Jean-Luc Makiola
f36a74246b
Three gaps in the Renovate setup, all about having enough information in front of you at review time: - The PR table had no Age/Adoption/Passing/Confidence columns. Those are Mend's Merge Confidence badges, which self-hosted Renovate only emits behind the `mergeConfidence:all-badges` preset. No credentials involved — Renovate embeds badge URLs and the browser resolves them on view. - Release notes came back empty. We run against Gitea, but the packages are *released* on GitHub, so changelog lookups were going out unauthenticated against a 60/h limit. A scopeless read-only PAT (GITHUB_COM_TOKEN secret) lifts that. - Nothing expressed how settled a release is. Cooling-off is now scaled by blast radius: 30 days major, 20 minor, 10 patch/digest. The age tiers are deliberately advisory. Renovate's default `internalChecksFilter: strict` would suppress the PR outright until the version aged in; "none" opens it at the highest version immediately and leaves a pending stability check behind, so merging ahead of the window stays a decision rather than a wait. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
48 lines
2.1 KiB
YAML
48 lines
2.1 KiB
YAML
name: Renovate
|
|
|
|
on:
|
|
# Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
|
|
# renovate.json5 deliberately has no internal schedule (avoids double-gating).
|
|
schedule:
|
|
- cron: '0 5 * * 1'
|
|
# Manual run for an on-demand sweep from the Actions tab.
|
|
workflow_dispatch:
|
|
|
|
# Never let two Renovate runs touch the repo at once.
|
|
concurrency:
|
|
group: renovate
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: docker
|
|
# Run the Renovate image *as* the job container and invoke the `renovate`
|
|
# binary directly. The renovatebot/github-action wrapper is a thin Node
|
|
# action that shells out to `docker run …` — it needs a Docker CLI + socket
|
|
# inside the job, which the Gitea runner's plain node container has not, so
|
|
# it died on "Unable to locate executable file: docker". Running the image
|
|
# directly drops the docker-in-docker requirement entirely.
|
|
# Full tag pinned; Renovate's github-actions manager keeps it bumped.
|
|
container:
|
|
image: ghcr.io/renovatebot/renovate:43.232.0
|
|
steps:
|
|
- name: Run Renovate
|
|
run: renovate
|
|
env:
|
|
# Self-hosted Gitea, not github.com.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://gitea.jeanlucmakiola.de/api/v1
|
|
# Bot-account token (Gitea secret). Needs repo read/write + PR scope.
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
# Scope to this repo only — no org-wide autodiscovery.
|
|
RENOVATE_AUTODISCOVER: 'false'
|
|
RENOVATE_REPOSITORIES: '["makiolaj/calendula"]'
|
|
# Commits/PRs authored as the bot, not a real maintainer.
|
|
RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
|
|
# Read-only github.com PAT (no scopes needed). We run on Gitea, but
|
|
# nearly every dependency is *released* on GitHub — without this,
|
|
# changelog/release-note lookups hit the 60/h anonymous rate limit
|
|
# and PRs arrive with an empty "Release Notes" section.
|
|
RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
|
LOG_LEVEL: info
|