ci(renovate): enable Dockerfile manager for the HTTP Gitea registry #23

2026-06-27T02:16:16+02:00

timothy commented

2026-06-27 02:16:16 +02:00

Enables the previously-deferred Dockerfile manager so Renovate also proposes base-image bumps for docker/Dockerfile. Completes the Dockerfile half of server-management#484 for ersatztv.

What

enabledManagers += dockerfile.
HTTP registry handling: docker/Dockerfile pulls 192.168.1.95:3000/timothy/ersatztv-ffmpeg from our HTTP-only Gitea container registry. The workflow passes a host rule via RENOVATE_HOST_RULES — insecureRegistry: true + registry-read creds reused from the existing REGISTRY_USER/REGISTRY_PASSWORD secrets. Kept in the workflow env, not in the committed renovate.json, so creds stay out of git.
Scope: only the built amd64 docker/Dockerfile. The vestigial upstream arm32v7 / arm64 / ffmpeg-tests Dockerfiles (which reference the archived ghcr.io/ersatztv/ersatztv-ffmpeg) are disabled — the fork ships amd64-only, so managing them is pure noise.
Grouping: mcr.microsoft.com/dotnet/* base images (aspnet + sdk) into one PR.
docker-compose manager: not enabled — the repo's compose files are build:-only (no pinned image: tags).

Net effect

Renovate will now track the two public mcr.microsoft.com/dotnet/* bases and the internal ersatztv-ffmpeg base. As with everything non-test/dev, these are manual review (no auto-merge) — relevant since FFmpeg upgrades are deliberately gated (ersatztv-ffmpeg#4/#9).

After merge I'll dry-run to confirm Renovate can read the HTTP registry (no auth/TLS errors), then it's live.

refs server-management#484

Enables the previously-deferred **Dockerfile manager** so Renovate also proposes base-image bumps for `docker/Dockerfile`. Completes the Dockerfile half of `server-management#484` for ersatztv. ## What - **`enabledManagers`** += `dockerfile`. - **HTTP registry handling**: `docker/Dockerfile` pulls `192.168.1.95:3000/timothy/ersatztv-ffmpeg` from our **HTTP-only** Gitea container registry. The workflow passes a host rule via **`RENOVATE_HOST_RULES`** — `insecureRegistry: true` + registry-read creds reused from the existing `REGISTRY_USER`/`REGISTRY_PASSWORD` secrets. Kept in the **workflow env**, not in the committed `renovate.json`, so creds stay out of git. - **Scope**: only the built **amd64 `docker/Dockerfile`**. The vestigial upstream `arm32v7` / `arm64` / `ffmpeg-tests` Dockerfiles (which reference the archived `ghcr.io/ersatztv/ersatztv-ffmpeg`) are disabled — the fork ships amd64-only, so managing them is pure noise. - **Grouping**: `mcr.microsoft.com/dotnet/*` base images (aspnet + sdk) into one PR. - **docker-compose manager**: not enabled — the repo's compose files are `build:`-only (no pinned `image:` tags). ## Net effect Renovate will now track the two public `mcr.microsoft.com/dotnet/*` bases and the internal `ersatztv-ffmpeg` base. As with everything non-test/dev, these are **manual review** (no auto-merge) — relevant since FFmpeg upgrades are deliberately gated (ersatztv-ffmpeg#4/#9). After merge I'll dry-run to confirm Renovate can read the HTTP registry (no auth/TLS errors), then it's live. refs server-management#484

timothy added 1 commit 2026-06-27 02:16:16 +02:00

ci(renovate): enable Dockerfile manager for the HTTP Gitea registry

Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped

Details

Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 1m59s

Details

0a8f290f81

Turn on the `dockerfile` manager so Renovate also proposes base-image bumps for
docker/Dockerfile (mcr.microsoft.com/dotnet/* and our internal
192.168.1.95:3000/timothy/ersatztv-ffmpeg). The internal registry is HTTP-only,
so the workflow passes a host rule (insecureRegistry + registry read creds reused
from REGISTRY_USER/REGISTRY_PASSWORD) via RENOVATE_HOST_RULES — kept in the
workflow env, not in the committed renovate.json.

- Scope: only the built amd64 docker/Dockerfile; the vestigial upstream
  arm32v7/arm64/ffmpeg-tests Dockerfiles (archived ghcr base) are disabled.
- Group mcr.microsoft.com/dotnet/* base images into one PR.
- Compose files are build-only (no image tags) -> docker-compose manager not needed.

refs server-management#484

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

timothy merged commit 2430927b40 into main

2026-06-27 02:18:48 +02:00

timothy deleted branch chore/renovate-dockerfile-manager

2026-06-27 02:18:48 +02:00

~~timothy referenced this pull request 2026-07-11 11:40:25 +02:00~~

ChicoryTV rewrite — queue tracker (goal, arc, session protocol) #237

timothy referenced this pull request

2026-07-11 14:29:15 +02:00

Schedule-items PUT cascade-deletes PlayoutScheduleItemFillGroupIndex — every save (even a no-op) silently resets fill-group progression #252

timothy referenced this pull request

2026-07-11 14:29:53 +02:00

Mutation hardening cluster (audit #21/#22/#23 low-severity): post-commit token consistency, orphan guide xml, child-id stability, dirty-nav guard, empty-list semantics #254