Running renovate on github actions without extra tokens

Caveats

Bear in mind that even though this works it has a couple of caveats:

Renovate cannot create PRs for files inside .workflows since that requires a permission of workflows that cannot be granted on a github action token
The PRs created by the github actions token do not run CI jobs at all

The problem

I’d like to run renovate on github actions but I really don’t like the idea of creating tokens to give it permissions to create issues and pull requests.

The plan

In a quick google search I couldn’t find any example of renovate using the ephemeral github actions tokens (which are created for each run).

When

First I want this to run once a week, so we use the github actions cron trigger (you can use crontab guru for the syntax).

on:
  schedule:
    - cron: '0 6 * * 1'

I’d also like to be able to trigger it manually:

on:
  workflow_dispatch:

Who

The github actions token has very few permissions to run renovate, so we need to give it some.

jobs:
  renovate:
    permissions:
      contents: write
      pull-requests: write
      issues: write
      packages: write

Here it depends on what we want renovate to do but:

contents: To be able to create files in the repo, mainly to create PRs.
pull-requests: If we want renovate to create PRs on its own.
issues: So renovate can manage its own dashboard.

What

Finally we need to pass the github actions token to the renovate action.

jobs:
  renovate:
    steps:
      - uses: actions/checkout@v5
      - uses: renovatebot/[email protected]
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
        env:
          RENOVATE_REPOSITORIES: ${{ github.repository }}
          # LOG_LEVEL: 'debug'

Note that we need to tell it the name of the repo we want it to work on because renovate runs in a container so it doesn’t have access to the repo. But we still need checkout to get the renovate configuration.

Debug

If something doesn’t work we can pass LOG_LEVEL so renovate tells us in detail what it’s doing.

jobs:
  renovate:
    steps:
      - uses: renovatebot/[email protected]
        env:
          LOG_LEVEL: 'debug'

One last detail for PRs

Finally if we want renovate to be able to create PRs we need to allow it on the project settings, for example: https://github.com/USER/REPOSITORY/settings/actions. There we need to go to the section Workflow permissions and:

Enable Allow GitHub Actions to create and approve pull requests.
Switch the radio button from Read repository contents and packages permissions to Workflows have read and write permissions in the repository for all scopes.

TLDR

In summary the file would go in .github/workflows/renovate.yaml with:

name: Renovate
on:
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

jobs:
  renovate:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
      packages: write
    steps:
      - uses: actions/checkout@v6
      - uses: renovatebot/[email protected]
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
        env:
          RENOVATE_REPOSITORIES: ${{ github.repository }}
          # LOG_LEVEL: 'debug'