Move the canonical forge to Codeberg, and add Renovate + Weblate (#2)

Makes Codeberg canonical for git, issues, PRs, tags and releases. The self-hosted Gitea instance stays build infrastructure: signing key, F-Droid publishing, release pipeline. Ports the setup Calendula already runs on, adapted where Agendula genuinely differs.

**This PR is its own test.** It is the first PR opened on Codeberg, so a green `CI` check proves the new runner works *and* that the submodule resolves from its new home.

### 1 · Workflows split by directory

Forgejo's lookup is first-match-wins across `.forgejo/` → `.gitea/` → `.github/`, and Gitea cannot see `.forgejo/` at all. So each forge sees exactly one set, with no duplicated files and no expression to keep in sync:

| Directory | Runs on | Contains | Secrets |
| --- | --- | --- | --- |
| `.forgejo/workflows/` | Codeberg | `ci.yaml`, `translations.yaml` | **none** |
| `.gitea/workflows/` | Gitea | `release.yaml`, `renovate.yml` | all of them |

The line is drawn at **secrets, not CI-vs-release** — that is what makes fork PRs safe. Renovate deliberately does *not* move despite opening PRs here; it keeps running where its token already lives and merely talks to Codeberg's API.

CI also gains three fixes: an explicit `SKIP_RE` skip-list that names the build-relevant files in the log, base-ref normalisation, and a fully-qualified `android-actions/setup-android` — Codeberg resolves bare `uses:` refs against `data.forgejo.org`, which does not carry that action.

### 2 · Three release-pipeline safety changes

- `detect` and the Renovate job get an explicit `repository_owner` guard. The directory split only holds while `.forgejo/` is non-empty; empty it and Codeberg would fall back to `.gitea/` and start running these on the contributor-facing runner, without secrets.
- `detect` now reads tags from **Codeberg**, not from the Gitea instance it runs on. Push mirroring is `git push --mirror`, so a tag minted on Gitea is deleted by the next sync until the Codeberg tag push propagates back — asking Gitea inside that window reports "no tag" for an already-shipped release and would cut it twice. It also now fails on any status other than 200/404 rather than reading a transient error as "no tag": a failed job is recoverable, a duplicate release is not.
- **The Codeberg publish step pushes the tag itself** instead of waiting for it to arrive by mirror. That wait was correct while Gitea mirrored *to* Codeberg; under Codeberg-canonical the mirror runs the other way and it would never resolve. Attaching the release to an already-pushed ref (no `target_commitish`) is what avoids the empty-bodied 500s, and the create call retries with backoff because Codeberg 500s on a tag it has only just received. The step stays **fail-loud**, not `continue-on-error` — it reported green through 0.2.1–0.3.2 while never once publishing, and that must not be possible again.

### 3 · Renovate

`renovate.json5` plus a Gitea-side job targeting Codeberg's API. `managerFilePatterns` covers **both** workflow directories, so the pinned Renovate image tag and the action versions in either file keep getting bumped.

Needs two new Gitea secrets: `RENOVATE_TOKEN` (Codeberg bot, repo read/write + PR scope) and `GITHUB_COM_TOKEN` (read-only github.com PAT, for changelog lookups).

### 4 · Weblate

A parity check (`scripts/check_translations.py`) runs on every PR without a path filter, so the required `Translations` status is always reported. Partial translations are expected, so `MissingTranslation` and `MissingQuantity` become informational — `ExtraTranslation` stays fatal. Agendula had no `lint` block at all, so the first locale to land would otherwise have failed the build.

**Settings → App language** now opens a picker carrying a "Help translate" header. That is why it drops floret-kit's `LanguagePickerRow` for a local row: the shared recipe has no `header` slot, and the framing is app-specific rather than a family primitive.

### 5 · Links repointed

In-app Source / License / report-issue URLs, F-Droid metadata, README (now with a Codeberg CI badge), and the docs.

`floret-kit` follows suit — `.gitmodules` points at `codeberg.org/jlmakiola/floret-kit`, so a clone no longer needs to reach the personal Gitea instance to resolve it. The Gitea copy is **kept**: every existing tag records the old submodule URL, so rebuilds of past releases still resolve.

### 6 · Housekeeping

Drops `release-notes.md` — a release-pipeline scratch file that got committed — and gitignores the five others the release job writes into the workspace.

