Jean-Luc Makiola
c6e83fc071
Three gaps in the Renovate setup, all about having enough in front of you at review time. ### Age reads UNKNOWN `config:recommended` already brings in `mergeConfidence:age-confidence-badges`, so the Age column existed — it just rendered grey. Fetching the badge SVGs from `developer.mend.io` directly shows why: Mend's index covers Maven Central but has nothing for Google's Maven repo, so every androidx/compose coordinate is blank. No token changes it; the JSON API behind the badges answers 401 for everyone. | coordinate | registry | age badge | | --- | --- | --- | | `androidx.compose:compose-bom` | Google Maven | UNKNOWN | | `androidx.core:core-ktx` | Google Maven | UNKNOWN | | `com.google.truth:truth` | Maven Central | 2y | | `org.jetbrains.kotlin:kotlin-stdlib` | Maven Central | 1y (confidence high, passing 99%) | Age is now computed from `newVersionAgeInDays`, which Renovate derives itself to evaluate `minimumReleaseAge` — Google Maven serves `last-modified` on its POMs, so it's populated where Mend is blank, and the number agrees with the tiers it's read against. Mend keeps the Confidence column, which still resolves for the Maven Central half (Kotlin, Gradle, AGP, the test stack). ### Empty release notes We run against Gitea, but the packages are *released* on GitHub, so changelog lookups were going out unauthenticated against a 60/h limit. `RENOVATE_GITHUB_COM_TOKEN` lifts that. **Needs a secret before it does anything:** a github.com PAT with **no scopes ticked**, added as repo secret `GITHUB_COM_TOKEN`. Until then the var resolves empty, which is exactly today's behaviour. ### Nothing expressed how settled a release is Cooling-off scaled by blast radius: 30 days major, 20 minor, 10 patch/digest. Deliberately advisory. Renovate's default `internalChecksFilter: strict` would suppress the PR outright until the version aged in; `none` opens it at the highest version immediately, so merging ahead of the window stays a decision rather than a wait. A too-young release still gets a yellow `renovate/stability-days` check — `setStability` computes that from `minimumReleaseAge` + `releaseTimestamp` independently of the filter — and with `automerge: false` nothing acts on it. ### Notes Validated with `renovate-config-validator` against the pinned 43.232.0. Config is read from the default branch, so the open bump PRs keep their current tables until the next run after this merges. Reviewed-on: #98
48 lines
2.1 KiB
YAML
48 lines
2.1 KiB
YAML
name: Renovate
|
|
|
|
on:
|
|
# Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
|
|
# renovate.json5 deliberately has no internal schedule (avoids double-gating).
|
|
schedule:
|
|
- cron: '0 5 * * 1'
|
|
# Manual run for an on-demand sweep from the Actions tab.
|
|
workflow_dispatch:
|
|
|
|
# Never let two Renovate runs touch the repo at once.
|
|
concurrency:
|
|
group: renovate
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: docker
|
|
# Run the Renovate image *as* the job container and invoke the `renovate`
|
|
# binary directly. The renovatebot/github-action wrapper is a thin Node
|
|
# action that shells out to `docker run …` — it needs a Docker CLI + socket
|
|
# inside the job, which the Gitea runner's plain node container has not, so
|
|
# it died on "Unable to locate executable file: docker". Running the image
|
|
# directly drops the docker-in-docker requirement entirely.
|
|
# Full tag pinned; Renovate's github-actions manager keeps it bumped.
|
|
container:
|
|
image: ghcr.io/renovatebot/renovate:43.232.0
|
|
steps:
|
|
- name: Run Renovate
|
|
run: renovate
|
|
env:
|
|
# Self-hosted Gitea, not github.com.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://gitea.jeanlucmakiola.de/api/v1
|
|
# Bot-account token (Gitea secret). Needs repo read/write + PR scope.
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
# Scope to this repo only — no org-wide autodiscovery.
|
|
RENOVATE_AUTODISCOVER: 'false'
|
|
RENOVATE_REPOSITORIES: '["makiolaj/calendula"]'
|
|
# Commits/PRs authored as the bot, not a real maintainer.
|
|
RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
|
|
# Read-only github.com PAT (no scopes needed). We run on Gitea, but
|
|
# nearly every dependency is *released* on GitHub — without this,
|
|
# changelog/release-note lookups hit the 60/h anonymous rate limit
|
|
# and PRs arrive with an empty "Release Notes" section.
|
|
RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
|
LOG_LEVEL: info
|