Drop the Renovate workflow: the Gitea side already has a shared instance
A measurement overtook this part of the change. A shared `jlab-renovate-bot` instance already runs on the Gitea side and already has this repository enrolled - its first run there opened PRs for searxng and gotenberg plus the dependency dashboard. A second runner in this repo would produce duplicate PRs and two schedulers rewriting each other's branches, so .github/workflows/renovate.yml is removed again. Two things fall out of that run, and both were open risks: - The instance reads our renovate.json5. searxng and gotenberg are customManagers targets of ours - no built-in manager finds an appVersion in a Chart.yaml - so the config is demonstrably in effect. - allowedCommands is already granted there. The searxng PR's diff carries `version: 1.0.4+up2026.9.11.ffe96f8a6 -> 1.0.5+up2026.9.13.96479fff6` next to the appVersion, and nothing but ci/renovate-bump-chart.sh writes `version:`. Had that allow-list been missing, postUpgradeTasks would have been skipped SILENTLY and every chart PR on Gitea would have been red on the version check with nothing naming the cause. With the workflow gone there is no container image to pin either; verified by dry run that the ghcr.io/renovatebot/renovate dependency is no longer extracted, while TRIVY_VERSION still is - that one belongs to the Trivy replacement and stays. README and CLAUDE.md now say Renovate runs on Gitea as an existing shared instance and that no workflow belongs here, so the next reader who finds none knows why instead of building one.
This commit is contained in:
4 files changed
+17
-117
No files matched your search
@@ -1,108 +0,0 @@
|
||||
# Renovate, self-hosted (issue #225).
|
||||
#
|
||||
# On github.com Renovate arrived as the `jlab-renovate` GitHub App and this
|
||||
# repo only ever carried renovate.json5. Gitea has no app model and no hosted
|
||||
# Renovate, so after the move the bot has to be *run* by this repo: a scheduled
|
||||
# job with its own token. That is the only change to how dependencies are
|
||||
# updated - renovate.json5 stays the single source of what gets updated, and
|
||||
# everything in it works unchanged on the Gitea platform.
|
||||
#
|
||||
# What the maintainer has to create once on the instance (the token this
|
||||
# workflow cannot create for itself):
|
||||
#
|
||||
# RENOVATE_TOKEN Gitea access token of the bot account, scopes
|
||||
# read:user, write:issue, write:repository. Renovate opens
|
||||
# the PRs and the dependency dashboard issue with it, so
|
||||
# the PRs will be authored by whoever owns the token.
|
||||
# GITHUB_COM_TOKEN Read-only github.com PAT (public_repo / no scopes at all
|
||||
# is enough). NOT optional here: every `github-releases` and
|
||||
# `github-tags` lookup in renovate.json5 - and the whole
|
||||
# built-in github-actions manager, which resolves
|
||||
# actions/checkout and friends on github.com - hits
|
||||
# github.com's unauthenticated rate limit within one run
|
||||
# otherwise. On the App this came for free; here it does not.
|
||||
# README already names this for the `no-result` symptom.
|
||||
#
|
||||
# There is deliberately no `allowedCommands` to set up by hand any more: the
|
||||
# postUpgradeTasks hook renovate.json5 needs (ci/renovate-bump-chart.sh, which
|
||||
# recomputes `version:` after an appVersion change) is allow-listed by the
|
||||
# RENOVATE_ALLOWED_COMMANDS env below, because this workflow *is* the instance
|
||||
# config now. Without it Renovate skips the task silently and every chart PR
|
||||
# stays red on the version-bump check - see README, "The version-bump hook".
|
||||
name: Renovate
|
||||
|
||||
on:
|
||||
schedule:
|
||||
# 03:40 UTC, once a day. Renovate's own `timezone` in renovate.json5
|
||||
# (Europe/Berlin) governs the PR schedules; this cron is plain UTC.
|
||||
- cron: "40 3 * * *"
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
dryRun:
|
||||
description: "Dry run: 'full' looks up and renders everything but writes nothing"
|
||||
type: choice
|
||||
default: "full"
|
||||
options: ["full", "lookup", "extract", "disabled"]
|
||||
logLevel:
|
||||
description: "Renovate log level"
|
||||
type: choice
|
||||
default: "info"
|
||||
options: ["info", "debug"]
|
||||
|
||||
jobs:
|
||||
renovate:
|
||||
name: Renovate
|
||||
# The guard that keeps this workflow inert on github.com. The file reaches
|
||||
# GitHub as well (that is where the migration PR is merged), and a
|
||||
# scheduled run there would authenticate a *Gitea* token against a Gitea
|
||||
# endpoint from a runner that has neither - failing nightly for a reason
|
||||
# nobody is watching for. GITHUB_SERVER_URL is the one context value that
|
||||
# differs between the two platforms without naming our instance: Gitea
|
||||
# sets it to its own base URL. Delete this line once github.com is a
|
||||
# push mirror without Actions.
|
||||
if: github.server_url != 'https://github.com'
|
||||
# No Docker socket needed: the Gitea runner starts every job in a container
|
||||
# itself, and `container:` is the runner's job to create, not the job's.
|
||||
# Measured on the probe PR of #225 - the same distinction that puts
|
||||
# install-test on ubuntu-docker leaves this job on ubuntu-latest.
|
||||
runs-on: ubuntu-latest
|
||||
# The official image rather than `npx renovate`: it ships the git, node and
|
||||
# package-manager versions Renovate expects, and pulling ~200 MB from npm
|
||||
# on every scheduled run is the alternative. Renovate's built-in
|
||||
# github-actions manager keeps this tag current (proved by dry run, see the
|
||||
# migration PR) - it reads `container:` images, not only `uses:`.
|
||||
container: ghcr.io/renovatebot/renovate:44.87.1
|
||||
steps:
|
||||
- name: "Checkout Repository"
|
||||
uses: actions/checkout@v7
|
||||
|
||||
- name: "Run Renovate"
|
||||
env:
|
||||
# Platform. The endpoint is derived from the run itself so the
|
||||
# instance address stays out of this repository, the same rule the
|
||||
# publish workflow follows for the registry URL.
|
||||
RENOVATE_PLATFORM: gitea
|
||||
RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
|
||||
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
||||
GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
||||
|
||||
# Exactly this repository. Autodiscovery would enrol every repo the
|
||||
# token can see, and the token is an account token, not an app
|
||||
# installation scoped to one repo.
|
||||
RENOVATE_AUTODISCOVER: "false"
|
||||
RENOVATE_REPOSITORIES: ${{ github.repository }}
|
||||
|
||||
# Who the commits are by. The e-mail must not be a real address of a
|
||||
# person - Gitea attributes a commit to the account whose verified
|
||||
# address matches, and these commits are the bot's.
|
||||
RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.invalid>"
|
||||
|
||||
# The instance-level half of renovate.json5's postUpgradeTasks. A
|
||||
# command not listed here is skipped WITHOUT an error message.
|
||||
RENOVATE_ALLOWED_COMMANDS: '["^ci/renovate-bump-chart\\.sh"]'
|
||||
|
||||
# Manual runs default to a dry run; the schedule is the only thing
|
||||
# that writes on its own.
|
||||
RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dryRun || 'null' }}
|
||||
LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.logLevel || 'info' }}
|
||||
run: renovate
|
||||
Reference in new issue
Block a user