### Not in this PR

The Codeberg → Gitea push mirror, the Weblate component, and the Codeberg bot account (all browser-side). Until the mirror is flipped, merging this does **not** reach the Gitea runner.

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/2

.gitea/ISSUE_TEMPLATE/bug_report.md

@@ -1,23 +0,0 @@
----
-name: Bug report
-about: Something doesn't work the way it should
-title: ""
-labels:
-  - bug
----
-
-### What happened
-
-
-### What you expected
-
-
-### Steps to reproduce
-1.
-2.
-3.
-
-### Environment
-- Agendula version: <!-- Settings → bottom of the screen -->
-- Android version:
-- Device:

.gitea/ISSUE_TEMPLATE/crash_report.md

@@ -1,27 +0,0 @@
----
-name: Crash report
-about: Report a crash. Agendula can capture this for you (Settings → Report a problem, or the prompt after a crash) — it copies the report to your clipboard and prefills this form.
-title: "Crash: "
-labels:
-  - bug
-  - crash
-  - priority:high
----
-
-<!--
-Thanks for reporting a crash in Agendula!
-
-If the app prefilled this for you, the crash report is already below — just add
-what you were doing and submit. Otherwise, paste the report from your clipboard
-into the code block. The report contains only app/Android/device versions and the
-stack trace — no personal data or calendar content.
--->
-
-### What happened
-
-
-### Crash report
-
-```
-(paste the crash report here)
-```

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -1,16 +0,0 @@
----
-name: Feature request
-about: Suggest an idea or improvement
-title: ""
-labels:
-  - feat
----
-
-### What would you like Agendula to do?
-
-
-### Why — what problem does it solve?
-
-
-### Anything else
-<!-- mockups, examples from other apps, alternatives you considered -->

.gitea/ISSUE_TEMPLATE/question.md

@@ -1,19 +0,0 @@
----
-name: Question
-about: Ask how something works or get help using Agendula
-title: ""
-labels:
-  - question
----
-
-### Your question
-
-
-### What you've tried
-<!-- so far, if anything -->
-
-
-### Context
-- Agendula version: <!-- Settings → bottom of the screen -->
-- Android version:
-- Device:

