From bf4115195daab0a2cb85a6a7b5f42f35b0e982da Mon Sep 17 00:00:00 2001 From: kert Date: Tue, 27 Oct 2026 11:05:23 -0400 Subject: [PATCH] fix(renovate): actually run against the repo; release cooldown, OSV alerts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 28 weekly Renovate runs were green and opened zero PRs: the log says "No repositories found" — RENOVATE_REPOSITORIES was never set, so every run exited before looking at the repo. Dependency drift went unwatched for its whole life. Workflow: self-hosted settings move to env where they belong (RENOVATE_PLATFORM/ENDPOINT/REPOSITORIES); the image is pinned (44.171.1) instead of `latest`, and Renovate bumps that pin itself. renovate.json: - fileMatch -> managerFilePatterns (Renovate 41+ migration; its own suggested rewrite of the Dockerfile glob was not a valid regex). - Drop the pip_requirements-on-pyproject.toml mapping; the default pep621 manager owns pyproject.toml + uv.lock. - minimumReleaseAge 7 days (matches the uv cooldown); osvVulnerabilityAlerts with a `security` label; weekly lockFileMaintenance. - Guards on the minor/patch automerge: Python 3.13 -> 3.15 counts as a "minor" and would have automerged; pymupdf stays <2 (licence); tool-pin bumps in backends/gitea.py need gen_config.py re-run, so a human merges those. - github-actions manager limited to renovate.yml — the rest of .gitea/workflows is generated. Validated with renovate-config-validator --strict; a local dry run (--platform=local --dry-run=lookup) proposes 25 updates, e.g. traefik v3.3 -> v3.7, coredns 1.12 -> 1.14.7, tempo 2.7.2 -> 2.10.10, CUDA 12.6 -> 12.9.2. Lookups of github-releases deps want a GITHUB_COM_TOKEN secret to avoid anonymous rate limits. Refs #1365 --- .gitea/workflows/renovate.yml | 11 +++++-- renovate.json | 55 ++++++++++++++++++++++++++--------- 2 files changed, 51 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml index 7bd8d7a..2889d7a 100644 --- a/.gitea/workflows/renovate.yml +++ b/.gitea/workflows/renovate.yml @@ -8,14 +8,21 @@ on: jobs: renovate: runs-on: ubuntu-latest - container: ghcr.io/renovatebot/renovate:latest + # Pinned: a floating `latest` let a Renovate major change behaviour + # unreviewed. Renovate bumps this pin itself (github-actions manager). + container: ghcr.io/renovatebot/renovate:44.171.1 steps: - uses: https://github.com/actions/checkout@v4 - name: Run Renovate run: renovate env: - RENOVATE_CONFIG_FILE: renovate.json + # Self-hosted (global) settings live here; renovate.json is the + # repo config. Without RENOVATE_REPOSITORIES every run was a silent + # no-op ("No repositories found") — 28 green runs, zero PRs. + RENOVATE_PLATFORM: gitea + RENOVATE_ENDPOINT: http://git:3000/api/v1 + RENOVATE_REPOSITORIES: homelab/stack RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} RENOVATE_GIT_AUTHOR: "Renovate Bot " LOG_LEVEL: "info" diff --git a/renovate.json b/renovate.json index 0fb6591..b1983f2 100644 --- a/renovate.json +++ b/renovate.json @@ -1,34 +1,63 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:recommended"], - "platform": "gitea", - "endpoint": "http://git:3000/api/v1", - "gitAuthor": "Renovate Bot ", - "automerge": false, "labels": ["dependencies"], + "automerge": false, + "minimumReleaseAge": "7 days", + "osvVulnerabilityAlerts": true, + "vulnerabilityAlerts": { + "labels": ["dependencies", "security"] + }, + "lockFileMaintenance": { + "enabled": true, + "schedule": ["before 6am on monday"] + }, "packageRules": [ { - "matchUpdateTypes": ["minor", "patch"], + "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"], "automerge": true + }, + { + "description": "A Python minor (3.13 -> 3.15) is a runtime migration, not a patch: never automerge it.", + "matchDepNames": ["python"], + "automerge": false + }, + { + "description": "pymupdf 2.x bundles the Polyform-Noncommercial layout code and onnxruntime — a licence decision (see pyproject.toml), not a routine bump.", + "matchPackageNames": ["pymupdf"], + "allowedVersions": "<2" + }, + { + "description": "Generated-workflow tool pins: gen_config.py must re-emit .gitea/workflows after the bump, so a human merges these.", + "matchFileNames": ["dev/scripts/backends/gitea.py"], + "automerge": false, + "prBodyNotes": ["Run `uv run python dev/scripts/gen_config.py` on this branch and commit the regenerated workflows before merging."] } ], - "pip_requirements": { - "fileMatch": ["pyproject.toml"] - }, - "docker-compose": { - "fileMatch": ["compose.yml"] - }, "dockerfile": { - "fileMatch": ["infra/images/*.Dockerfile"] + "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"] + }, + "github-actions": { + "description": "Only the hand-written Renovate workflow; the rest of .gitea/workflows is generated by gen_config.py.", + "managerFilePatterns": ["/^\\.gitea/workflows/renovate\\.yml$/"] }, "customManagers": [ { "customType": "regex", "description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (marimo, yq, otel-cli, …) that the dockerfile manager can't see.", - "fileMatch": ["(^|/)[^/]+\\.Dockerfile$"], + "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"], "matchStrings": [ "# renovate: datasource=(?\\S+) depName=(?\\S+)(?: extractVersion=(?\\S+))?\\s+ARG \\w+?_VERSION=(?\\S+)" ] + }, + { + "customType": "regex", + "description": "Bump the trivy/crane pins the CI workflow generator installs.", + "managerFilePatterns": ["/^dev/scripts/backends/gitea\\.py$/"], + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)\\s+\\w+_VERSION = \"(?[^\"]+)\"" + ], + "extractVersionTemplate": "^v?(?.*)$" } ] }