fix(renovate): actually run against the repo; release cooldown, OSV alerts

28 weekly Renovate runs were green and opened zero PRs: the log says
"No repositories found" — RENOVATE_REPOSITORIES was never set, so every
run exited before looking at the repo. Dependency drift went unwatched
for its whole life.

Workflow: self-hosted settings move to env where they belong
(RENOVATE_PLATFORM/ENDPOINT/REPOSITORIES); the image is pinned
(44.171.1) instead of `latest`, and Renovate bumps that pin itself.

renovate.json:
- fileMatch -> managerFilePatterns (Renovate 41+ migration; its own
  suggested rewrite of the Dockerfile glob was not a valid regex).
- Drop the pip_requirements-on-pyproject.toml mapping; the default
  pep621 manager owns pyproject.toml + uv.lock.
- minimumReleaseAge 7 days (matches the uv cooldown);
  osvVulnerabilityAlerts with a `security` label; weekly
  lockFileMaintenance.
- Guards on the minor/patch automerge: Python 3.13 -> 3.15 counts as a
  "minor" and would have automerged; pymupdf stays <2 (licence);
  tool-pin bumps in backends/gitea.py need gen_config.py re-run, so a
  human merges those.
- github-actions manager limited to renovate.yml — the rest of
  .gitea/workflows is generated.

Validated with renovate-config-validator --strict; a local dry run
(--platform=local --dry-run=lookup) proposes 25 updates, e.g. traefik
v3.3 -> v3.7, coredns 1.12 -> 1.14.7, tempo 2.7.2 -> 2.10.10, CUDA
12.6 -> 12.9.2. Lookups of github-releases deps want a
GITHUB_COM_TOKEN secret to avoid anonymous rate limits.

Refs #1365

.gitea/workflows/renovate.yml

@@ -8,14 +8,21 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:latest
+    # Pinned: a floating `latest` let a Renovate major change behaviour
+    # unreviewed. Renovate bumps this pin itself (github-actions manager).
+    container: ghcr.io/renovatebot/renovate:44.171.1
     steps:
       - uses: https://github.com/actions/checkout@v4
 
       - name: Run Renovate
         run: renovate
         env:
-          RENOVATE_CONFIG_FILE: renovate.json
+          # Self-hosted (global) settings live here; renovate.json is the
+          # repo config. Without RENOVATE_REPOSITORIES every run was a silent
+          # no-op ("No repositories found") — 28 green runs, zero PRs.
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: http://git:3000/api/v1
+          RENOVATE_REPOSITORIES: homelab/stack
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
           LOG_LEVEL: "info"

renovate.json

@@ -1,34 +1,63 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "platform": "gitea",
-  "endpoint": "http://git:3000/api/v1",
-  "gitAuthor": "Renovate Bot <renovate@fhirworx.io>",
-  "automerge": false,
   "labels": ["dependencies"],
+  "automerge": false,
+  "minimumReleaseAge": "7 days",
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "labels": ["dependencies", "security"]
+  },
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 6am on monday"]
+  },
   "packageRules": [
     {
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
       "automerge": true
+    },
+    {
+      "description": "A Python minor (3.13 -> 3.15) is a runtime migration, not a patch: never automerge it.",
+      "matchDepNames": ["python"],
+      "automerge": false
+    },
+    {
+      "description": "pymupdf 2.x bundles the Polyform-Noncommercial layout code and onnxruntime — a licence decision (see pyproject.toml), not a routine bump.",
+      "matchPackageNames": ["pymupdf"],
+      "allowedVersions": "<2"
+    },
+    {
+      "description": "Generated-workflow tool pins: gen_config.py must re-emit .gitea/workflows after the bump, so a human merges these.",
+      "matchFileNames": ["dev/scripts/backends/gitea.py"],
+      "automerge": false,
+      "prBodyNotes": ["Run `uv run python dev/scripts/gen_config.py` on this branch and commit the regenerated workflows before merging."]
     }
   ],
-  "pip_requirements": {
-    "fileMatch": ["pyproject.toml"]
-  },
-  "docker-compose": {
-    "fileMatch": ["compose.yml"]
-  },
   "dockerfile": {
-    "fileMatch": ["infra/images/*.Dockerfile"]
+    "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"]
+  },
+  "github-actions": {
+    "description": "Only the hand-written Renovate workflow; the rest of .gitea/workflows is generated by gen_config.py.",
+    "managerFilePatterns": ["/^\\.gitea/workflows/renovate\\.yml$/"]
   },
   "customManagers": [
     {
       "customType": "regex",
       "description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (marimo, yq, otel-cli, …) that the dockerfile manager can't see.",
-      "fileMatch": ["(^|/)[^/]+\\.Dockerfile$"],
+      "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"],
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: extractVersion=(?<extractVersion>\\S+))?\\s+ARG \\w+?_VERSION=(?<currentValue>\\S+)"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Bump the trivy/crane pins the CI workflow generator installs.",
+      "managerFilePatterns": ["/^dev/scripts/backends/gitea\\.py$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+\\w+_VERSION = \"(?<currentValue>[^\"]+)\""
+      ],
+      "extractVersionTemplate": "^v?(?<version>.*)$"
     }
   ]
 }