Automate dependency updates

.github/workflows/pipeline-bump-cpp-deps.yml

@@ -0,0 +1,77 @@
+name: Bump-Cpp-Deps
+
+# Weekly bump of the C++ library pins that Renovate has no manager for.
+
+on:
+  schedule:
+    - cron: "0 0 * * 1" # Mondays at 00:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  bump-cpp-dependencies:
+    runs-on: ubuntu-24.04
+    # The weekly cron only runs on the canonical repo. Forks can still trigger it manually.
+    if: github.event_name != 'schedule' || github.repository == 'ngcpp/proxy'
+    steps:
+      - name: Mint a GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.DEPENDENCY_MANAGER_APP_ID }}
+          private-key: ${{ secrets.DEPENDENCY_MANAGER_APP_PRIVATE_KEY }}
+
+      - name: Resolve the bot's commit identity
+        id: bot
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          slug='${{ steps.app-token.outputs.app-slug }}'
+          uid=$(gh api "/users/${slug}[bot]" --jq '.id')
+          echo "name=${slug}[bot]" >> "$GITHUB_OUTPUT"
+          echo "email=${uid}+${slug}[bot]@users.noreply.github.com" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v6
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Install Meson
+        run: python3 -m pip install --upgrade pip meson
+
+      - name: Bump CMake and Meson dependencies
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: python3 tools/bump_cmake_meson_deps.py
+
+      - name: Open or update the pull request
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GIT_NAME: ${{ steps.bot.outputs.name }}
+          GIT_EMAIL: ${{ steps.bot.outputs.email }}
+          BASE: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "No dependency changes; nothing to do."
+            exit 0
+          fi
+          branch=auto/bump-cpp-deps
+          git config user.name "$GIT_NAME"
+          git config user.email "$GIT_EMAIL"
+          git checkout -B "$branch"
+          git add -A
+          git commit -m "Bump CMake and Meson dependencies"
+          git push --force origin "$branch"
+          if [ -n "$(gh pr list --head "$branch" --base "$BASE" --state open --json number --jq '.[0].number // empty')" ]; then
+            echo "Updated the existing pull request."
+          else
+            gh pr create --base "$BASE" --head "$branch" \
+              --title "Bump CMake and Meson dependencies" \
+              --body 'Automated bump of the CMake FetchContent registries and the Meson wraps (tools/bump_cmake_meson_deps.py). The Renovate pipeline handles everything else.'
+          fi

.github/workflows/pipeline-bump-renovate-deps.yml

@@ -0,0 +1,53 @@
+name: Bump-Renovate-Deps
+
+# Weekly Renovate run that bumps every dependency it has a manager for, all in one pull request.
+
+on:
+  schedule:
+    - cron: "0 0 * * 1" # Mondays at 00:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  renovate:
+    runs-on: ubuntu-24.04
+    # The weekly cron only runs on the canonical repo. Forks can still trigger it manually.
+    if: github.event_name != 'schedule' || github.repository == 'ngcpp/proxy'
+    steps:
+      - name: Mint a GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.DEPENDENCY_MANAGER_APP_ID }}
+          private-key: ${{ secrets.DEPENDENCY_MANAGER_APP_PRIVATE_KEY }}
+
+      - name: Resolve the bot's commit identity
+        id: bot
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          slug='${{ steps.app-token.outputs.app-slug }}'
+          uid=$(gh api "/users/${slug}[bot]" --jq '.id')
+          echo "git-author=${slug}[bot] <${uid}+${slug}[bot]@users.noreply.github.com>" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Run Renovate
+        env:
+          RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
+          RENOVATE_USERNAME: ${{ steps.app-token.outputs.app-slug }}[bot]
+          RENOVATE_GIT_AUTHOR: ${{ steps.bot.outputs.git-author }}
+          RENOVATE_PLATFORM: github
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_AUTODISCOVER: "false"
+          RENOVATE_ONBOARDING: "false"
+          RENOVATE_BASE_BRANCHES: ${{ github.ref_name }}
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^bazel mod graph --lockfile_mode=update$"]'
+          LOG_LEVEL: info
+        run: npx --yes renovate

CMakeLists.txt

@@ -106,6 +106,9 @@ install(
 if(BUILD_TESTING)
   include(CTest)
 
+  include(cmake/read_dependencies.cmake)
+  proxy_read_dependencies("${CMAKE_CURRENT_SOURCE_DIR}/cmake/dependencies.json")
+
   include(FetchContent)
   # The policy uses the download time for timestamp, instead of the timestamp in the archive. This
   # allows for proper rebuilds when a projects URL changes.
@@ -115,9 +118,8 @@ if(BUILD_TESTING)
 
   FetchContent_Declare(
     fmt
-    URL https://github.com/fmtlib/fmt/archive/refs/tags/12.1.0.tar.gz
-    URL_HASH
-      SHA256=ea7de4299689e12b6dddd392f9896f08fb0777ac7168897a244a6d6085043fea
+    URL ${PROXY_FMT_URL}
+    URL_HASH SHA256=${PROXY_FMT_SHA256}
     SYSTEM
   )
   FetchContent_MakeAvailable(fmt)

benchmarks/CMakeLists.txt

@@ -2,9 +2,8 @@ project(msft_proxy_benchmarks)
 
