From bb4fbf80a6158d273d800feca89a3975dff6c56a Mon Sep 17 00:00:00 2001 From: kert Date: Thu, 29 Oct 2026 17:38:05 -0400 Subject: [PATCH] =?UTF-8?q?fix(renovate):=20run=20without=20a=20GitHub=20t?= =?UTF-8?q?oken=20=E2=80=94=20full=20image,=20no=20changelog=20fetch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No GitHub token exists on the host, and minting one needs a browser login. The anonymous api.github.com limit (60/h) was being spent on two things this repo doesn't need per run: downloading uv/node/python (each version looked up on GitHub, which is also why the dbt-core lock update failed) and fetching release notes. The -full image ships the tools (binarySource=global), and fetchChangeLogs=off drops the release notes. GITHUB_COM_TOKEN stays wired as optional headroom. --- .gitea/workflows/renovate.yml | 15 ++++++++++----- renovate.json | 1 + 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml index 39ddf8d..72c9645 100644 --- a/.gitea/workflows/renovate.yml +++ b/.gitea/workflows/renovate.yml @@ -12,7 +12,11 @@ jobs: runs-on: ubuntu-latest # Pinned: a floating `latest` let a Renovate major change behaviour # unreviewed. Renovate bumps this pin itself (github-actions manager). - container: ghcr.io/renovatebot/renovate:44.171.1 + # -full ships uv, node, python and the other tools Renovate runs to + # update lock files. The slim image downloads them per run, looking each + # version up on api.github.com: that spent the anonymous 60/h limit and + # failed the lock updates (artifactErrors). + container: ghcr.io/renovatebot/renovate:44.171.1-full steps: - uses: https://github.com/actions/checkout@v4 @@ -26,10 +30,11 @@ jobs: RENOVATE_ENDPOINT: http://git:3000/api/v1 RENOVATE_REPOSITORIES: homelab/stack RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} - # github.com lookups (github-tags/-releases pins, action pins, the - # uv/node tools Renovate installs to update lock files). Without it - # the anonymous 60/h API limit fails them all ("Package lookup - # failures", artifactErrors). A read-only token is enough. + RENOVATE_BINARY_SOURCE: global + # Optional. Without it, github.com lookups (github-tags/-releases + # pins) share the anonymous 60/h limit, which the -full image and + # fetchChangeLogs=off keep this repo well under. Add the secret (a + # no-scope classic PAT) for release notes and headroom. GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }} RENOVATE_GIT_AUTHOR: "Renovate Bot " LOG_LEVEL: "info" diff --git a/renovate.json b/renovate.json index b71bcba..ff4d5f2 100644 --- a/renovate.json +++ b/renovate.json @@ -7,6 +7,7 @@ "automergeStrategy": "fast-forward", "prHourlyLimit": 0, "minimumReleaseAge": "7 days", + "fetchChangeLogs": "off", "ignorePaths": [ "**/node_modules/**", "**/bower_components/**",