tutorial

Monitoring Renovate Bot with Vigilmon: Job Runner Health, Webhook Endpoints & Dashboard Status

How to monitor a self-hosted Renovate Bot instance with Vigilmon — detecting job runner failures, webhook endpoint downtime, and stalled dependency update schedules before they leave your repos unpatched.

Renovate Bot is the automated dependency updater that keeps your repositories free of outdated packages, Docker base images, Helm charts, and GitHub Actions versions. When running self-hosted, Renovate is a scheduled job that runs on your own infrastructure — a GitLab CI runner, a Kubernetes CronJob, a GitHub Actions self-hosted runner, or a standalone server. It quietly opens PRs for you. When it stops working, nothing breaks immediately — your apps just quietly fall behind on security patches and dependency updates, and you won't notice until a vulnerability report arrives or a major version EOL sneaks up. Vigilmon monitors your Renovate deployment so you know immediately when the update pipeline stalls.

What You'll Build

  • A heartbeat monitor that verifies Renovate jobs are completing on schedule
  • HTTP monitors for the Renovate dashboard (if you run renovate-graph or a dashboard UI)
  • Webhook endpoint monitoring if Renovate receives repository events
  • Alert channels to notify your team before the update queue grows stale

Prerequisites

  • Self-hosted Renovate running on Kubernetes, GitLab CI, GitHub Actions, or as a standalone service
  • Network access to configure Vigilmon heartbeat pings from your Renovate environment
  • A free account at vigilmon.online

Why You Need External Monitoring for Renovate

Renovate is easy to ignore precisely because it works silently. That silence becomes a liability:

Renovate failures are invisible. Unlike a web service that users hit directly, Renovate runs on a schedule. If the runner crashes, the CronJob fails to schedule, or authentication to your Git platform expires, nothing immediately breaks — Renovate just stops opening PRs. You'll only notice weeks later when teammates ask why dependency PRs have gone quiet.

Token and permission issues stall the entire queue. Renovate needs write access to repositories and API tokens for each package registry it consults (npm, Docker Hub, PyPI, etc.). When any of these expire or get rotated without updating Renovate's config, it silently fails on every repository it touches.

Schedule drift causes security gaps. Renovate is typically configured to run nightly or weekly. If a runner node is decommissioned, a CronJob schedule is accidentally modified, or the Kubernetes namespace is scaled to zero, the schedule drifts. You might not have a security patch applied for weeks before anyone notices.

The Renovate dashboard doesn't self-monitor. If you run the Renovate dashboard or renovate-graph, it provides useful visibility into queue status — but if the dashboard itself goes down, you lose that visibility without any alert.

Step 1: Set Up a Vigilmon Heartbeat Monitor

The most important Renovate monitor is a heartbeat: you configure Renovate to ping Vigilmon at the end of each successful run. If Vigilmon doesn't receive the ping within the expected window, it opens an incident.

In the Vigilmon dashboard:

  1. Go to Add Monitor → Heartbeat
  2. Name: renovate bot job
  3. Expected interval: match your Renovate schedule (e.g., 1 day for nightly runs, 6 hours for more frequent runs)
  4. Grace period: 1 hour (allows for long runs against large repository sets)
  5. Save — copy the heartbeat URL (e.g., https://vigilmon.online/heartbeat/abc123xyz)

Step 2: Add the Heartbeat Ping to Renovate

Option A: Kubernetes CronJob

If Renovate runs as a Kubernetes CronJob:

# renovate-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: renovate
  namespace: renovate
spec:
  schedule: "0 2 * * *"        # 02:00 UTC daily
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: renovate
              image: renovate/renovate:latest
              env:
                - name: RENOVATE_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: renovate-secrets
                      key: github-token
                - name: VIGILMON_HEARTBEAT_URL
                  valueFrom:
                    secretKeyRef:
                      name: renovate-secrets
                      key: vigilmon-heartbeat-url
                - name: LOG_LEVEL
                  value: "info"
              command:
                - /bin/sh
                - -c
                - |
                  set -e
                  renovate
                  # Only ping on successful completion
                  wget -qO- "$VIGILMON_HEARTBEAT_URL"
                  echo "Renovate run complete — heartbeat sent"

Create the secret:

kubectl create secret generic renovate-secrets \
  --from-literal=github-token='ghp_your_github_token' \
  --from-literal=vigilmon-heartbeat-url='https://vigilmon.online/heartbeat/abc123xyz' \
  -n renovate

Option B: GitLab CI Pipeline

If Renovate runs on a scheduled GitLab CI pipeline, add the heartbeat ping as a final step:

# .gitlab-ci.yml (renovate job)
renovate:
  image: renovate/renovate:latest
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
  script:
    - renovate
    - |
      # Send heartbeat after successful run
      wget -qO- "$VIGILMON_HEARTBEAT_URL"
  variables:
    LOG_LEVEL: info
    # Store VIGILMON_HEARTBEAT_URL in GitLab CI/CD Variables (masked)

Store the heartbeat URL as a masked CI/CD variable in GitLab: Settings → CI/CD → Variables → VIGILMON_HEARTBEAT_URL.

