ci: the full release pipeline, Codeberg-canonical from commit one

Both siblings' pipelines are near-identical; the real difference between them is which forge is canonical. This is Agendula's spine — it pushes the tag to Codeberg itself and flags pre-1.0 releases as pre-releases — with Calendula's `play` job grafted on unchanged. Taking Agendula's spine means there is no Gitea-canonical phase to migrate out of later, which is the one thing Agendula had to unwind. The Codeberg publish step stays NOT continue-on-error, inherited that way deliberately: in Agendula it reported green through five consecutive releases while never once publishing, which is how a crash-fix release reached F-Droid but not the users who needed it. Comments that recount that history now name Agendula, so an inherited scar isn't misread as ours. The `play` job runs last and isolated, and skips cleanly until PLAY_SERVICE_ACCOUNT_JSON exists — so it stays dormant through the whole pre-1.0 run, which is the correct behaviour anyway. Templates, the contributing guide and verify-release.sh are rewritten for this app's domain rather than renamed: the architectural rule here is that Room types stay in the data layer, and the on-device release check is an alarm that survives a lock screen and a reboot, not a task list that loads. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L94fydiJC37LtxVusNQBDy
2026-09-11 11:47:07 +02:00
parent 5ddec0f248
commit 97ed6cf6f5
25 changed files with 1963 additions and 0 deletions
@@ -0,0 +1,61 @@
+name: Renovate
+
+on:
+  # Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
+  # renovate.json5 deliberately has no internal schedule (avoids double-gating).
+  schedule:
+    - cron: '0 5 * * 1'
+  # Manual run for an on-demand sweep from the Actions tab.
+  workflow_dispatch:
+
+# Never let two Renovate runs touch the repo at once.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    # Gitea only — same guard, and the same reason, as release.yaml's `detect`:
+    # this file is invisible to Codeberg only while .forgejo/ is non-empty, and
+    # a repo-write token must never run on the contributor-facing runner.
+    if: github.repository_owner == 'makiolaj'
+    runs-on: docker
+    # Run the Renovate image *as* the job container and invoke the `renovate`
+    # binary directly. The renovatebot/github-action wrapper is a thin Node
+    # action that shells out to `docker run …` — it needs a Docker CLI + socket
+    # inside the job, which the Gitea runner's plain node container has not, so
+    # it died on "Unable to locate executable file: docker". Running the image
+    # directly drops the docker-in-docker requirement entirely.
+    # Full tag pinned; Renovate's github-actions manager keeps it bumped.
+    container:
+      image: ghcr.io/renovatebot/renovate:43.232.0
+    steps:
+      - name: Run Renovate
+        run: renovate
+        env:
+          # Renovate targets Codeberg (canonical) while still RUNNING on the
+          # Gitea runner. Moving the job to Codeberg would put a repo-write
+          # token on the contributor-facing runner, which is exactly what the
+          # .forgejo/ vs .gitea/ split exists to prevent — so the token stays
+          # where the other secrets live and only the API calls cross over.
+          #
+          # Platform is `forgejo`, not `gitea`: Codeberg runs Forgejo, and the
+          # pinned image ships a distinct forgejo platform module.
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://codeberg.org/api/v1
+          # Codeberg bot-account token (Gitea secret). Needs repo read/write +
+          # PR scope on jlmakiola/clockula.
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          # Scope to this repo only — no org-wide autodiscovery.
+          RENOVATE_AUTODISCOVER: 'false'
+          RENOVATE_REPOSITORIES: '["jlmakiola/clockula"]'
+          # Commits/PRs authored as the bot, not a real maintainer. This address
+          # must be a verified email on the Codeberg bot account, otherwise the
+          # commits show up unattributed there.
+          RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
+          # Read-only github.com PAT (no scopes needed). Nearly every dependency
+          # is *released* on GitHub, and without this, changelog/release-note
+          # lookups hit the 60/h anonymous rate limit and PRs arrive with an
+          # empty "Release Notes" section.
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
+          LOG_LEVEL: info