bf4115195d
28 weekly Renovate runs were green and opened zero PRs: the log says "No repositories found" — RENOVATE_REPOSITORIES was never set, so every run exited before looking at the repo. Dependency drift went unwatched for its whole life. Workflow: self-hosted settings move to env where they belong (RENOVATE_PLATFORM/ENDPOINT/REPOSITORIES); the image is pinned (44.171.1) instead of `latest`, and Renovate bumps that pin itself. renovate.json: - fileMatch -> managerFilePatterns (Renovate 41+ migration; its own suggested rewrite of the Dockerfile glob was not a valid regex). - Drop the pip_requirements-on-pyproject.toml mapping; the default pep621 manager owns pyproject.toml + uv.lock. - minimumReleaseAge 7 days (matches the uv cooldown); osvVulnerabilityAlerts with a `security` label; weekly lockFileMaintenance. - Guards on the minor/patch automerge: Python 3.13 -> 3.15 counts as a "minor" and would have automerged; pymupdf stays <2 (licence); tool-pin bumps in backends/gitea.py need gen_config.py re-run, so a human merges those. - github-actions manager limited to renovate.yml — the rest of .gitea/workflows is generated. Validated with renovate-config-validator --strict; a local dry run (--platform=local --dry-run=lookup) proposes 25 updates, e.g. traefik v3.3 -> v3.7, coredns 1.12 -> 1.14.7, tempo 2.7.2 -> 2.10.10, CUDA 12.6 -> 12.9.2. Lookups of github-releases deps want a GITHUB_COM_TOKEN secret to avoid anonymous rate limits. Refs #1365
29 lines
983 B
YAML
29 lines
983 B
YAML
name: Renovate
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 4 * * 1" # Weekly Monday 4am
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: ubuntu-latest
|
|
# Pinned: a floating `latest` let a Renovate major change behaviour
|
|
# unreviewed. Renovate bumps this pin itself (github-actions manager).
|
|
container: ghcr.io/renovatebot/renovate:44.171.1
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Run Renovate
|
|
run: renovate
|
|
env:
|
|
# Self-hosted (global) settings live here; renovate.json is the
|
|
# repo config. Without RENOVATE_REPOSITORIES every run was a silent
|
|
# no-op ("No repositories found") — 28 green runs, zero PRs.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: http://git:3000/api/v1
|
|
RENOVATE_REPOSITORIES: homelab/stack
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
|
|
LOG_LEVEL: "info"
|