24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
# renovate-runner
|
|
|
|
Runs [Renovate](https://docs.renovatebot.com) on edb's repositories on git.neuf.no, daily around 17:00, from
|
|
`.gitea/workflows/renovate.yaml`.
|
|
|
|
Renovate finds repositories by autodiscovery: every repository in `edb` it can write to. To add a repository, give
|
|
Renovate write access to it. Renovate then opens an onboarding PR with a `renovate.json`, unless the repository already
|
|
has one. Each repository's `renovate.json` decides what is updated and when.
|
|
|
|
## Secrets
|
|
|
|
- `RENOVATE_TOKEN`: a Gitea token with the scopes `write:repository`, `write:issue`,
|
|
`read:user` and `read:organization`.
|
|
- `RENOVATE_GIT_PRIVATE_KEY`: an ed25519 SSH key without a passphrase, which signs Renovate's commits. Its public key
|
|
is on the renovate account, which has `renovate@neuf.no` as a verified email. Merge with "Fast-forward only" to keep
|
|
the signed commit on the default branch.
|
|
- `RENOVATE_GITHUB_COM_TOKEN`: a GitHub token with read-only access to public repositories. Without it Renovate hits
|
|
GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.
|
|
|
|
## Running it now
|
|
|
|
Actions → Renovate → Run workflow. A run also processes the checkboxes ticked on a repository's Dependency
|
|
Dashboard issue.
|