fix(renovate): run without a GitHub token — full image, no changelog fetch

No GitHub token exists on the host, and minting one needs a browser
login. The anonymous api.github.com limit (60/h) was being spent on two
things this repo doesn't need per run: downloading uv/node/python
(each version looked up on GitHub, which is also why the dbt-core lock
update failed) and fetching release notes. The -full image ships the
tools (binarySource=global), and fetchChangeLogs=off drops the release
notes. GITHUB_COM_TOKEN stays wired as optional headroom.

.gitea/workflows/renovate.yml

@@ -12,7 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     # Pinned: a floating `latest` let a Renovate major change behaviour
     # unreviewed. Renovate bumps this pin itself (github-actions manager).
-    container: ghcr.io/renovatebot/renovate:44.171.1
+    # -full ships uv, node, python and the other tools Renovate runs to
+    # update lock files. The slim image downloads them per run, looking each
+    # version up on api.github.com: that spent the anonymous 60/h limit and
+    # failed the lock updates (artifactErrors).
+    container: ghcr.io/renovatebot/renovate:44.171.1-full
     steps:
       - uses: https://github.com/actions/checkout@v4
 
@@ -26,10 +30,11 @@ jobs:
           RENOVATE_ENDPOINT: http://git:3000/api/v1
           RENOVATE_REPOSITORIES: homelab/stack
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          # github.com lookups (github-tags/-releases pins, action pins, the
-          # uv/node tools Renovate installs to update lock files). Without it
-          # the anonymous 60/h API limit fails them all ("Package lookup
-          # failures", artifactErrors). A read-only token is enough.
+          RENOVATE_BINARY_SOURCE: global
+          # Optional. Without it, github.com lookups (github-tags/-releases
+          # pins) share the anonymous 60/h limit, which the -full image and
+          # fetchChangeLogs=off keep this repo well under. Add the secret (a
+          # no-scope classic PAT) for release notes and headroom.
           GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
           RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
           LOG_LEVEL: "info"

renovate.json

@@ -7,6 +7,7 @@
   "automergeStrategy": "fast-forward",
   "prHourlyLimit": 0,
   "minimumReleaseAge": "7 days",
+  "fetchChangeLogs": "off",
   "ignorePaths": [
     "**/node_modules/**",
     "**/bower_components/**",