ci: sign renovate's commits

.gitea/workflows/renovate.yaml

@@ -19,6 +19,9 @@ jobs:
           RENOVATE_ENDPOINT: https://git.neuf.no/api/v1
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no>
+          # ed25519 key; its public half is on the renovate account. Gitea shows a commit as
+          # verified only if the author email is a verified email on that account.
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           # Every edb repository the renovate account can write to
           RENOVATE_AUTODISCOVER: "true"
           RENOVATE_AUTODISCOVER_FILTER: edb/*

README.md

@@ -11,6 +11,9 @@ has one. Each repository's `renovate.json` decides what is updated and when.
 
 - `RENOVATE_TOKEN`: a Gitea token with the scopes `write:repository`, `write:issue`,
   `read:user` and `read:organization`.
+- `RENOVATE_GIT_PRIVATE_KEY`: an ed25519 SSH key without a passphrase, which signs Renovate's commits. Its public key
+  is on the renovate account, which has `renovate@neuf.no` as a verified email. Merge with "Fast-forward only" to keep
+  the signed commit on the default branch.
 - `RENOVATE_GITHUB_COM_TOKEN`: a GitHub token with read-only access to public repositories. Without it Renovate hits
   GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.