 FetchContent_Declare(
   benchmark
-  URL https://github.com/google/benchmark/archive/refs/tags/v1.9.5.tar.gz
-  URL_HASH
-    SHA256=9631341c82bac4a288bef951f8b26b41f69021794184ece969f8473977eaa340
+  URL ${PROXY_BENCHMARK_URL}
+  URL_HASH SHA256=${PROXY_BENCHMARK_SHA256}
 )
 set(
   BENCHMARK_ENABLE_TESTING

cmake/dependencies.json

@@ -0,0 +1,17 @@
+[
+  {
+    "name": "fmt",
+    "url": "https://github.com/fmtlib/fmt/archive/refs/tags/12.1.0.tar.gz",
+    "sha256": "ea7de4299689e12b6dddd392f9896f08fb0777ac7168897a244a6d6085043fea"
+  },
+  {
+    "name": "googletest",
+    "url": "https://github.com/google/googletest/archive/refs/tags/v1.17.0.tar.gz",
+    "sha256": "65fab701d9829d38cb77c14acdc431d2108bfdbf8979e40eb8ae567edf10b27c"
+  },
+  {
+    "name": "benchmark",
+    "url": "https://github.com/google/benchmark/archive/refs/tags/v1.9.5.tar.gz",
+    "sha256": "9631341c82bac4a288bef951f8b26b41f69021794184ece969f8473977eaa340"
+  }
+]

cmake/read_dependencies.cmake

@@ -0,0 +1,20 @@
+# Read a JSON dependency registry and expose PROXY_<NAME>_URL / PROXY_<NAME>_SHA256 in the caller's scope for FetchContent_Declare.
+
+function(proxy_read_dependencies _json_path)
+  file(READ "${_json_path}" _json)
+  set_property(
+    DIRECTORY
+    APPEND
+    PROPERTY CMAKE_CONFIGURE_DEPENDS "${_json_path}"
+  )
+  string(JSON _count LENGTH "${_json}")
+  math(EXPR _last "${_count} - 1")
+  foreach(_i RANGE 0 ${_last})
+    string(JSON _name GET "${_json}" ${_i} "name")
+    string(JSON _url GET "${_json}" ${_i} "url")
+    string(JSON _sha GET "${_json}" ${_i} "sha256")
+    string(TOUPPER "${_name}" _name)
+    set("PROXY_${_name}_URL" "${_url}" PARENT_SCOPE)
+    set("PROXY_${_name}_SHA256" "${_sha}" PARENT_SCOPE)
+  endforeach()
+endfunction()

renovate.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "enabledManagers": [
+    "github-actions",
+    "pre-commit",
+    "pip_requirements",
+    "bazel-module",
+    "bazelisk"
+  ],
+  "pre-commit": {
+    "enabled": true
+  },
+  "separateMajorMinor": false,
+  "updateLockFiles": false,
+  "prHourlyLimit": 0,
+  "branchPrefix": "auto/bump-renovate-",
+  "packageRules": [
+    {
+      "description": "One weekly PR on auto/bump-renovate-deps.",
+      "matchManagers": [
+        "github-actions",
+        "pre-commit",
+        "pip_requirements",
+        "bazel-module",
+        "bazelisk"
+      ],
+      "groupName": "dependencies",
+      "groupSlug": "deps"
+    }
+  ],
+  "postUpgradeTasks": {
+    "description": "Refresh MODULE.bazel.lock to track the bazel_dep versions Renovate bumped.",
+    "commands": ["bazel mod graph --lockfile_mode=update"],
+    "fileFilters": ["MODULE.bazel.lock"],
+    "executionMode": "branch"
+  }
+}

subprojects/fmt.wrap

@@ -1,13 +1,13 @@
 [wrap-file]
-directory = fmt-12.1.0
-source_url = https://github.com/fmtlib/fmt/archive/12.1.0.tar.gz
-source_filename = fmt-12.1.0.tar.gz
-source_hash = ea7de4299689e12b6dddd392f9896f08fb0777ac7168897a244a6d6085043fea
-source_fallback_url = https://github.com/wrapdb/fmt/releases/download/12.1.0-4/fmt-12.1.0.tar.gz
-patch_filename = fmt_12.1.0-4_patch.zip
-patch_url = https://github.com/wrapdb/fmt/releases/download/12.1.0-4/fmt_12.1.0-4_patch.zip
-patch_hash = 65b7fe3c29f25528011bc295e83e4f6f10028c922407e003b7856bb79789f345
-3rdparty_wrapdb_version = 12.1.0-4
+directory = fmt-12.0.0
+source_url = https://github.com/fmtlib/fmt/archive/12.0.0.tar.gz
+source_filename = fmt-12.0.0.tar.gz
+source_hash = aa3e8fbb6a0066c03454434add1f1fc23299e85758ceec0d7d2d974431481e40
+source_fallback_url = https://github.com/mesonbuild/wrapdb/releases/download/fmt_12.0.0-1/fmt-12.0.0.tar.gz
+patch_filename = fmt_12.0.0-1_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/fmt_12.0.0-1/get_patch
+patch_hash = 307f288ebf3850abf2f0c50ac1fb07de97df9538d39146d802f3c0d6cada8998
+wrapdb_version = 12.0.0-1
 
 [provide]
 dependency_names = fmt

tests/CMakeLists.txt

@@ -2,9 +2,8 @@ project(msft_proxy_tests)
 
 FetchContent_Declare(
   googletest
-  URL https://github.com/google/googletest/archive/refs/tags/v1.17.0.tar.gz
-  URL_HASH
-    SHA256=65fab701d9829d38cb77c14acdc431d2108bfdbf8979e40eb8ae567edf10b27c
+  URL ${PROXY_GOOGLETEST_URL}
+  URL_HASH SHA256=${PROXY_GOOGLETEST_SHA256}
 )
 set(gtest_force_shared_crt ON CACHE BOOL "" FORCE) # For Windows: Prevent overriding the parent project's compiler/linker settings
 set(BUILD_GMOCK OFF CACHE BOOL "" FORCE) # Disable GMock