2430927b40
Turn on the `dockerfile` manager so Renovate also proposes base-image bumps for docker/Dockerfile (mcr.microsoft.com/dotnet/* and our internal 192.168.1.95:3000/timothy/ersatztv-ffmpeg). The internal registry is HTTP-only, so the workflow passes a host rule (insecureRegistry + registry read creds reused from REGISTRY_USER/REGISTRY_PASSWORD) via RENOVATE_HOST_RULES — kept in the workflow env, not in the committed renovate.json. - Scope: only the built amd64 docker/Dockerfile; the vestigial upstream arm32v7/arm64/ffmpeg-tests Dockerfiles (archived ghcr base) are disabled. - Group mcr.microsoft.com/dotnet/* base images into one PR. - Compose files are build-only (no image tags) -> docker-compose manager not needed. refs server-management#484 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
name: Renovate
|
|
|
|
# Self-hosted Renovate for the ErsatzTV fork (server-management#484).
|
|
#
|
|
# Opens dependency-update PRs against this repo (managers: nuget via CPM, github-actions).
|
|
# Runs on the shared Gitea act_runner (bumblebee). It supersedes the *proposing* half that
|
|
# the dependency-scan.yml (ersatztv#14) deliberately left out — that scan stays as a cheap
|
|
# in-repo detector for now.
|
|
#
|
|
# Config: repo-root renovate.json (package rules, grouping, automerge policy).
|
|
# Bot identity + tokens are injected from repo Actions secrets:
|
|
# RENOVATE_TOKEN — PAT of the dedicated `renovate` Gitea bot (write:repository,
|
|
# read:user, write:issue, read:organization)
|
|
# GH_COM_TOKEN — no-scope github.com PAT for changelog/release-note fetching
|
|
# (Renovate needs this on non-GitHub platforms; optional, degrades
|
|
# gracefully to anonymous if unset). Named GH_, not GITHUB_, because
|
|
# Gitea reserves the GITHUB_ secret-name prefix.
|
|
#
|
|
# NOTE: Gitea runs `schedule` triggers ONLY from the default branch (main); this file must
|
|
# be on main before the cron registers. Use workflow_dispatch to run on demand — it defaults
|
|
# to a DRY RUN (logs only, no PRs); dispatch with "Dry run" cleared to create real PRs.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
dryRun:
|
|
description: 'Dry run (full = log only, no PRs; clear for a live run)'
|
|
type: choice
|
|
options:
|
|
- 'full'
|
|
- ''
|
|
default: 'full'
|
|
logLevel:
|
|
description: 'Log level'
|
|
type: choice
|
|
options:
|
|
- 'info'
|
|
- 'debug'
|
|
default: 'info'
|
|
schedule:
|
|
# Mondays 03:00 UTC — ahead of the 06:00 vulnerability scan
|
|
- cron: '0 3 * * 1'
|
|
|
|
concurrency:
|
|
group: ersatztv-renovate
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
renovate:
|
|
name: Renovate
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: renovate/renovate:43
|
|
steps:
|
|
- name: Run Renovate
|
|
env:
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: http://192.168.1.95:3000/api/v1
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
|
|
RENOVATE_REPOSITORIES: timothy/ersatztv
|
|
RENOVATE_AUTODISCOVER: 'false'
|
|
RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@tblindustries.be>'
|
|
# Let the dockerfile manager query our HTTP-only Gitea container registry for the
|
|
# ersatztv-ffmpeg base image. Creds (reused from the image-push secrets) + insecureRegistry
|
|
# live here, NOT in renovate.json, so they stay out of the committed config.
|
|
RENOVATE_HOST_RULES: '[{"matchHost":"192.168.1.95:3000","hostType":"docker","username":"${{ secrets.REGISTRY_USER }}","password":"${{ secrets.REGISTRY_PASSWORD }}","insecureRegistry":true}]'
|
|
RENOVATE_DRY_RUN: ${{ inputs.dryRun }}
|
|
LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
|
|
run: renovate
|