### Automate Renovate Onboarding Steps (Bash)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

These bash commands outline the steps required to integrate a new repository with Renovate. This involves updating configuration files in the central github-config repository and disabling Dependabot.

```bash
# Steps to onboard a repository to Renovate:
# 1. Add repository to .github/renovate-config.js in github-config
# 2. Remove .github/dependabot.yml from target repository
# 3. Add dependabot.yml and renovate.json to .github/.syncignore
# 4. Create .github/renovate.json extending github-config configuration
```

--------------------------------

### Conditional Image Display Logic (Go Template)

Source: https://github.com/paketo-buildpacks/github-config/blob/main/actions/stack/release-notes/entrypoint/template.md

This Go template snippet determines which image information to display based on the presence of `.BuildImage`. If `.BuildImage` is not set, it displays the run image. Otherwise, it displays both build and run images.

```go-template
{{- if not .BuildImage -}}
## Image - `{{- .RunImage -}}`
{{- else }}
## Images
Build: `{{- .BuildImage -}}`
Run: `{{- .RunImage -}}`
{{- end }}
```

--------------------------------

### Display Known CVEs (Go Template)

Source: https://github.com/paketo-buildpacks/github-config/blob/main/actions/stack/release-notes/entrypoint/template.md

This Go template snippet conditionally displays known CVEs for build and run images if either `.BuildCveReport` or `.RunCveReport` is present. It uses `<details>` and `<summary>` tags to create collapsible sections for each image's CVE report table.

```go-template
{{- if or .BuildCveReport .RunCveReport}}
## Known CVEs
This section lists known CVEs of Critical, High and Unknown severity.

{{if .BuildCveReport }}
### Build Image
<details>
<summary>Table</summary>
{{.BuildCveReport}}
</details>
{{- end }}

{{if .RunCveReport }}
### Run Image
<details>
<summary>Table</summary>
{{.RunCveReport}}
</details>
{{- end }}
{{- end }}
```

--------------------------------

### Configure Renovate with Paketo Bot (JavaScript)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

This JavaScript configuration file sets up Renovate for the paketo-buildpacks organization. It specifies the bot user, author, enables fork processing, and lists repositories to be managed by Renovate.

```javascript
// File: .github/renovate-config.js (in github-config repository)
module.exports = {
    username: 'paketo-bot',
    gitAuthor: 'paketo-bot <paketobuildpacks@gmail.com>',
    onboarding: false,
    platform: 'github',
    forkProcessing: 'enabled',
    repositories: [
        "paketo-buildpacks/nodejs",
        "paketo-buildpacks/go",
        "paketo-buildpacks/java"
    ]
}
```

--------------------------------

### GitHub Actions Workflow: Create Draft Release

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

This workflow automates the process of running unit and integration tests, calculating the semantic version, packaging artifacts, and creating a draft GitHub release. It utilizes custom actions for semver calculation and release creation.

```yaml
# File: implementation/.github/workflows/create-draft-release.yml
name: Create or Update Draft Release

on:
  push:
    branches:
    - main
  repository_dispatch:
    types: [ version-bump ]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version of the release to cut (e.g. 1.2.3)'
        required: false

concurrency: release

jobs:
  unit:
    name: Unit Tests
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v5
    - uses: actions/setup-go@v6
      with:
        go-version-file: go.mod
    - run: ./scripts/unit.sh

  integration:
    name: Integration Tests
    runs-on: ubuntu-24.04
    needs: unit
    steps:
    - uses: actions/checkout@v5
    - uses: actions/setup-go@v6
      with:
        go-version-file: go.mod
    - run: ./scripts/integration.sh --builder paketobuildpacks/builder:base --token ${{ github.token }}

  release:
    name: Release
    runs-on: ubuntu-24.04
    needs: integration
    steps:
    - uses: actions/checkout@v5
      with:
        fetch-tags: true

    - name: Calculate Semver Tag
      id: semver
      uses: paketo-buildpacks/github-config/actions/tag/calculate-semver@main
      with:
        repo: ${{ github.repository }}
        token: ${{ github.token }}
        ref-name: ${{ github.ref_name }}

    - name: Package
      run: ./scripts/package.sh --version "${{ steps.semver.outputs.tag }}"

    - name: Create Release
      uses: paketo-buildpacks/github-config/actions/release/create@main
      with:
        repo: ${{ github.repository }}
        token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
        tag_name: v${{ steps.semver.outputs.tag }}
        target_commitish: ${{ github.sha }}
        name: v${{ steps.semver.outputs.tag }}
        body_filepath: "./release_notes"
        draft: true
        assets: ${{ steps.create_release_assets.outputs.release_assets }}

