e3def65fd2
Some checks failed
CI / lint (push) Successful in 35s
CI / notebooks-smoke (push) Successful in 1m56s
Deploy / changes (push) Successful in 16s
CI / test (push) Successful in 3m52s
Deploy / zotero (push) Successful in 6m19s
Deploy / notebooks (push) Successful in 6m55s
Deploy / docs (push) Successful in 1m26s
Deploy / api (push) Successful in 2m36s
Deploy / bcda (push) Successful in 2m34s
Deploy / mc (push) Has been skipped
Deploy / llm (push) Successful in 1m41s
Deploy / report (push) Successful in 16s
Zotero Sync / zotero-sync (push) Successful in 2m24s
Package Supply Chain / pkg-supply-chain (push) Successful in 1m18s
Comment Pull / comment-pull (push) Successful in 1m7s
Harden / build-scan-report (push) Successful in 37m33s
Notebooks Integration / notebooks-integration (push) Failing after 9m43s
LLM Golden / llm-golden (push) Successful in 7m39s
Renovate / renovate (push) Successful in 2m5s
fe94999 put githubTokenWarn in renovate.json. Renovate rejects
global-only options in a repository config ("Configuration Error"),
and run 1606 then extracted dependencies but opened no branches. It now
comes from RENOVATE_GITHUB_TOKEN_WARN in the workflow, and renovate.json
validates in repo mode (renovate-config-validator --strict from the repo
directory). I had validated with the file path as an argument, which
checks it as global config, where the option is legal.
44 lines
1.9 KiB
YAML
44 lines
1.9 KiB
YAML
name: Renovate
|
|
|
|
on:
|
|
schedule:
|
|
# Daily: with automergeType=branch, Renovate merges a branch whose CI is
|
|
# green on its *next* run, so a weekly run took two weeks per update.
|
|
- cron: "0 4 * * *"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: ubuntu-latest
|
|
# Pinned: a floating `latest` let a Renovate major change behaviour
|
|
# unreviewed. Renovate bumps this pin itself (github-actions manager).
|
|
# -full ships uv, node, python and the other tools Renovate runs to
|
|
# update lock files. The slim image downloads them per run, looking each
|
|
# version up on api.github.com: that spent the anonymous 60/h limit and
|
|
# failed the lock updates (artifactErrors).
|
|
container: ghcr.io/renovatebot/renovate:44.171.1-full
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Run Renovate
|
|
run: renovate
|
|
env:
|
|
# Self-hosted (global) settings live here; renovate.json is the
|
|
# repo config. Without RENOVATE_REPOSITORIES every run was a silent
|
|
# no-op ("No repositories found") — 28 green runs, zero PRs.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: http://git:3000/api/v1
|
|
RENOVATE_REPOSITORIES: homelab/stack
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
RENOVATE_BINARY_SOURCE: global
|
|
# Global-only option (a repo renovate.json may not set it). The only
|
|
# github.com deps left are ones packageRules disable on purpose.
|
|
RENOVATE_GITHUB_TOKEN_WARN: "false"
|
|
# Optional. Without it, github.com lookups (github-tags/-releases
|
|
# pins) share the anonymous 60/h limit, which the -full image and
|
|
# fetchChangeLogs=off keep this repo well under. Add the secret (a
|
|
# no-scope classic PAT) for release notes and headroom.
|
|
GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
|
RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
|
|
LOG_LEVEL: "info"
|