chore(renovate): rebase conflicted PRs on every merge to main (#366)

Renovate only rebases while it runs, and it ran once a week, so merging one dependency PR left the others conflicted until the next Monday.

- `renovate.yml`: also run on push to `main` (mirror syncs fire push events, like `release.yaml`).
- `renovate.json5`: new PRs only in a Monday window (`* 4-6 * * 1`) around the weekly cron; on-merge runs only rebase conflicted PRs (`rebaseWhen: "conflicted"`).

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/calendula/pulls/366

.gitea/workflows/renovate.yml

@@ -1,8 +1,17 @@
 name: Renovate
 
 on:
-  # Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
-  # renovate.json5 deliberately has no internal schedule (avoids double-gating).
+  # Every merge to main. Mirror syncs from Codeberg fire push events here (the
+  # same trigger release.yaml relies on), so a merged Renovate PR is followed
+  # within minutes by a run that rebases the sibling PRs it just conflicted —
+  # most bumps touch gradle/libs.versions.toml. Outside renovate.json5's
+  # `schedule` window such a run only maintains existing branches
+  # (updateNotScheduled), it never opens new PRs. Renovate's own rebases push
+  # to renovate/* branches, not main, so this cannot loop.
+  push:
+    branches: [main]
+  # Weekly sweep for new updates. Mondays 05:00 UTC, inside the schedule window
+  # in renovate.json5 — keep the two in step.
   schedule:
     - cron: '0 5 * * 1'
   # Manual run for an on-demand sweep from the Actions tab.

renovate.json5

@@ -52,9 +52,16 @@
   prConcurrentLimit: 5,
   prHourlyLimit: 0,
 
-  // Cadence is owned by the Gitea Actions cron (.gitea/workflows/renovate.yml,
-  // Mondays) — no internal `schedule` here, so the two don't double-gate and
-  // silently skip a run.
+  // New branches/PRs only in the Monday window (UTC), which brackets the weekly
+  // cron in .gitea/workflows/renovate.yml with slack for a late start — keep
+  // the two in step, or the sweep lands outside the window and finds nothing.
+  // The same workflow also runs on every push to main; those runs fall outside
+  // the window and, via the default updateNotScheduled: true, only maintain
+  // existing branches — chiefly rebasing PRs a merge just conflicted.
+  schedule: ["* 4-6 * * 1"],
+  // Rebase only on conflict, not every time main moves (automerge is off, so
+  // this matches "auto"; spelled out because the on-merge trigger relies on it).
+  rebaseWhen: "conflicted",
 
   // Gitea Actions workflows live under .gitea/workflows, not .github — extend
   // the github-actions manager (same syntax) to watch them too.