2.9 KiB
name: Renovate
Self-hosted Renovate for the ErsatzTV fork (server-management#484).
Opens dependency-update PRs against this repo (managers: nuget via CPM, github-actions).
Runs on the shared Gitea act_runner (bumblebee). It supersedes the proposing half that
the dependency-scan.yml (ersatztv#14) deliberately left out — that scan stays as a cheap
in-repo detector for now.
Config: repo-root renovate.json (package rules, grouping, automerge policy).
Bot identity + tokens are injected from repo Actions secrets:
RENOVATE_TOKEN — PAT of the dedicated renovate Gitea bot (write:repository,
read:user, write:issue, read:organization)
GH_COM_TOKEN — no-scope github.com PAT for changelog/release-note fetching
(Renovate needs this on non-GitHub platforms; optional, degrades
gracefully to anonymous if unset). Named GH_, not GITHUB_, because
Gitea reserves the GITHUB_ secret-name prefix.
NOTE: Gitea runs schedule triggers ONLY from the default branch (main); this file must
be on main before the cron registers. Use workflow_dispatch to run on demand — it defaults
to a DRY RUN (logs only, no PRs); dispatch with "Dry run" cleared to create real PRs.
on: workflow_dispatch: inputs: dryRun: description: 'Dry run (full = log only, no PRs; clear for a live run)' type: choice options: - 'full' - '' default: 'full' logLevel: description: 'Log level' type: choice options: - 'info' - 'debug' default: 'info' schedule: # Mondays 03:00 UTC — ahead of the 06:00 vulnerability scan - cron: '0 3 * * 1'
concurrency: group: ersatztv-renovate cancel-in-progress: false
jobs: renovate: name: Renovate runs-on: ubuntu-latest container: image: renovate/renovate:43 steps: - name: Run Renovate env: RENOVATE_PLATFORM: gitea RENOVATE_ENDPOINT: http://192.168.1.95:3000/api/v1 RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }} RENOVATE_REPOSITORIES: timothy/ersatztv RENOVATE_AUTODISCOVER: 'false' RENOVATE_GIT_AUTHOR: 'Renovate Bot renovate@tblindustries.be' # Let the dockerfile manager query our HTTP-only Gitea container registry for the # ersatztv-ffmpeg base image. Creds (reused from the image-push secrets) + insecureRegistry # live here, NOT in renovate.json, so they stay out of the committed config. RENOVATE_HOST_RULES: '[{"matchHost":"192.168.1.95:3000","hostType":"docker","username":"${{ secrets.REGISTRY_USER }}","password":"${{ secrets.REGISTRY_PASSWORD }}","insecureRegistry":true}]' RENOVATE_DRY_RUN: ${{ inputs.dryRun }} LOG_LEVEL: ${{ inputs.logLevel || 'info' }} run: renovate