.gitea/workflows/ci.yaml

@@ -1,145 +0,0 @@
-name: CI
-
-# One gate per pull request. Branch pushes no longer trigger CI on their own,
-# so a change is built once on its PR (covering feature -> release/* and
-# release/* -> main) instead of once per push and again on the merge to main.
-# The merge itself is handled by release.yaml, which only does heavy work when
-# the merge actually cuts a release.
-on:
-  pull_request:
-
-# Cancel superseded runs for the same PR.
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  # Single job named `ci` so the required "CI" status check is always reported,
-  # even for docs-only PRs: those just skip the Android build and the job still
-  # succeeds (fast green check) instead of being filtered out and leaving the
-  # required check pending forever.
-  ci:
-    runs-on: docker
-    env:
-      ANDROID_HOME: /opt/android-sdk
-      ANDROID_SDK_ROOT: /opt/android-sdk
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          # Full history so the base..HEAD diff below has a merge-base.
-          fetch-depth: 0
-          submodules: recursive
-
-      # Cheap, always-on guard: the release build must stay reproducible for the
-      # official F-Droid repo (no AGP VCS-info embedding). Runs regardless of
-      # change scope so a regression can't slip through on a "docs-only" PR.
-      - name: Reproducible-release invariant
-        run: bash scripts/check_reproducible_release.sh
-
-      # Decide whether anything that affects the app build changed. Docs,
-      # F-Droid metadata and the licence don't, so those PRs skip the SDK +
-      # Gradle work below but still report a green `ci`.
-      - name: Classify change scope
-        id: scope
-        run: |
-          set -e
-          BASE="${{ github.base_ref }}"
-          # Full (not --depth=1) base fetch so the merge-base is present even when
-          # the PR branch forked several commits back; a shallow tip has no merge
-          # base with a divergent branch and `git diff base...HEAD` aborts.
-          git fetch --no-tags origin "$BASE"
-          MB=$(git merge-base "origin/$BASE" HEAD 2>/dev/null || true)
-          if [ -z "$MB" ]; then
-            # No common ancestor available — don't risk skipping the build.
-            echo "No merge base with origin/$BASE — running the full build to be safe."
-            echo "code=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          CHANGED=$(git diff --name-only "$MB" HEAD)
-          echo "Changed files:"; echo "$CHANGED"
-          if echo "$CHANGED" | grep -vE '(\.md$|^docs/|^fdroid-metadata/|^fastlane/|^LICENSE$)' | grep -q .; then
-            echo "code=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "code=false" >> "$GITHUB_OUTPUT"
-            echo "Docs/metadata-only change — skipping the Android build."
-          fi
-
-      - name: Setup Java
-        if: steps.scope.outputs.code == 'true'
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'zulu'
-          java-version: '17'
-
-      - name: Setup Android SDK
-        if: steps.scope.outputs.code == 'true'
-        uses: android-actions/setup-android@v3
-        with:
-          # Default ("tools platform-tools") drags in the Android Emulator
-          # (~300 MB) which the build never uses.
-          packages: ''
-
-      - name: Setup Android SDK cache
-        if: steps.scope.outputs.code == 'true'
-        uses: actions/cache@v4
-        with:
-          path: /opt/android-sdk
-          key: ${{ runner.os }}-android-sdk-37-36.0.0
-
-      - name: Install Android SDK packages
-        if: steps.scope.outputs.code == 'true'
-        run: |
-          yes | sdkmanager --licenses >/dev/null || true
-          sdkmanager \
-            "platform-tools" \
-            "platforms;android-37.0" \
-            "build-tools;36.0.0"
-
-      - name: Setup Gradle cache
-        if: steps.scope.outputs.code == 'true'
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
-
-      - name: Grant execute permission for gradlew
-        if: steps.scope.outputs.code == 'true'
-        run: chmod +x ./gradlew
-
-      # No --no-daemon: the daemon lives only as long as this job container
-      # and lets the following steps skip JVM startup + reconfiguration.
-      - name: Lint (debug variant only)
-        if: steps.scope.outputs.code == 'true'
-        run: ./gradlew lintDebug
-
-      - name: Unit tests
-        if: steps.scope.outputs.code == 'true'
-        run: ./gradlew testDebugUnitTest
-
-      - name: Assemble debug APK
-        if: steps.scope.outputs.code == 'true'
-        run: ./gradlew assembleDebug
-
-      - name: Trivy filesystem scan
-        if: steps.scope.outputs.code == 'true'
-        run: |
-          set -e
-          SUDO=""
-          if command -v sudo >/dev/null 2>&1; then
-            SUDO="sudo"
-          fi
-          if command -v apt-get >/dev/null 2>&1; then
-            $SUDO apt-get update
-            $SUDO apt-get install -y wget apt-transport-https gnupg lsb-release
-            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | $SUDO tee /usr/share/keyrings/trivy.gpg > /dev/null
-            echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | $SUDO tee /etc/apt/sources.list.d/trivy.list
-            $SUDO apt-get update
-            $SUDO apt-get install -y trivy
-          fi
-          trivy filesystem --severity HIGH,CRITICAL --exit-code 0 .
-        continue-on-error: true

