makiolaj
881f6b1286
Brings the workflows, scripts and fastlane setup up to Agendula's
v1.1.0-beta.1 state:
- beta.yaml: a release/** branch carrying X.Y.Z-beta.N publishes a
Gitea + Codeberg pre-release with the signed APK. Never F-Droid or Play.
- scripts/version_info.sh derives versionCode from versionName for every
workflow and CI step. Clockula has no shipped 1.0.x codes, so it uses one
scheme: X*1000000 + Y*10000 + Z*100 + (beta N, or 99 for stable).
- CI checks the committed versionCode, blocks a beta from reaching main,
enforces the 500-char What's New and validates the store listing.
- Shared publish_gitea_release.sh / publish_codeberg_release.sh /
release_notes.sh replace the inline steps in release.yaml.
- Renovate also runs on every push to main to rebase conflicted PRs.
- jniLibs keepDebugSymbols, which the reproducibility guard now requires.
Fixes a bug present in Agendula too: the Codeberg tag lookups used
/git/refs/tags/{tag}, which matches by prefix, so v1.0.0 would have
"existed" as soon as v1.0.0-beta.1 did. That would have refused every
later beta and skipped the stable release. Both now use /tags/{tag}.
71 lines
3.5 KiB
YAML
71 lines
3.5 KiB
YAML
name: Renovate
|
|
|
|
on:
|
|
# Every merge to main. Mirror syncs from Codeberg fire push events here (the
|
|
# same trigger release.yaml relies on), so a merged Renovate PR is followed
|
|
# within minutes by a run that rebases the sibling PRs it just conflicted —
|
|
# most bumps touch gradle/libs.versions.toml. Outside renovate.json5's
|
|
# `schedule` window such a run only maintains existing branches
|
|
# (updateNotScheduled), it never opens new PRs. Renovate's own rebases push
|
|
# to renovate/* branches, not main, so this cannot loop.
|
|
push:
|
|
branches: [main]
|
|
# Weekly sweep for new updates. Mondays 05:00 UTC, inside the schedule window
|
|
# in renovate.json5 — keep the two in step.
|
|
schedule:
|
|
- cron: '0 5 * * 1'
|
|
# Manual run for an on-demand sweep from the Actions tab.
|
|
workflow_dispatch:
|
|
|
|
# Never let two Renovate runs touch the repo at once.
|
|
concurrency:
|
|
group: renovate
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
renovate:
|
|
# Gitea only — same guard, and the same reason, as release.yaml's `detect`:
|
|
# this file is invisible to Codeberg only while .forgejo/ is non-empty, and
|
|
# a repo-write token must never run on the contributor-facing runner.
|
|
if: github.repository_owner == 'makiolaj'
|
|
runs-on: docker
|
|
# Run the Renovate image *as* the job container and invoke the `renovate`
|
|
# binary directly. The renovatebot/github-action wrapper is a thin Node
|
|
# action that shells out to `docker run …` — it needs a Docker CLI + socket
|
|
# inside the job, which the Gitea runner's plain node container has not, so
|
|
# it died on "Unable to locate executable file: docker". Running the image
|
|
# directly drops the docker-in-docker requirement entirely.
|
|
# Full tag pinned; Renovate's github-actions manager keeps it bumped.
|
|
container:
|
|
image: ghcr.io/renovatebot/renovate:43.232.0
|
|
steps:
|
|
- name: Run Renovate
|
|
run: renovate
|
|
env:
|
|
# Renovate targets Codeberg (canonical) while still RUNNING on the
|
|
# Gitea runner. Moving the job to Codeberg would put a repo-write
|
|
# token on the contributor-facing runner, which is exactly what the
|
|
# .forgejo/ vs .gitea/ split exists to prevent — so the token stays
|
|
# where the other secrets live and only the API calls cross over.
|
|
#
|
|
# Platform is `forgejo`, not `gitea`: Codeberg runs Forgejo, and the
|
|
# pinned image ships a distinct forgejo platform module.
|
|
RENOVATE_PLATFORM: forgejo
|
|
RENOVATE_ENDPOINT: https://codeberg.org/api/v1
|
|
# Codeberg bot-account token (Gitea secret). Needs repo read/write +
|
|
# PR scope on jlmakiola/clockula.
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
# Scope to this repo only — no org-wide autodiscovery.
|
|
RENOVATE_AUTODISCOVER: 'false'
|
|
RENOVATE_REPOSITORIES: '["jlmakiola/clockula"]'
|
|
# Commits/PRs authored as the bot, not a real maintainer. This address
|
|
# must be a verified email on the Codeberg bot account, otherwise the
|
|
# commits show up unattributed there.
|
|
RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
|
|
# Read-only github.com PAT (no scopes needed). Nearly every dependency
|
|
# is *released* on GitHub, and without this, changelog/release-note
|
|
# lookups hit the 60/h anonymous rate limit and PRs arrive with an
|
|
# empty "Release Notes" section.
|
|
RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
|
|
LOG_LEVEL: info
|