From 0a8f290f81c0f7d10adac43bd9a1b0f5fe5bc8b3 Mon Sep 17 00:00:00 2001 From: Timothy Date: Sat, 27 Jun 2026 02:15:11 +0200 Subject: [PATCH] ci(renovate): enable Dockerfile manager for the HTTP Gitea registry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Turn on the `dockerfile` manager so Renovate also proposes base-image bumps for docker/Dockerfile (mcr.microsoft.com/dotnet/* and our internal 192.168.1.95:3000/timothy/ersatztv-ffmpeg). The internal registry is HTTP-only, so the workflow passes a host rule (insecureRegistry + registry read creds reused from REGISTRY_USER/REGISTRY_PASSWORD) via RENOVATE_HOST_RULES — kept in the workflow env, not in the committed renovate.json. - Scope: only the built amd64 docker/Dockerfile; the vestigial upstream arm32v7/arm64/ffmpeg-tests Dockerfiles (archived ghcr base) are disabled. - Group mcr.microsoft.com/dotnet/* base images into one PR. - Compose files are build-only (no image tags) -> docker-compose manager not needed. refs server-management#484 Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/renovate.yml | 4 ++++ renovate.json | 18 +++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml index bf9bec59a..114eb262e 100644 --- a/.gitea/workflows/renovate.yml +++ b/.gitea/workflows/renovate.yml @@ -61,6 +61,10 @@ jobs: RENOVATE_REPOSITORIES: timothy/ersatztv RENOVATE_AUTODISCOVER: 'false' RENOVATE_GIT_AUTHOR: 'Renovate Bot ' + # Let the dockerfile manager query our HTTP-only Gitea container registry for the + # ersatztv-ffmpeg base image. Creds (reused from the image-push secrets) + insecureRegistry + # live here, NOT in renovate.json, so they stay out of the committed config. + RENOVATE_HOST_RULES: '[{"matchHost":"192.168.1.95:3000","hostType":"docker","username":"${{ secrets.REGISTRY_USER }}","password":"${{ secrets.REGISTRY_PASSWORD }}","insecureRegistry":true}]' RENOVATE_DRY_RUN: ${{ inputs.dryRun }} LOG_LEVEL: ${{ inputs.logLevel || 'info' }} run: renovate diff --git a/renovate.json b/renovate.json index dd84b16f8..0ca066093 100644 --- a/renovate.json +++ b/renovate.json @@ -7,13 +7,29 @@ "semanticCommits": "enabled", "dependencyDashboard": true, "labels": ["dependencies"], - "enabledManagers": ["nuget", "github-actions"], + "enabledManagers": ["nuget", "github-actions", "dockerfile"], "osvVulnerabilityAlerts": true, "vulnerabilityAlerts": { "labels": ["dependencies", "security"] }, "prConcurrentLimit": 5, "packageRules": [ + { + "description": "Only manage the built amd64 docker/Dockerfile; ignore the vestigial upstream arm/ffmpeg-tests Dockerfiles (this fork ships amd64-only)", + "matchManagers": ["dockerfile"], + "matchFileNames": [ + "docker/arm32v7/Dockerfile", + "docker/arm64/Dockerfile", + "docker/ffmpeg-tests/Dockerfile" + ], + "enabled": false + }, + { + "description": "Group the .NET base images (mcr.microsoft.com/dotnet/*) into one PR", + "matchManagers": ["dockerfile"], + "matchPackageNames": ["/^mcr\\.microsoft\\.com\\/dotnet\\//"], + "groupName": ".NET base images" + }, { "description": "Group the Microsoft.Extensions.* family into one PR", "matchPackageNames": ["/^Microsoft\\.Extensions\\./"], -- 2.47.3