renovate-runner
Runs Renovate on edb's repositories on git.neuf.no, daily around 17:00, from
.gitea/workflows/renovate.yaml.
Renovate finds repositories by autodiscovery: every repository in edb it can write to. To add a repository, give
Renovate write access to it. Renovate then opens an onboarding PR with a renovate.json, unless the repository already
has one. Each repository's renovate.json decides what is updated and when.
Secrets
RENOVATE_TOKEN: a Gitea token with the scopeswrite:repository,write:issue,read:userandread:organization.RENOVATE_GIT_PRIVATE_KEY: an ed25519 SSH key without a passphrase, which signs Renovate's commits. Its public key is on the renovate account, which hasrenovate@neuf.noas a verified email. Merge with "Fast-forward only" to keep the signed commit on the default branch.RENOVATE_GITHUB_COM_TOKEN: a GitHub token with read-only access to public repositories. Without it Renovate hits GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.
Running it now
Actions → Renovate → Run workflow. A run also processes the checkboxes ticked on a repository's Dependency Dashboard issue.