```

--------------------------------

### Bootstrap New CNB with Common GitHub Config

Source: https://github.com/paketo-buildpacks/github-config/blob/main/README.md

This script bootstraps a new Cloud Native Buildpack (CNB) by copying common configuration files from the github-config repository. It requires the target path of the new CNB and its repository type (implementation, language-family, or builder) as input.

```shell
# type is either "implementation", "language-family", or "builder"
./scripts/bootstrap.sh --target <path/to/your/cnb> --repo-type <type>
```

--------------------------------

### Create GitHub Release Action (Go)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Go program to create GitHub releases, either as drafts or published. Supports uploading assets like buildpack archives (.tgz) and packages (.cnb). Can specify tag name, target commitish, release name, body content (or from a file), and draft status. Requires repository and token.

```go
# Go implementation
go run ./actions/release/create/entrypoint/main.go \
  -repo paketo-buildpacks/nodejs \
  -token ${GITHUB_TOKEN} \
  -tag-name v1.2.3 \
  -target-commitish main \
  -name "Node.js Buildpack v1.2.3" \
  -body "Release notes content" \
  -draft \
  -assets '[ 
    {
      "path": "build/buildpack.tgz",
      "name": "nodejs-buildpack-1.2.3.tgz",
      "content_type": "application/gzip"
    },
    {
      "path": "build/buildpackage.cnb",
      "name": "nodejs-buildpack-1.2.3.cnb",
      "content_type": "application/gzip"
    }
  ]'

# Create release from file
go run ./actions/release/create/entrypoint/main.go \
  -repo paketo-buildpacks/go \
  -token ${GITHUB_TOKEN} \
  -tag-name v2.0.0 \
  -target-commitish abc123 \
  -name "Go Buildpack v2.0.0" \
  -body-filepath ./release-notes.md \
  -assets '[]'
```

--------------------------------

### Repository Structure Overview (Bash)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

This is a representation of the directory structure within the paketo-buildpacks/github-config repository. It illustrates how configurations for various buildpack types, actions, and scripts are organized.

```bash
# Repository structure
.
├── actions/                    # Reusable GitHub Actions
│   ├── dispatch/              # Repository event dispatcher
│   ├── release/               # Release creation and management
│   │   ├── create/           # Create releases with assets
│   │   ├── download-asset/   # Download release assets
│   │   └── reset-draft/      # Reset draft releases
│   └── tag/                   # Version tag management
│       └── calculate-semver/  # Automatic semver calculation
├── implementation/            # Implementation buildpack configs
│   ├── .github/workflows/    # CI/CD workflows for implementations
│   └── scripts/              # Build, test, package scripts
├── language-family/           # Language-family buildpack configs
│   ├── .github/workflows/    # CI/CD workflows for composites
│   └── scripts/              # Package, test, publish scripts
├── builder/                   # Builder image configs
│   ├── .github/workflows/    # Builder creation workflows
│   └── scripts/              # Builder smoke tests and publishing
├── stack/                     # Stack image configs
│   ├── .github/workflows/    # Stack build and release workflows
│   └── scripts/              # Stack creation and testing
├── library/                   # Go library configs
│   └── .github/workflows/    # Library testing workflows
├── renovate/                  # Renovate configuration presets
└── scripts/                   # Repository management scripts
    ├── bootstrap.sh          # Bootstrap new repositories
    ├── sanity.sh            # Validate configuration
    └── repo_rules.sh        # Check branch protection rules
```

