TPTito Pinardo Gutiérrez
← Articles
Español

Near miss Published on · 1U · GIT

Renovate at home: three upgrades that never applied

Renovate opens a PR for every pinned version that has a new release, and each one goes through CI and the plan like any change. On the first day of PRs, one of them came with a zero-change plan. Pulling that thread turned up three roles that had been «upgrading» for a while without upgrading anything.

  • Renovate
  • Ansible
  • Forgejo · Actions

What Renovate does here

All my infrastructure pins versions: Forgejo, Terraform, Traefik, Qdrant, the home dashboard, the Matrix client, the Terraform providers… Re-running a playbook must not upgrade anything by surprise, so every bump is a change with its own commit. Until now I did it by hand, when I remembered.

Now, every Monday, Renovate checks those versions and opens a PR for each one with a new release. Pinned downloads carry their SHA-256, and a small script takes it from the release's official checksum file. If the release doesn't publish one, no PR comes out. Major versions wait for my approval in an issue, and databases stay out.

Nothing applies on its own: every PR goes through CI, brings its plan as a comment and, once merged, is applied with the same click as one of my changes.

# renovate: datasource=docker depName=qdrant/qdrant extractVersion=^v(?<version>.+)$
qdrant_version: "1.19.1"

The plan that didn't add up

The Qdrant PR went from 1.19.1 to 1.19.2. CI went green and the plan said the Qdrant playbook would run with zero tasks changed. A new version that changes nothing makes no sense: something had to be downloaded and installed.

The role downloaded the binary to a fixed temporary path and skipped the download if a file was already there. The previous version's was there, so the new one was never fetched and the old one was reinstalled. The inventory said 1.19.2 and the server was still on 1.19.1.

Traefik had the same flaw. And the control node's Ansible tool used «make sure it's installed», so an installed version was never touched: the PR for its new version wouldn't have changed anything either.

The fix

  • Each version in its own directory, as other roles already did: a new version is a new path, which doesn't exist until it's downloaded.
  • The Ansible tool compares the installed version with the requested one and, if they differ, upgrades inside the same environment without losing what was added.
  • Along the way, out with the noise: several tasks showed as «changed» on every deployment without changing anything (packages copied to a folder that emptied itself). Now a plan with changes means changes.

Why I hadn't seen it

Bumping numbers by hand, I'd run the playbook, it went green and I took the upgrade as done. Nobody compared the number with what was actually running.

With Renovate, every bump brings a plan that says how many tasks would change, and I read it before merging. A zero where there should be a change stands out.

Result

All three roles really upgrade now, and that day's Renovate PRs were merged with their plans already showing the changes. Since then, the only work versions leave me is reading the plan and clicking.