A measurement overtook this part of the change. A shared `jlab-renovate-bot`
instance already runs on the Gitea side and already has this repository
enrolled - its first run there opened PRs for searxng and gotenberg plus the
dependency dashboard. A second runner in this repo would produce duplicate
PRs and two schedulers rewriting each other's branches, so
.github/workflows/renovate.yml is removed again.
Two things fall out of that run, and both were open risks:
- The instance reads our renovate.json5. searxng and gotenberg are
customManagers targets of ours - no built-in manager finds an appVersion
in a Chart.yaml - so the config is demonstrably in effect.
- allowedCommands is already granted there. The searxng PR's diff carries
`version: 1.0.4+up2026.9.11.ffe96f8a6 -> 1.0.5+up2026.9.13.96479fff6`
next to the appVersion, and nothing but ci/renovate-bump-chart.sh writes
`version:`. Had that allow-list been missing, postUpgradeTasks would have
been skipped SILENTLY and every chart PR on Gitea would have been red on
the version check with nothing naming the cause.
With the workflow gone there is no container image to pin either; verified
by dry run that the ghcr.io/renovatebot/renovate dependency is no longer
extracted, while TRIVY_VERSION still is - that one belongs to the Trivy
replacement and stays.
README and CLAUDE.md now say Renovate runs on Gitea as an existing shared
instance and that no workflow belongs here, so the next reader who finds
none knows why instead of building one.
jklein
c3889a66b6