renovate-runner/README.md

renovate-runner

Runs Renovate on edb's repositories on git.neuf.no, daily around 17:00, from .gitea/workflows/renovate.yaml.

Renovate finds repositories by autodiscovery: every repository in edb it can write to. To add a repository, give Renovate write access to it. Renovate then opens an onboarding PR with a renovate.json, unless the repository already has one. Each repository's renovate.json decides what is updated and when.

Secrets

• RENOVATE_TOKEN: a Gitea token with the scopes write:repository, write:issue, read:user and read:organization.
• RENOVATE_GIT_PRIVATE_KEY: an ed25519 SSH key without a passphrase, which signs Renovate's commits. Its public key is on the renovate account, which has renovate@neuf.no as a verified email. Merge with "Fast-forward only" to keep the signed commit on the default branch.
• RENOVATE_GITHUB_COM_TOKEN: a GitHub token with read-only access to public repositories. Without it Renovate hits GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.

Running it now

Actions → Renovate → Run workflow. A run also processes the checkboxes ticked on a repository's Dependency Dashboard issue.