.gitea/workflows/release.yaml

@@ -3,12 +3,18 @@ name: Release — F-Droid repo + Gitea/Codeberg release
 # A release is cut by merging a release branch into main with a bumped
 # versionName (see docs/RELEASING.md). This workflow reads that versionName and,
 # if no matching tag exists yet, runs tests, builds + signs the APK, publishes
-# it to the F-Droid repo, creates the vX.Y.Z tag + Gitea release, and mirrors
-# that release to Codeberg with the signed APK + a SHA-256 checksum as a
+# it to the F-Droid repo, creates the vX.Y.Z tag + Gitea release, and publishes
+# the release on Codeberg with the signed APK + a SHA-256 checksum as a
 # direct-download channel — the tag is an output of the pipeline, not its
 # trigger. Ordinary merges (no version bump) fall through `detect` and do
 # nothing.
 #
+# This file lives in .gitea/workflows on purpose: Codeberg is canonical for git,
+# issues, PRs and releases, but every secret (app key, F-Droid repo key, Hetzner
+# credentials) lives on the self-hosted Gitea instance, and this is the only
+# directory Codeberg cannot see. Contributor-triggerable work lives in
+# .forgejo/workflows and references no secret. See docs/RELEASING.md.
+#
 # A manual workflow_dispatch (from a branch) runs the re-sign-only recovery
 # path: it re-signs the existing F-Droid index with the repo key and re-uploads,
 # without building an APK or creating a release. Used for key rotation / repo
@@ -27,6 +33,14 @@ jobs:
   # whether this push actually cuts a new release (no tag for it yet). Keeps the
   # heavy job from running on every merge to main.
   detect:
+    # Gitea only. The workflow directory split already keeps this file invisible
+    # to Codeberg — Forgejo's lookup is first-match-wins, and .forgejo/workflows
+    # exists — but that only holds while .forgejo/ is non-empty. Move the last
+    # file out of it and Codeberg would fall back to .gitea/workflows and start
+    # running the release pipeline on the contributor-facing runner, with no
+    # secrets. repository_owner differs between the two forges regardless of
+    # URL, proxy or instance rename, so this closes it permanently.
+    if: github.repository_owner == 'makiolaj'
     runs-on: docker
     outputs:
       is_release: ${{ steps.v.outputs.is_release }}
@@ -42,8 +56,16 @@ jobs:
       - name: Resolve version and whether it is a new release
         id: v
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          # Tags are read from Codeberg, which is canonical — deliberately NOT
+          # from the Gitea API this workflow runs on. The Codeberg -> Gitea sync
+          # is a push mirror, i.e. `git push --mirror`, which deletes refs the
+          # source does not have. A tag minted here on Gitea is therefore wiped
+          # by the next sync (Codeberg does not have it yet) and only reappears
+          # once the tag push at the end of this workflow propagates back.
+          # Asking Gitea inside that window would report "no tag" for a release
+          # that already shipped, and cut it a second time.
+          # Public repo, so this read needs no token.
+          TAG_API: https://codeberg.org/api/v1/repos/jlmakiola/agendula
         run: |
           set -e
           VERSION=$(grep -oP 'versionName\s*=\s*"\K[^"]+' app/build.gradle.kts)
@@ -65,15 +87,28 @@ jobs:
           fi
           # A tag for this version already existing means the release shipped on
           # an earlier push; do nothing. Absent => this merge cuts the release.
-          STATUS=$(curl -s -o /dev/null -w '%{http_code}' \
-            -H "Authorization: token $TOKEN" "$API/git/refs/tags/v$VERSION")
-          if [ "$STATUS" = "200" ]; then
-            echo "Tag v$VERSION already exists — nothing to release."
-            echo "is_release=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "No tag for v$VERSION yet — cutting the release."
-            echo "is_release=true" >> "$GITHUB_OUTPUT"
-          fi
+          #
+          # Anything other than a clean 200/404 is treated as fatal rather than
+          # as "no tag". A Codeberg outage or a network blip would otherwise
+          # read as absent and re-cut a release that has already shipped —
+          # republishing to F-Droid. Failing here is recoverable; a duplicate
+          # release is not.
+          STATUS=$(curl -s -o /dev/null -w '%{http_code}' "$TAG_API/git/refs/tags/v$VERSION" || echo 000)
+          case "$STATUS" in
+            200)
+              echo "Tag v$VERSION already exists on Codeberg — nothing to release."
+              echo "is_release=false" >> "$GITHUB_OUTPUT"
+              ;;
+            404)
+              echo "No tag for v$VERSION on Codeberg yet — cutting the release."
+              echo "is_release=true" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "Codeberg tag lookup for v$VERSION returned HTTP $STATUS." >&2
+              echo "Refusing to guess: treating this as 'no tag' could re-cut a shipped release." >&2
+              exit 1
+              ;;
+          esac
 
   # Releases: build + sign + publish, then mint the tag and Gitea release.
   # Also runs on manual dispatch, where it skips the build and just re-signs and
@@ -360,14 +395,15 @@ jobs:
             -F "attachment=@/tmp/$ASSET" \
             "$API/releases/$ID/assets?name=$ASSET" -o /dev/null -w "asset upload HTTP %{http_code}\n"
 
