate';
-  // renovate: datasource=docker depName=renovate/renovate versioning=docker
-  readonly tag = '32.68.2-slim';
-  readonly tagSuffix = '-slim';
+import type { Input } from './input';
+import { warning } from '@actions/core';
+
+export class Docker {
+  private static readonly image = 'ghcr.io/renovatebot/renovate';
+  private static readonly version = '43'; // renovate
+
+  private readonly dockerImage: string;
+  private readonly fullTag: string;
+
+  constructor(input: Input) {
+    let image = input.getDockerImage();
+    let version = input.getVersion();
+
+    if (!image) {
+      warning(`No Docker image specified, using ${Docker.image}`);
+      image = Docker.image;
+    }
+    if (!version) {
+      warning(`No Docker version specified, using ${Docker.version}`);
+      version = Docker.version;
+    }
+
+    this.dockerImage = image;
+    this.fullTag = version;
+  }
 
   image(): string {
-    return `${this.repository}:${this.tag}`;
-  }
-
-  version(): string {
-    return this.tag.replace(this.tagSuffix, '');
+    return `${this.dockerImage}:${this.fullTag}`;
   }
 }
-
-export default Docker;

src/get-version.ts

@@ -1,5 +0,0 @@
-import * as core from '@actions/core';
-import Docker from './docker';
-
-const docker = new Docker();
-core.setOutput('version', docker.version());

src/index.ts

@@ -1,16 +1,21 @@
-import * as core from '@actions/core';
-import Input from './input';
-import Renovate from './renovate';
+import { group, notice, setFailed } from '@actions/core';
+import { Input } from './input';
+import { Renovate } from './renovate';
 
 async function run(): Promise<void> {
   try {
     const input = new Input();
     const renovate = new Renovate(input);
 
+    await group('Check Renovate version', async () => {
+      const version = await renovate.runDockerContainerForVersion();
+      notice(version, { title: 'Renovate CLI version' });
+    });
+
     await renovate.runDockerContainer();
   } catch (error) {
     console.error(error);
-    core.setFailed(error as Error);
+    setFailed(error as Error);
   }
 }
 

src/input.ts

@@ -1,14 +1,15 @@
-import * as core from '@actions/core';
-import path from 'path';
+import { getInput } from '@actions/core';
+import path from 'node:path';
 
-interface EnvironmentVariable {
+export interface EnvironmentVariable {
   key: string;
   value: string;
 }
 
-class Input {
+export class Input {
   readonly options = {
-    envRegex: /^(?:RENOVATE_\w+|LOG_LEVEL|GITHUB_COM_TOKEN|NODE_OPTIONS)$/,
+    envRegex:
+      /^(?:RENOVATE_\w+|LOG_LEVEL|GITHUB_COM_TOKEN|NODE_OPTIONS|(?:HTTPS?|NO)_PROXY|(?:https?|no)_proxy)$/,
     configurationFile: {
       input: 'configurationFile',
       env: 'RENOVATE_CONFIG_FILE',
@@ -26,21 +27,25 @@ class Input {
   private readonly _configurationFile: Readonly<EnvironmentVariable>;
 
   constructor() {
+    const envRegexInput = getInput('env-regex');
+    const envRegex = envRegexInput
+      ? new RegExp(envRegexInput)
+      : this.options.envRegex;
     this._environmentVariables = new Map(
-      Object.entries(process.env).filter(([key]) =>
-        this.options.envRegex.test(key)
-      )
+      Object.entries(process.env)
+        .filter(([key]) => envRegex.test(key))
+        .filter((pair): pair is [string, string] => pair[1] !== undefined),
     );
 
     this.token = this.get(
       this.options.token.input,
       this.options.token.env,
-      this.options.token.optional
+      this.options.token.optional,
     );
     this._configurationFile = this.get(
       this.options.configurationFile.input,
       this.options.configurationFile.env,
-      this.options.configurationFile.optional
+      this.options.configurationFile.optional,
     );
   }
 
@@ -55,6 +60,42 @@ class Input {
     return null;
   }
 
+  getDockerImage(): string | null {
+    return getInput('renovate-image') || null;
+  }
+
+  getVersion(): string | null {
+    return getInput('renovate-version') || null;
+  }
+
+  mountDockerSocket(): boolean {
+    return getInput('mount-docker-socket') === 'true';
+  }
+
+  dockerSocketHostPath(): string {
+    return getInput('docker-socket-host-path') || '/var/run/docker.sock';
+  }
+
+  getDockerCmdFile(): string | null {
+    const cmdFile = getInput('docker-cmd-file');
+    return !!cmdFile && cmdFile !== '' ? path.resolve(cmdFile) : null;
+  }
+
+  getDockerUser(): string | null {
+    return getInput('docker-user') || null;
+  }
+
+  getDockerVolumeMounts(): string[] {
+    return getInput('docker-volumes')
+      .split(';')
+      .map((v) => v.trim())
+      .filter((v) => !!v);
+  }
+
+  getDockerNetwork(): string {
+    return getInput('docker-network');
+  }
+
   /**
    * Convert to environment variables.
    *
@@ -72,9 +113,9 @@ class Input {
   private get(
     input: string,
     env: string,
-    optional: boolean
+    optional: boolean,
   ): EnvironmentVariable {
-    const fromInput = core.getInput(input);
+    const fromInput = getInput(input);
     const fromEnv = this._environmentVariables.get(env);
 