--------------------------------

### Bootstrap New Buildpack Repository Script

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Shell script to copy standardized configuration files for creating new buildpack repositories. Supports different repository types: implementation, language-family, and builder. Requires a target path for the new repository.

```bash
# Bootstrap an implementation buildpack
./scripts/bootstrap.sh --target /path/to/my-buildpack --repo-type implementation

# Bootstrap a language-family buildpack
./scripts/bootstrap.sh --target /path/to/java-buildpack --repo-type language-family

# Bootstrap a builder
./scripts/bootstrap.sh --target /path/to/my-builder --repo-type builder
```

--------------------------------

### Display Package Changes for Build Image (Go Template)

Source: https://github.com/paketo-buildpacks/github-config/blob/main/actions/stack/release-notes/entrypoint/template.md

This Go template snippet conditionally displays package changes (added, modified, removed) for the build image. It checks if there are any packages and if the list is within the display limit. If too large, it indicates that it's too large to include.

```go-template
{{- if .BuildImage -}}

## Build Image Package Changes
### Added
{{- if and (gt (len .BuildAdded) 0) (lt (len .BuildAdded) .ReceiptsShowLimit) }}
```
{{- range .BuildAdded }}
{{ .Name }} {{ .Version }} (PURL: {{ .PURL }})
{{- end }}
```
{{- else if and (gt (len .BuildAdded) 0) (gt (len .BuildAdded) .ReceiptsShowLimit) }}
```
❌ TOO large to include
```
{{- else }}
No packages added.
{{- end }}

### Modified
{{- if and (gt (len .BuildModified) 0) (lt (len .BuildModified) .ReceiptsShowLimit) }}
```
{{- range .BuildModified }}
{{ .Name }} {{ .PreviousVersion }} ==> {{ .CurrentVersion }} (PURL: {{ .PreviousPURL }} ==> {{ .CurrentPURL }})
{{- end }}
```
{{- else if and (gt (len .BuildModified) 0) (gt (len .BuildModified) .ReceiptsShowLimit) }}
```
❌ TOO large to include
```
{{- else }}
No packages modified.
{{- end }}

### Removed
{{- if and (gt (len .BuildRemoved) 0) (lt (len .BuildRemoved) .ReceiptsShowLimit) }}
```
{{- range .BuildRemoved }}
{{ .Name }} {{ .Version }} (PURL: {{ .PURL }})
{{- end }}
```
{{- else if and (gt (len .BuildRemoved) 0) (gt (len .BuildRemoved) .ReceiptsShowLimit) }}
```
❌ TOO large to include
```
{{- else }}
No packages removed.
{{- end }}
{{- end }}
```

--------------------------------

### Display Package Changes for Run Image (Go Template)

Source: https://github.com/paketo-buildpacks/github-config/blob/main/actions/stack/release-notes/entrypoint/template.md

This Go template snippet conditionally displays package changes (added, modified, removed) for the run image. It checks if there are any packages and if the list is within the display limit. If too large, it indicates that it's too large to include.

```go-template
## Run Image Package Changes
### Added
{{- if and (gt (len .RunAdded) 0) (lt (len .RunAdded) .ReceiptsShowLimit) }}
```
{{- range .RunAdded }}
{{ .Name }} {{ .Version }} (PURL: {{ .PURL }})
{{- end }}
```
{{- else if and (gt (len .RunAdded) 0) (gt (len .RunAdded) .ReceiptsShowLimit) }}
```
❌ TOO large to include
```
{{- else }}
No packages added.
{{- end }}

### Modified
{{- if and (gt (len .RunModified) 0) (lt (len .RunModified) .ReceiptsShowLimit) }}
```
{{- range .RunModified }}
{{ .Name }} {{ .PreviousVersion }} ==> {{ .CurrentVersion }} (PURL: {{ .PreviousPURL }} ==> {{ .CurrentPURL }})
{{- end }}
```
{{- else if and (gt (len .RunModified) 0) (gt (len .RunModified) .ReceiptsShowLimit) }}
```
❌ TOO large to include
```
{{- else }}
No packages modified.
{{- end }}

### Removed
{{- if and (gt (len .RunRemoved) 0) (lt (len .RunRemoved) .ReceiptsShowLimit) }}
```
{{- range .RunRemoved }}
{{ .Name }} {{ .Version }} (PURL: {{ .PURL }})
{{- end }}
```
{{- else if and (gt (len .RunRemoved) 0) (gt (len .RunRemoved) .ReceiptsShowLimit) }}
```
❌ TOO large to include
```
{{- else }}
No packages removed.
{{- end }}
```

