ci: run renovate from gitea actions with autodiscovery

.gitea/workflows/renovate.yaml

@@ -0,0 +1,27 @@
+name: Renovate
+
+on:
+  schedule:
+    # UTC. Each repository's renovate.json decides when PRs open; daily runs pick up
+    # updates approved on its dependency dashboard.
+    - cron: "17 2 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:44
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: https://git.neuf.no/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no>
+          # Every edb repository the renovate account can write to
+          RENOVATE_AUTODISCOVER: "true"
+          RENOVATE_AUTODISCOVER_FILTER: edb/*
+          # Raises the GitHub API rate limit for release notes and github-tags lookups
+          GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
+          LOG_LEVEL: info
+        run: renovate

.gitlab-ci.yml

@@ -1,11 +0,0 @@
-variables:
-  RENOVATE_EXTRA_FLAGS: edb/galtinn
-  LOG_LEVEL: debug
-
-include:
-    - remote: https://gitlab.com/renovate-bot/renovate-runner/-/raw/v17.171.0/templates/renovate.gitlab-ci.yml
-
-renovate:
-    rules:
-        - if: '$CI_PIPELINE_SOURCE == "schedule"'
-        - if: '$CI_PIPELINE_SOURCE == "push"'

README.md

@@ -1,5 +1,20 @@
 # renovate-runner
 
-Run [renovate](https://github.com/renovatebot/renovate) to keep dependencies up to date automatically.
+Runs [Renovate](https://docs.renovatebot.com) on edb's repositories on git.neuf.no, daily from
+`.gitea/workflows/renovate.yaml`.
 
-Read more on [gitlab.com/renovate-bot/renovate-runner/](https://gitlab.com/renovate-bot/renovate-runner/).
+Renovate finds repositories by autodiscovery: every repository in `edb` it can write to. To add a repository, give
+Renovate write access to it. Renovate then opens an onboarding PR with a `renovate.json`, unless the repository already
+has one. Each repository's `renovate.json` decides what is updated and when.
+
+## Secrets
+
+- `RENOVATE_TOKEN`: a Gitea token with the scopes `write:repository`, `write:issue`,
+  `read:user` and `read:organization`.
+- `RENOVATE_GITHUB_COM_TOKEN`: a GitHub token with read-only access to public repositories. Without it Renovate hits
+  GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.
+
+## Running it now
+
+Actions → Renovate → Run workflow. A run also processes the checkboxes ticked on a repository's Dependency
+Dashboard issue.