     if (fromInput === '' && fromEnv === undefined && !optional) {
@@ -82,7 +123,7 @@ class Input {
         [
           `'${input}' MUST be passed using its input or the '${env}'`,
           'environment variable',
-        ].join(' ')
+        ].join(' '),
       );
     }
 
@@ -90,9 +131,6 @@ class Input {
     if (fromInput !== '') {
       return { key: env, value: fromInput };
     }
-    return { key: env, value: fromEnv !== undefined ? fromEnv : '' };
+    return { key: env, value: fromEnv ?? '' };
   }
 }
-
-export default Input;
-export { EnvironmentVariable, Input };

src/renovate.ts

@@ -1,47 +1,93 @@
-import Docker from './docker';
+import { exec, getExecOutput } from '@actions/exec';
+import { Docker } from './docker';
 import { Input } from './input';
-import { exec } from '@actions/exec';
-import fs from 'fs';
-import path from 'path';
+import fs from 'node:fs/promises';
+import path from 'node:path';
 
-class Renovate {
-  private dockerGroupName = 'docker';
+export class Renovate {
+  static dockerGroupRegex = /^docker:x:(?<groupId>[1-9][0-9]*):/m;
   private configFileMountDir = '/github-action';
 
   private docker: Docker;
 
   constructor(private input: Input) {
-    this.validateArguments();
+    this.docker = new Docker(input);
+  }
 
-    this.docker = new Docker();
+  async runDockerContainerForVersion(): Promise<string> {
+    const command = `docker run -t --rm ${this.docker.image()} --version`;
+
+    const { exitCode, stdout } = await getExecOutput(command);
+    if (exitCode !== 0) {
+      new Error(`'docker run' failed with exit code ${exitCode}.`);
+    }
+
+    return stdout.trim();
   }
 
   async runDockerContainer(): Promise<void> {
-    const renovateDockerUser = '1000';
+    await this.validateArguments();
 
     const dockerArguments = this.input
       .toEnvironmentVariables()
       .map((e) => `--env ${e.key}`)
       .concat([`--env ${this.input.token.key}=${this.input.token.value}`]);
 
-    if (this.input.configurationFile() !== null) {
-      const baseName = path.basename(this.input.configurationFile().value);
+    const configurationFile = this.input.configurationFile();
+    if (configurationFile !== null) {
+      const baseName = path.basename(configurationFile.value);
       const mountPath = path.join(this.configFileMountDir, baseName);
       dockerArguments.push(
-        `--env ${this.input.configurationFile().key}=${mountPath}`,
-        `--volume ${this.input.configurationFile().value}:${mountPath}`
+        `--env ${configurationFile.key}=${mountPath}`,
+        `--volume ${configurationFile.value}:${mountPath}`,
       );
     }
 
-    dockerArguments.push(
-      '--volume /var/run/docker.sock:/var/run/docker.sock',
-      '--volume /tmp:/tmp',
-      `--user ${renovateDockerUser}:${this.getDockerGroupId()}`,
-      '--rm',
-      this.docker.image()
-    );
+    if (this.input.mountDockerSocket()) {
+      const sockPath = this.input.dockerSocketHostPath();
+      const stat = await fs.stat(sockPath);
+      if (!stat.isSocket()) {
+        throw new Error(
+          `docker socket host path '${sockPath}' MUST exist and be a socket`,
+        );
+      }
 
-    const command = `docker run ${dockerArguments.join(' ')}`;
+      dockerArguments.push(
+        `--volume ${sockPath}:/var/run/docker.sock`,
+        `--group-add ${await this.getDockerGroupId()}`,
+      );
+    }
+
+    const dockerCmdFile = this.input.getDockerCmdFile();
+    let dockerCmd: string | null = null;
+    if (dockerCmdFile !== null) {
+      const baseName = path.basename(dockerCmdFile);
+      const mountPath = `/${baseName}`;
+      dockerArguments.push(`--volume ${dockerCmdFile}:${mountPath}`);
+      dockerCmd = mountPath;
+    }
+
+    const dockerUser = this.input.getDockerUser();
+    if (dockerUser !== null) {
+      dockerArguments.push(`--user ${dockerUser}`);
+    }
+
+    for (const volumeMount of this.input.getDockerVolumeMounts()) {
+      dockerArguments.push(`--volume ${volumeMount}`);
+    }
+
+    const dockerNetwork = this.input.getDockerNetwork();
+    if (dockerNetwork) {
+      dockerArguments.push(`--network ${dockerNetwork}`);
+    }
+
+    dockerArguments.push('--rm', this.docker.image());
+
+    if (dockerCmd !== null) {
+      dockerArguments.push(dockerCmd);
+    }
+
+    const command = `docker run -t ${dockerArguments.join(' ')}`;
 