-      # Mirror the release to the Codeberg mirror as a direct-download channel
-      # for users who don't want F-Droid. Gitea already push-mirrors branches +
-      # tags to Codeberg, but releases aren't git objects so they don't sync —
-      # we create the release there over the API and attach the signed APK plus
-      # a SHA-256 checksum. The APK is identical to the F-Droid one (same app
-      # key), so this adds no trust surface. Best-effort: a Codeberg outage
-      # (it 504s under load) must never fail an already-published F-Droid
-      # release. Needs the CODEBERG_RELEASE_TOKEN secret; skips cleanly if unset.
+      # Publish the release on Codeberg, which is canonical for tags and
+      # releases (see docs/RELEASING.md). Codeberg push-mirrors branches + tags
+      # to Gitea, but releases aren't git objects and don't sync in either
+      # direction — so this step pushes the tag straight to Codeberg and creates
+      # the release there over the API, attaching the signed APK plus a SHA-256
+      # checksum as the direct-download channel for users who don't want
+      # F-Droid. The APK is identical to the F-Droid one (same app key), so this
+      # adds no trust surface. Needs the CODEBERG_RELEASE_TOKEN secret; skips
+      # cleanly if unset.
       - name: Publish release to Codeberg
         if: env.IS_RELEASE == 'true'
         # NOT continue-on-error: this step reported green through 0.2.1, 0.2.2,
@@ -377,6 +413,7 @@ jobs:
         env:
           TOKEN: ${{ secrets.CODEBERG_RELEASE_TOKEN }}
           API: https://codeberg.org/api/v1/repos/jlmakiola/agendula
+          SHA: ${{ github.sha }}
         run: |
           set -e
           if [ -z "${TOKEN:-}" ]; then
@@ -401,34 +438,21 @@ jobs:
             sed -i -e '/./,$!d' release-notes.md
           fi
           [ -s release-notes.md ] || echo "_See CHANGELOG.md for ${VERSION}._" > release-notes.md
-          # Never mint the tag here. Gitea's push mirror owns getting it to
-          # Codeberg; this step's only job is to attach a release to a tag that
-          # has already landed. That split matters because every way of creating
-          # a tag from here — git push, or a release POST carrying
-          # target_commitish for a tag Codeberg lacks — is a ref WRITE, and ref
-          # writes are what fail on this repo ("cannot lock references" on push,
-          # an empty-bodied 500 on the API). Attaching to a tag that is already
-          # present needs no ref write and succeeds.
+          # Push the tag to Codeberg ourselves. Under Codeberg-canonical the
+          # mirror runs Codeberg -> Gitea, so waiting for a tag to arrive here
+          # from Gitea (what 0.3.2 did) would wait forever. The tag this
+          # pipeline minted on Gitea is in fact *deleted* by the next mirror
+          # sync until Codeberg has it — so pushing it here is what makes it
+          # durable on both forges.
           #
-          # So: wait for the mirror, verify, then attach. If the tag never shows
-          # up, fail — do NOT fall back to creating it, which is what produced
-          # the silent breakage across 0.2.1 through 0.3.2.
-          TAG_OK=""
-          for i in $(seq 1 30); do
-            if [ "$(curl -s -o /dev/null -w '%{http_code}' \
-                    -H "Authorization: token $TOKEN" "$API/tags/$TAG")" = "200" ]; then
-              TAG_OK=1; echo "Codeberg has $TAG (after ~$((i*10))s)"; break
-            fi
-            sleep 10
-          done
-          if [ -z "$TAG_OK" ]; then
-            echo "Codeberg never received $TAG from the push mirror (waited 300s)." >&2
-            echo "Not creating it here: ref writes to this repo fail, so that" >&2
-            echo "would 500. Check the mirror, then re-run once the tag is there." >&2
-            exit 1
-          fi
-          # No target_commitish: the tag exists, so the API must attach to it
-          # rather than resolve a commit and mint one.
+          # Pushing the ref first and attaching with NO target_commitish is
+          # deliberate: a release POST carrying a target_commitish for a commit
+          # or tag Codeberg hasn't received yet is what produced the
+          # empty-bodied 500s. Attaching to a ref that already exists doesn't
+          # need the API to write one.
+          git tag -f "$TAG" "$SHA"
+          git push -f "https://jlmakiola:${TOKEN}@codeberg.org/jlmakiola/agendula.git" \
+            "refs/tags/$TAG"
           python3 - "$TAG" "$PRERELEASE" <<'PY' > cb-payload.json
           import json, sys
           tag, pre = sys.argv[1:3]
@@ -441,20 +465,31 @@ jobs:
               "prerelease": pre == "true",
           }))
           PY
-          # Upsert (re-run safe): a release already attached to this tag is
-          # PATCHed in place, so re-running never disturbs a published release.
-          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
-          if [ -n "$ID" ]; then
-            curl -s -o /dev/null -w "release PATCH HTTP %{http_code}\n" -X PATCH \
+          # Create (or update) the release. Codeberg 500s on a POST/GET against a
+          # tag it has only just received — the release request outruns the
+          # indexing of the ref we pushed a moment ago — so a single attempt can
+          # fail even though the very same call succeeds seconds later. Retry
+          # with backoff, and PATCH in place if a release already exists (re-run
+          # safe, so re-running never disturbs a published release). A 5xx body
+          # still exits curl 0, so the loop, not `set -e`, controls the flow.
+          ID=""
+          for attempt in 1 2 3 4 5 6; do
+            EXIST=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty' 2>/dev/null || true)
+            if [ -n "$EXIST" ]; then
+              curl -s -o /dev/null -w "release PATCH HTTP %{http_code}\n" -X PATCH \
+                -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+                -d @cb-payload.json "$API/releases/$EXIST"
+              ID="$EXIST"; break
+            fi
+            CODE=$(curl -s -o cb-response.json -w "%{http_code}" -X POST \
               -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-              -d @cb-payload.json "$API/releases/$ID"
-          else
-            curl -s -o cb-response.json -w "release POST HTTP %{http_code}\n" -X POST \
-              -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-              -d @cb-payload.json "$API/releases"
+              -d @cb-payload.json "$API/releases")
+            echo "release POST attempt $attempt HTTP $CODE"
             ID=$(jq -r '.id // empty' cb-response.json 2>/dev/null || true)
-          fi
-          if [ -z "$ID" ]; then echo "Could not resolve Codeberg release id." >&2; exit 1; fi
+            [ -n "$ID" ] && break
+            sleep $((attempt * 10))
+          done
+          if [ -z "$ID" ]; then echo "Could not resolve Codeberg release id after retries." >&2; exit 1; fi
 
