first commit

.github/renovate.json5

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    ":semanticCommitsDisabled",
+    "github>grafana/sm-renovate//renovate/grafana.json5",
+    "github>grafana/sm-renovate//renovate/alpine-packages.json5"
+  ],
+  "packageRules": [
+    {
+      // Update alpine itself and all dependencies in the same PR. This ensures consistency, e.g. makes sure a PR
+      // renovate does not attempt to update chromium without updating alpine if an update for the latter is also
+      // available, as that PR would fail.
+      "matchFileNames": [
+        "Dockerfile"
+      ],
+      "groupName": "Dockerfile",
+    },
+  ],
+  "customManagers": [
+    {
+      // Update alpine tag, which is stored in an ARG for easy greppability.
+      "customType": "regex",
+      "depNameTemplate": "alpine",
+      "datasourceTemplate": "docker",
+      "fileMatch": [
+        "Dockerfile"
+      ],
+      "matchStrings": [
+        "ALPINE_VERSION=(?<currentValue>[^@\\s]+)(?:@(?<currentDigest>\\S+))?"
+      ]
+    },
+    {
+      // Update chromium version from alpine packages.
+      "customType": "regex",
+      "fileMatch": [
+        "Dockerfile",
+      ],
+      "matchStrings": [
+        "CHROMIUM_VERSION=(?<currentValue>[-.\\w]+)"
+      ],
+      "depNameTemplate": "chromium-swiftshader",
+      "versioningTemplate": "loose", // The most lenient versioning renovate supports.
+      // We use two different datasources for main and community, as alpine serves them in different URLs.
+      "datasourceTemplate": "custom.alpine-community",
+      // Extracted "versions" include the package name, so here we strip that prefix using a regex.
+      "extractVersionTemplate": "{{depName}}-(?<version>.+).apk",
+    },
+  ]
+}

.github/workflows/push-pr-release.yaml

@@ -0,0 +1,32 @@
+name: Build
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+
+jobs:
+  build-contianer:
+    name: Build container
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Gather versions
+        id: repo
+        run: |-
+          alpine_version_full="$(grep -e "ALPINE_VERSION=" Dockerfile | cut -d '=' -f 2)"
+          alpine_version="${alpine_version_full%@*}"
+          chromium_version="$(grep -e "CHROMIUM_VERSION=" Dockerfile | cut -d '=' -f 2)"
+          echo "alpine_version_full=$alpine_version_full" >> "$GITHUB_OUTPUT"
+          echo "alpine_version=$alpine_version" >> "$GITHUB_OUTPUT"
+          echo "chromium_version=$chromium_version" >> "$GITHUB_OUTPUT"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          push: ${{ github.event_name == 'push' }}
+          tags: ghcr.io/${{ github.repository}}:${{ steps.repo.outputs.chromium_version }}-${{ steps.repo.outputs.alpine_version }}

.github/workflows/renovate-validate.yaml

@@ -0,0 +1,24 @@
+name: Validate renovate config
+on:
+  pull_request:
+    paths:
+      # When renovate config changes:
+      - "renovate.*"
+      - ".renovate.*"
+      - ".github/renovate.*"
+      # Also when renovate version changes:
+      - ".github/workflows/renovate*"
+
+jobs:
+  renovate:
+    permissions:
+      # Needed for logging into vault.
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Self-hosted renovate
+        uses: grafana/sm-renovate/actions/renovate-validate@main

.github/workflows/renovate.yaml

@@ -0,0 +1,20 @@
+name: Self-hosted Renovate
+
+on:
+  schedule:
+    - cron: "22 */4 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    permissions:
+      # Needed for logging into vault.
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Self-hosted renovate
+        uses: grafana/sm-renovate/actions/renovate@main

Dockerfile

@@ -0,0 +1,7 @@
+# Renovate updates these version. Keep their format as it is.
+ARG ALPINE_VERSION=3.20.3@sha256:1e42bbe2508154c9126d48c2b8a75420c3544343bf86fd041fb7527e017a4b4a
+ARG CHROMIUM_VERSION=131.0.6778.69-r0
+
+FROM alpine:${ALPINE_VERSION}
+
+RUN apk add --no-cache "chromium-swiftshader=${CHROMIUM_VERSION}"