     const code = await exec(command);
     if (code !== 0) {
@@ -55,9 +101,9 @@ class Renovate {
    * The Renovate container needs access to this group in order to have the
    * required permissions on the Docker socket.
    */
-  private getDockerGroupId(): string {
+  private async getDockerGroupId(): Promise<string> {
     const groupFile = '/etc/group';
-    const groups = fs.readFileSync(groupFile, {
+    const groups = await fs.readFile(groupFile, {
       encoding: 'utf-8',
     });
 
@@ -67,18 +113,15 @@ class Renovate {
      *
      * Source: https://www.thegeekdiary.com/etcgroup-file-explained/
      */
-    const re = new RegExp(`^${this.dockerGroupName}:x:([1-9][0-9]*):`, 'm');
-    const match = re.exec(groups);
-    if (!match || match.length < 2) {
-      throw new Error(
-        `Could not find group '${this.dockerGroupName}' in ${groupFile}`
-      );
+    const match = Renovate.dockerGroupRegex.exec(groups);
+    if (match?.groups?.groupId === undefined) {
+      throw new Error(`Could not find group docker in ${groupFile}`);
     }
 
-    return match[1];
+    return match.groups.groupId;
   }
 
-  private validateArguments(): void {
+  private async validateArguments(): Promise<void> {
     if (/\s/.test(this.input.token.value)) {
       throw new Error('Token MUST NOT contain whitespace');
     }
@@ -86,14 +129,11 @@ class Renovate {
     const configurationFile = this.input.configurationFile();
     if (
       configurationFile !== null &&
-      (!fs.existsSync(configurationFile.value) ||
-        !fs.statSync(configurationFile.value).isFile())
+      !(await fs.stat(configurationFile.value)).isFile()
     ) {
       throw new Error(
-        `configuration file '${configurationFile.value}' MUST be an existing file`
+        `configuration file '${configurationFile.value}' MUST be an existing file`,
       );
     }
   }
 }
-
-export default Renovate;

src/tsconfig.json

@@ -1,11 +0,0 @@
-{
-  "extends": "../tsconfig.json",
-  "compilerOptions": {
-    "sourceMap": false,
-    "declaration": false,
-    "allowJs": false,
-    "rootDir": ".",
-    "outDir": "dist",
-    "types": ["node"]
-  }
-}

tools/cjs-shim.ts

@@ -0,0 +1,8 @@
+// https://github.com/evanw/esbuild/issues/1921#issuecomment-1898197331
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import url from 'node:url';
+
+globalThis.require = createRequire(import.meta.url);
+globalThis.__filename = url.fileURLToPath(import.meta.url);
+globalThis.__dirname = path.dirname(__filename);

tools/compile.js

@@ -0,0 +1,15 @@
+import { build } from 'esbuild';
+import { env } from 'node:process';
+
+await build({
+  entryPoints: ['./src/index.ts'],
+  bundle: true,
+  platform: 'node',
+  target: 'node24',
+  minify: !!env.CI,
+  tsconfig: 'tsconfig.dist.json',
+  sourcemap: true,
+  format: 'esm',
+  outdir: './dist/',
+  inject: ['tools/cjs-shim.ts'], // https://github.com/evanw/esbuild/issues/1921#issuecomment-1898197331
+});

tools/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "@tsconfig/strictest/tsconfig.json",
+    "@tsconfig/node24/tsconfig.json"
+  ],
+  "compilerOptions": {
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "noEmit": true
+  }
+}

tsconfig.dist.json

@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "types": ["node"]
+  },
+  "files": ["./src/index.ts"]
+}

tsconfig.eslint.json

@@ -1,4 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "include": ["**/*.js", "**/*.ts", "**/*.d.ts", ".*.js"]
-}

tsconfig.json

@@ -1,12 +1,16 @@
 {
+  "extends": [
+    "@tsconfig/strictest/tsconfig.json",
+    "@tsconfig/node24/tsconfig.json"
+  ],
   "compilerOptions": {
-    "target": "es2020",
-    "module": "commonjs",
-    "moduleResolution": "node",
-    "resolveJsonModule": true,
-    "esModuleInterop": true,
-    "allowSyntheticDefaultImports": true,
     "allowJs": true,
-    "outDir": "dist"
-  }
+    "allowSyntheticDefaultImports": true,
+    "outDir": "dist",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "noImplicitAny": false,
+    "noPropertyAccessFromIndexSignature": false /* makes code more complex */
+  },
+  "exclude": ["node_modules/", "**/__mocks__/*", "dist/", "coverage/", "html/"]
 }