bb4fbf80a6
Some checks failed
CI / lint (push) Successful in 34s
CI / test (push) Successful in 3m36s
Deploy / changes (push) Successful in 18s
CI / notebooks-smoke (push) Successful in 1m29s
Deploy / notebooks (push) Has been cancelled
Deploy / report (push) Has been cancelled
Deploy / llm (push) Has been cancelled
Deploy / mc (push) Has been cancelled
Deploy / zotero (push) Has been cancelled
Deploy / docs (push) Has been cancelled
Deploy / api (push) Has been cancelled
Deploy / bcda (push) Has been cancelled
No GitHub token exists on the host, and minting one needs a browser login. The anonymous api.github.com limit (60/h) was being spent on two things this repo doesn't need per run: downloading uv/node/python (each version looked up on GitHub, which is also why the dbt-core lock update failed) and fetching release notes. The -full image ships the tools (binarySource=global), and fetchChangeLogs=off drops the release notes. GITHUB_COM_TOKEN stays wired as optional headroom.
41 lines
1.7 KiB
YAML
41 lines
1.7 KiB
YAML
name: Renovate
|
|
|
|
on:
|
|
schedule:
|
|
# Daily: with automergeType=branch, Renovate merges a branch whose CI is
|
|
# green on its *next* run, so a weekly run took two weeks per update.
|
|
- cron: "0 4 * * *"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: ubuntu-latest
|
|
# Pinned: a floating `latest` let a Renovate major change behaviour
|
|
# unreviewed. Renovate bumps this pin itself (github-actions manager).
|
|
# -full ships uv, node, python and the other tools Renovate runs to
|
|
# update lock files. The slim image downloads them per run, looking each
|
|
# version up on api.github.com: that spent the anonymous 60/h limit and
|
|
# failed the lock updates (artifactErrors).
|
|
container: ghcr.io/renovatebot/renovate:44.171.1-full
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Run Renovate
|
|
run: renovate
|
|
env:
|
|
# Self-hosted (global) settings live here; renovate.json is the
|
|
# repo config. Without RENOVATE_REPOSITORIES every run was a silent
|
|
# no-op ("No repositories found") — 28 green runs, zero PRs.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: http://git:3000/api/v1
|
|
RENOVATE_REPOSITORIES: homelab/stack
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
RENOVATE_BINARY_SOURCE: global
|
|
# Optional. Without it, github.com lookups (github-tags/-releases
|
|
# pins) share the anonymous 60/h limit, which the -full image and
|
|
# fetchChangeLogs=off keep this repo well under. Add the secret (a
|
|
# no-scope classic PAT) for release notes and headroom.
|
|
GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
|
RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
|
|
LOG_LEVEL: "info"
|