probe round 3: keep the failed k3s node and dump its log

.github/workflows/renovate.yml

@@ -0,0 +1,108 @@
+# Renovate, self-hosted (issue #225).
+#
+# On github.com Renovate arrived as the `jlab-renovate` GitHub App and this
+# repo only ever carried renovate.json5. Gitea has no app model and no hosted
+# Renovate, so after the move the bot has to be *run* by this repo: a scheduled
+# job with its own token. That is the only change to how dependencies are
+# updated - renovate.json5 stays the single source of what gets updated, and
+# everything in it works unchanged on the Gitea platform.
+#
+# What the maintainer has to create once on the instance (the token this
+# workflow cannot create for itself):
+#
+#   RENOVATE_TOKEN   Gitea access token of the bot account, scopes
+#                    read:user, write:issue, write:repository. Renovate opens
+#                    the PRs and the dependency dashboard issue with it, so
+#                    the PRs will be authored by whoever owns the token.
+#   GITHUB_COM_TOKEN Read-only github.com PAT (public_repo / no scopes at all
+#                    is enough). NOT optional here: every `github-releases` and
+#                    `github-tags` lookup in renovate.json5 - and the whole
+#                    built-in github-actions manager, which resolves
+#                    actions/checkout and friends on github.com - hits
+#                    github.com's unauthenticated rate limit within one run
+#                    otherwise. On the App this came for free; here it does not.
+#                    README already names this for the `no-result` symptom.
+#
+# There is deliberately no `allowedCommands` to set up by hand any more: the
+# postUpgradeTasks hook renovate.json5 needs (ci/renovate-bump-chart.sh, which
+# recomputes `version:` after an appVersion change) is allow-listed by the
+# RENOVATE_ALLOWED_COMMANDS env below, because this workflow *is* the instance
+# config now. Without it Renovate skips the task silently and every chart PR
+# stays red on the version-bump check - see README, "The version-bump hook".
+name: Renovate
+
+on:
+  schedule:
+    # 03:40 UTC, once a day. Renovate's own `timezone` in renovate.json5
+    # (Europe/Berlin) governs the PR schedules; this cron is plain UTC.
+    - cron: "40 3 * * *"
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: "Dry run: 'full' looks up and renders everything but writes nothing"
+        type: choice
+        default: "full"
+        options: ["full", "lookup", "extract", "disabled"]
+      logLevel:
+        description: "Renovate log level"
+        type: choice
+        default: "info"
+        options: ["info", "debug"]
+
+jobs:
+  renovate:
+    name: Renovate
+    # The guard that keeps this workflow inert on github.com. The file reaches
+    # GitHub as well (that is where the migration PR is merged), and a
+    # scheduled run there would authenticate a *Gitea* token against a Gitea
+    # endpoint from a runner that has neither - failing nightly for a reason
+    # nobody is watching for. GITHUB_SERVER_URL is the one context value that
+    # differs between the two platforms without naming our instance: Gitea
+    # sets it to its own base URL. Delete this line once github.com is a
+    # push mirror without Actions.
+    if: github.server_url != 'https://github.com'
+    # No Docker socket needed: the Gitea runner starts every job in a container
+    # itself, and `container:` is the runner's job to create, not the job's.
+    # Measured on the probe PR of #225 - the same distinction that puts
+    # install-test on ubuntu-docker leaves this job on ubuntu-latest.
+    runs-on: ubuntu-latest
+    # The official image rather than `npx renovate`: it ships the git, node and
+    # package-manager versions Renovate expects, and pulling ~200 MB from npm
+    # on every scheduled run is the alternative. Renovate's built-in
+    # github-actions manager keeps this tag current (proved by dry run, see the
+    # migration PR) - it reads `container:` images, not only `uses:`.
+    container: ghcr.io/renovatebot/renovate:44.87.1
+    steps:
+      - name: "Checkout Repository"
+        uses: actions/checkout@v7
+
+      - name: "Run Renovate"
+        env:
+          # Platform. The endpoint is derived from the run itself so the
+          # instance address stays out of this repository, the same rule the
+          # publish workflow follows for the registry URL.
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
+
+          # Exactly this repository. Autodiscovery would enrol every repo the
+          # token can see, and the token is an account token, not an app
+          # installation scoped to one repo.
+          RENOVATE_AUTODISCOVER: "false"
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+
+          # Who the commits are by. The e-mail must not be a real address of a
+          # person - Gitea attributes a commit to the account whose verified
+          # address matches, and these commits are the bot's.
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.invalid>"
+
+          # The instance-level half of renovate.json5's postUpgradeTasks. A
+          # command not listed here is skipped WITHOUT an error message.
+          RENOVATE_ALLOWED_COMMANDS: '["^ci/renovate-bump-chart\\.sh"]'
+
+          # Manual runs default to a dry run; the schedule is the only thing
+          # that writes on its own.
+          RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dryRun || 'null' }}
+          LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.logLevel || 'info' }}
+        run: renovate

.github/workflows/validate-charts.yml

@@ -335,7 +335,18 @@ jobs:
       - name: "Install k3d"
         run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash
       - name: "Create k3d cluster"
-        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s
+        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s --no-rollback
+      - name: "PROBE why did k3s not come up (remove before merge)"
+        if: failure()
+        run: |
+          docker ps -a
+          echo "=== docker logs k3d-install-test-server-0 ==="
+          docker logs k3d-install-test-server-0 2>&1 | tail -100 || true
+          echo "=== docker info ==="
+          docker info || true
+          echo "=== host cgroup ==="
+          cat /proc/self/cgroup || true
+          ls /sys/fs/cgroup | head -30 || true
       # Every chart reaching this step is one the exclusion filter let through,
       # so the script's SKIP branch is never taken here - it exists for local
       # runs. The variables below are empty for every chart but the one that