Three gaps in the Renovate setup, all about having enough information in
front of you at review time:
- The PR table had no Age/Adoption/Passing/Confidence columns. Those are
Mend's Merge Confidence badges, which self-hosted Renovate only emits
behind the `mergeConfidence:all-badges` preset. No credentials involved
— Renovate embeds badge URLs and the browser resolves them on view.
- Release notes came back empty. We run against Gitea, but the packages
are *released* on GitHub, so changelog lookups were going out
unauthenticated against a 60/h limit. A scopeless read-only PAT
(GITHUB_COM_TOKEN secret) lifts that.
- Nothing expressed how settled a release is. Cooling-off is now scaled
by blast radius: 30 days major, 20 minor, 10 patch/digest.
The age tiers are deliberately advisory. Renovate's default
`internalChecksFilter: strict` would suppress the PR outright until the
version aged in; "none" opens it at the highest version immediately and
leaves a pending stability check behind, so merging ahead of the window
stays a decision rather than a wait.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
renovatebot/github-action is a Node wrapper that shells out to
`docker run ghcr.io/renovatebot/renovate`, requiring a Docker CLI + socket
inside the job. The Gitea runner executes the job in a plain node:22 container
with neither, so it died on "Unable to locate executable file: docker".
Run the renovate image as the job container and invoke `renovate` directly —
drops the docker-in-docker requirement. Full tag pinned; Renovate's
github-actions manager keeps container.image bumped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
renovatebot/github-action ships only full semver tags; @v40 was an
invalid ref and the dispatched run failed to resolve it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
renovate.json5 (config:recommended + semantic commits, no automerge,
dependency dashboard; material3 stays on its 1.5-alpha pin in an
isolated PR; test deps grouped; github-actions manager watches
.gitea/workflows). Cadence owned by .gitea/workflows/renovate.yml
(Mondays 05:00 UTC + manual dispatch), self-hosted via
renovatebot/github-action, scoped to makiolaj/calendula.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