Option C: GitHub Actions Self-Hosted Runner

# .github/workflows/renovate.yml
name: Renovate
on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:

jobs:
  renovate:
    runs-on: self-hosted
    steps:
      - name: Run Renovate
        uses: renovatebot/github-action@v40
        with:
          token: ${{ secrets.RENOVATE_TOKEN }}
      
      - name: Send Vigilmon heartbeat
        if: success()   # Only ping on successful run
        run: |
          curl -fsS "${{ secrets.VIGILMON_HEARTBEAT_URL }}" > /dev/null
          echo "Heartbeat sent to Vigilmon"

Option D: Standalone Renovate Server

If you run Renovate as a persistent server (using renovate-server or a self-hosted Mend Renovate):

Add a health endpoint to your deployment and wire the heartbeat into your process manager. For a Docker Compose deployment:

# docker-compose.yml
services:
  renovate:
    image: renovate/renovate:latest
    environment:
      RENOVATE_TOKEN: ${RENOVATE_TOKEN}
      VIGILMON_HEARTBEAT_URL: ${VIGILMON_HEARTBEAT_URL}
    command: >
      sh -c "while true; do
        renovate && wget -qO- $$VIGILMON_HEARTBEAT_URL;
        sleep 86400;
      done"
    restart: unless-stopped

Step 3: Monitor the Renovate Dashboard (Optional)

If you run the Renovate dashboard UI (via renovate-graph, Mend Renovate's self-hosted dashboard, or a custom status page), add an HTTP monitor in Vigilmon:

  1. Go to Add Monitor → HTTP
  2. Set the URL to your dashboard: https://renovate.yourdomain.com/health or https://renovate.yourdomain.com
  3. Configure:
    • Check interval: 5 minutes
    • Expected status code: 200
    • Timeout: 10 seconds
  4. Save

If your dashboard includes a specific health endpoint, use that — it's more meaningful than the UI root. For the Mend Renovate self-hosted server, the health endpoint is typically /health.

Step 4: Monitor Renovate's Webhook Endpoint

If your Renovate instance receives repository webhooks (for event-driven runs on push, PR creation, or config change), that webhook endpoint is itself a service that needs monitoring:

For a webhook receiver deployed as a service:

# Vigilmon HTTP monitor for the Renovate webhook endpoint
# URL: https://renovate-webhook.yourdomain.com/webhook
# Expected: 200 or 204 (most webhook receivers return 204 No Content)
# Note: Vigilmon's probe won't send a valid webhook payload, so configure
#       the endpoint to return 200 on GET requests for health checks

If your webhook receiver doesn't have a GET health route, add one:

// webhook-server.js (Node.js example)
const express = require('express');
const app = express();

// Health check for Vigilmon
app.get('/health', (req, res) => {
  res.status(200).json({ status: 'ok', service: 'renovate-webhook' });
});

// Webhook handler
app.post('/webhook', express.json(), async (req, res) => {
  // Handle repository events that trigger Renovate
  res.status(204).end();
});

app.listen(3000);

Add a Vigilmon HTTP monitor:

  • URL: https://renovate-webhook.yourdomain.com/health
  • Expected status: 200
  • Check interval: 1 minute

Step 5: Detecting Renovate Token Expiry

Renovate uses personal access tokens (GitHub/GitLab) and package registry tokens that can expire. Create a separate CronJob that validates token health independently of the main run:

# renovate-token-check-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: renovate-token-check
  namespace: renovate
spec:
  schedule: "0 1 * * *"     # Daily, 1 hour before Renovate runs
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: token-check
              image: curlimages/curl:latest
              env:
                - name: GITHUB_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: renovate-secrets
                      key: github-token
                - name: TOKEN_HEARTBEAT_URL
                  valueFrom:
                    secretKeyRef:
                      name: renovate-secrets
                      key: token-check-heartbeat-url
              command:
                - /bin/sh
                - -c
                - |
                  set -e
                  # Verify GitHub token is valid
                  HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
                    -H "Authorization: token $GITHUB_TOKEN" \
                    https://api.github.com/user)
                  if [ "$HTTP_STATUS" != "200" ]; then
                    echo "FAIL: GitHub token invalid (HTTP $HTTP_STATUS)"
                    exit 1
                  fi
                  # Token is valid — send heartbeat
                  curl -fsS "$TOKEN_HEARTBEAT_URL" > /dev/null
                  echo "Token check passed"

Create a second Vigilmon heartbeat monitor for this check:

  • Name: renovate github token validity
  • Expected interval: 1 day
  • Grace period: 2 hours

If the token expires or gets revoked, the check fails, the heartbeat doesn't fire, and you get an alert before the next Renovate run fails.

Step 6: Configure Alert Channels

Route Renovate alerts to the right place:

Failed Renovate runs (Slack — not an emergency, but needs attention within hours):

  1. Alert Channels → Add Channel → Slack Webhook
  2. Paste your #dependencies or #devops-alerts webhook URL
  3. Assign to: renovate bot job heartbeat, renovate github token validity heartbeat

Webhook endpoint down (affects event-driven triggers — higher urgency):

  1. Alert Channels → Add Channel → Email
  2. Enter your platform team email
  3. Assign to: renovate webhook /health

If Renovate is your primary security patching mechanism, consider adding the job heartbeat to an on-call channel as well — a missed nightly run means a full day without security patch detection.

Complete Monitoring Coverage

| Component | Monitor Type | What It Detects | |---|---|---| | Renovate job | Heartbeat | Job not completing on schedule | | Renovate token | Heartbeat | GitHub/GitLab token expired or revoked | | Renovate dashboard | HTTP | Dashboard UI or health endpoint down | | Webhook receiver | HTTP | Event-driven triggers not reachable |

Conclusion

A Renovate deployment that silently stops working is worse than no Renovate at all — you lose security patch coverage while thinking you have it. Vigilmon's heartbeat monitoring is purpose-built for scheduled jobs like Renovate: if the job doesn't ping in, you'll know within an hour rather than weeks. Pair it with token validity checks and webhook monitoring, and you have complete observability over your dependency automation pipeline.

Get started at vigilmon.online — the heartbeat monitor for Renovate takes under two minutes to configure, and the first run confirmation shows up as your first successful heartbeat ping.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles