28 weekly Renovate runs were green and opened zero PRs: the log says
"No repositories found" — RENOVATE_REPOSITORIES was never set, so every
run exited before looking at the repo. Dependency drift went unwatched
for its whole life.
Workflow: self-hosted settings move to env where they belong
(RENOVATE_PLATFORM/ENDPOINT/REPOSITORIES); the image is pinned
(44.171.1) instead of `latest`, and Renovate bumps that pin itself.
renovate.json:
- fileMatch -> managerFilePatterns (Renovate 41+ migration; its own
suggested rewrite of the Dockerfile glob was not a valid regex).
- Drop the pip_requirements-on-pyproject.toml mapping; the default
pep621 manager owns pyproject.toml + uv.lock.
- minimumReleaseAge 7 days (matches the uv cooldown);
osvVulnerabilityAlerts with a `security` label; weekly
lockFileMaintenance.
- Guards on the minor/patch automerge: Python 3.13 -> 3.15 counts as a
"minor" and would have automerged; pymupdf stays <2 (licence);
tool-pin bumps in backends/gitea.py need gen_config.py re-run, so a
human merges those.
- github-actions manager limited to renovate.yml — the rest of
.gitea/workflows is generated.
Validated with renovate-config-validator --strict; a local dry run
(--platform=local --dry-run=lookup) proposes 25 updates, e.g. traefik
v3.3 -> v3.7, coredns 1.12 -> 1.14.7, tempo 2.7.2 -> 2.10.10, CUDA
12.6 -> 12.9.2. Lookups of github-releases deps want a
GITHUB_COM_TOKEN secret to avoid anonymous rate limits.
Refs #1365
bf4115195d