--------------------------------

### Calculate Next Semantic Version (Go)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Determines the next semantic version based on merged pull request labels ('semver:patch', 'semver:minor', 'semver:major'). It reads merged PRs since the last release and outputs the calculated tag to $GITHUB_OUTPUT. This script can also be used to set an initial version for a new branch.

```bash
# Go implementation
go run ./actions/tag/calculate-semver/entrypoint/main.go \
  -repo paketo-buildpacks/nodejs \
  -token ${GITHUB_TOKEN} \
  -ref-name main

# Reads merged PRs since last release and checks for labels:
# - semver:patch → increment patch version (0.0.X)
# - semver:minor → increment minor version (0.X.0)
# - semver:major → increment major version (X.0.0)

# Writes to $GITHUB_OUTPUT:
# tag=1.2.4

# Start new version line
go run ./actions/tag/calculate-semver/entrypoint/main.go \
  -repo paketo-buildpacks/go \
  -token ${GITHUB_TOKEN} \
  -ref-name v2.x \
  -latest-version 2.0.0

# For first release on new branch:
# tag=2.0.0
```

--------------------------------

### Dispatch Repository Events Action (Go)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Go program to send repository dispatch events, triggering workflows across multiple repositories. Requires API endpoint, repository list, GitHub token, event type, and a JSON payload. Useful for coordinating actions like dependency updates across different buildpacks.

```go
# Go implementation
go run ./actions/dispatch/entrypoint/main.go \
  -endpoint https://api.github.com \
  -repos "paketo-buildpacks/nodejs,paketo-buildpacks/go" \
  -token ${GITHUB_TOKEN} \
  -event dependency-update \
  -payload '{"dependency":"node","version":"18.0.0"}'

# Output:
# Dispatching
#   Repository: paketo-buildpacks/nodejs
# Success!
#   Repository: paketo-buildpacks/go
# Success!
```

--------------------------------

### Package Buildpack Script (Implementation & Language Family)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Shell script to build and package buildpacks into .cnb files or release artifacts. Supports specifying a version, custom output paths, and GitHub tokens for tool downloads. For language-family buildpacks, it can also handle custom labels for multi-arch support and generates a complete release bundle.

```bash
# Package implementation buildpack with version
./scripts/package.sh --version 1.2.3

# Package with custom output path
./scripts/package.sh --version 1.2.3 --output /tmp/my-buildpack.cnb

# Package with GitHub token for tool downloads
./scripts/package.sh --version 1.2.3 --token ${GITHUB_TOKEN}

# Package language-family buildpack
./scripts/package.sh --version 2.5.0

# Package with custom labels for multi-arch support
./scripts/package.sh --version 2.5.0 --label "io.buildpacks.stack.bionic=true"

# The script generates:
# - build/buildpack.tgz (buildpack archive)
# - build/buildpackage.cnb (single-arch package)
# - build/buildpackage-linux-amd64.cnb (architecture-specific package)
# - build/buildpack-release-artifact.tgz (complete release bundle with README, package.toml, buildpack.toml)
```

--------------------------------

### Display Patched USNs (Go Template)

Source: https://github.com/paketo-buildpacks/github-config/blob/main/actions/stack/release-notes/entrypoint/template.md

This Go template snippet conditionally displays a list of patched USNs (Ubuntu Security Notices) if the `.SupportsUsns` flag is true. It iterates over `.PatchedArray` to list each USN's title and URL. If no USNs are patched, it displays a 'No USNs patched' message.

```go-template
{{- if .SupportsUsns }}

## Patched USNs
{{- if ne (len .PatchedArray) 0 }}
{{ range .PatchedArray }}
- [{{- .Title -}}]({{- .URL -}})
{{- end }}
{{- else }}
No USNs patched in this release.
{{- end }}
{{- end }}
```