           # Attach APK + checksum, replacing any prior asset of the same name.
           for A in "$ASSET_APK" "$ASSET_SUM"; do

.gitea/workflows/renovate.yml

@@ -0,0 +1,61 @@
+name: Renovate
+
+on:
+  # Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
+  # renovate.json5 deliberately has no internal schedule (avoids double-gating).
+  schedule:
+    - cron: '0 5 * * 1'
+  # Manual run for an on-demand sweep from the Actions tab.
+  workflow_dispatch:
+
+# Never let two Renovate runs touch the repo at once.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    # Gitea only — same guard, and the same reason, as release.yaml's `detect`:
+    # this file is invisible to Codeberg only while .forgejo/ is non-empty, and
+    # a repo-write token must never run on the contributor-facing runner.
+    if: github.repository_owner == 'makiolaj'
+    runs-on: docker
+    # Run the Renovate image *as* the job container and invoke the `renovate`
+    # binary directly. The renovatebot/github-action wrapper is a thin Node
+    # action that shells out to `docker run …` — it needs a Docker CLI + socket
+    # inside the job, which the Gitea runner's plain node container has not, so
+    # it died on "Unable to locate executable file: docker". Running the image
+    # directly drops the docker-in-docker requirement entirely.
+    # Full tag pinned; Renovate's github-actions manager keeps it bumped.
+    container:
+      image: ghcr.io/renovatebot/renovate:43.232.0
+    steps:
+      - name: Run Renovate
+        run: renovate
+        env:
+          # Renovate targets Codeberg (canonical) while still RUNNING on the
+          # Gitea runner. Moving the job to Codeberg would put a repo-write
+          # token on the contributor-facing runner, which is exactly what the
+          # .forgejo/ vs .gitea/ split exists to prevent — so the token stays
+          # where the other secrets live and only the API calls cross over.
+          #
+          # Platform is `forgejo`, not `gitea`: Codeberg runs Forgejo, and the
+          # pinned image ships a distinct forgejo platform module.
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://codeberg.org/api/v1
+          # Codeberg bot-account token (Gitea secret). Needs repo read/write +
+          # PR scope on jlmakiola/agendula.
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          # Scope to this repo only — no org-wide autodiscovery.
+          RENOVATE_AUTODISCOVER: 'false'
+          RENOVATE_REPOSITORIES: '["jlmakiola/agendula"]'
+          # Commits/PRs authored as the bot, not a real maintainer. This address
+          # must be a verified email on the Codeberg bot account, otherwise the
+          # commits show up unattributed there.
+          RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
+          # Read-only github.com PAT (no scopes needed). Nearly every dependency
+          # is *released* on GitHub, and without this, changelog/release-note
+          # lookups hit the 60/h anonymous rate limit and PRs arrive with an
+          # empty "Release Notes" section.
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
+          LOG_LEVEL: info