edb/renovate-runner
9
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: sign renovate's commits

Browse Source
This commit is contained in:
ponas committed 2026-11-03 17:08:36 +01:00
1 parent 199522c344
commit 514269bc1a
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitea/workflows/renovate.yaml
+3
View File
@@ -19,6 +19,9 @@ jobs:
RENOVATE_ENDPOINT: https://git.neuf.no/api/v1 RENOVATE_ENDPOINT: https://git.neuf.no/api/v1
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no> RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no>
# ed25519 key; its public half is on the renovate account. Gitea shows a commit as
# verified only if the author email is a verified email on that account.
RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
# Every edb repository the renovate account can write to # Every edb repository the renovate account can write to
RENOVATE_AUTODISCOVER: "true" RENOVATE_AUTODISCOVER: "true"
RENOVATE_AUTODISCOVER_FILTER: edb/* RENOVATE_AUTODISCOVER_FILTER: edb/*
README.md
+3
View File
@@ -11,6 +11,9 @@ has one. Each repository's `renovate.json` decides what is updated and when.
- `RENOVATE_TOKEN`: a Gitea token with the scopes `write:repository`, `write:issue`, - `RENOVATE_TOKEN`: a Gitea token with the scopes `write:repository`, `write:issue`,
`read:user` and `read:organization`. `read:user` and `read:organization`.
- `RENOVATE_GIT_PRIVATE_KEY`: an ed25519 SSH key without a passphrase, which signs Renovate's commits. Its public key
is on the renovate account, which has `renovate@neuf.no` as a verified email. Merge with "Fast-forward only" to keep
the signed commit on the default branch.
- `RENOVATE_GITHUB_COM_TOKEN`: a GitHub token with read-only access to public repositories. Without it Renovate hits - `RENOVATE_GITHUB_COM_TOKEN`: a GitHub token with read-only access to public repositories. Without it Renovate hits
GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes. GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.