--------------------------------

### Configure Renovate Dependency Updates (JSON)

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

This JSON file configures Renovate to extend default configurations from the paketo-buildpacks/github-config repository. It ensures consistent dependency update strategies across Paketo buildpack repositories.

```json
// File: <buildpack-repo>/.github/renovate.json
{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
        "github>paketo-buildpacks/github-config//renovate/renovate-default.json"
    ]
}
```

--------------------------------

### Renovate Configuration for Dependency Updates

Source: https://github.com/paketo-buildpacks/github-config/blob/main/README.md

This JSON configuration snippet sets up Renovate for automatic dependency updates within a Paketo Buildpack repository. It extends the common Renovate configuration from the paketo-buildpacks/github-config repository. Ensure to replace '<respective configuration file in github-config>' with the actual file name.

```json
{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
        "github>paketo-buildpacks/github-config//renovate/<respective configuration file in github-config>"
    ]
}
```

--------------------------------

### GitHub Actions Workflow: Update Tools

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

This workflow is scheduled to run daily and automatically updates build tool versions (e.g., Jam, pack) across all buildpack types. It fetches the latest versions using a custom 'latest' action, updates a 'tools.json' file, commits the changes, and opens a pull request.

```yaml
# File: .github/workflows/update-tools.yml
name: Update Tools

on:
  schedule:
  - cron: '42 19 * * *' # daily at 19:42 UTC
  workflow_dispatch: {}

jobs:
  update:
    name: Update
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v5

    - name: Fetch Latest Jam
      id: latest-jam
      uses: paketo-buildpacks/github-config/actions/tools/latest@main
      with:
        token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
        repo: paketo-buildpacks/jam

    - name: Fetch Latest pack
      id: latest-pack
      uses: paketo-buildpacks/github-config/actions/tools/latest@main
      with:
        token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
        repo: buildpacks/pack

    - name: Update implementation tools.json
      env:
        JAM_VERSION: ${{ steps.latest-jam.outputs.version }}
        PACK_VERSION: ${{ steps.latest-pack.outputs.version }}
      run: |
        jq --null-input \
           --sort-keys \
           --arg pack "${PACK_VERSION}" \
           --arg jam "${JAM_VERSION}" \
           '{ pack: $pack, jam: $jam }' > ./implementation/scripts/.util/tools.json

    - name: Commit
      uses: paketo-buildpacks/github-config/actions/pull-request/create-commit@main
      with:
        message: "Updating tools"
        pathspec: "."

    - name: Open Pull Request
      uses: paketo-buildpacks/github-config/actions/pull-request/open@main
      with:
        token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
        title: "Updates tools"
        branch: automation/tools/update

```

--------------------------------

### Verify Branch Protection Rules Script

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Shell script to validate GitHub branch protection settings for a buildpack repository. It checks for required approving reviews, dismissal of stale reviews, code owner review requirements, status checks, linear history enforcement, admin enforcement, and restrictions on force pushes and branch deletions. Requires repository name, token, and optionally a branch name and verbose output.

```bash
# Check main branch protection rules
./scripts/repo_rules.sh \
  --repo paketo-buildpacks/nodejs \
  --token ${GITHUB_TOKEN}

# Check custom branch with verbose output
./scripts/repo_rules.sh \
  --repo paketo-buildpacks/go \
  --token ${GITHUB_TOKEN} \
  --branch develop \
  --verbose

# Validates:
# - Required approving review count (must be 1)
# - Dismiss stale reviews on new commits
# - Code owner review requirement
# - Status checks (Integration Tests, Semver Labels)
# - Linear history enforcement
# - Admin enforcement
# - Force push and branch deletion restrictions
```

--------------------------------

### Validate Repository Configuration Script

Source: https://context7.com/paketo-buildpacks/github-config/llms.txt

Shell script to validate the configuration structure of a repository against defined rules. It checks if specific directories contain only subdirectories, failing if non-directory files are present. Designed for buildpack, builder, and stack configurations.

```bash
# Validate github-config structure
./scripts/sanity.sh

# Output when valid:
# All files in implementation/, language-family/, builder/, and stack/ are directories

# Fails if non-directory files exist in these folders
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.