cesnimda
b31758e23d
CI / backend (pull_request) Successful in 54s
CI / frontend (pull_request) Successful in 16s
CI / format (pull_request) Successful in 56s
CI / db-tests (pull_request) Successful in 52s
Security / secrets (pull_request) Successful in 4s
Security / dependencies (pull_request) Successful in 58s
Weekly Renovate run against this Gitea instance: grouped minor/patch PRs per ecosystem, individually-reviewed majors (dashboard approval), immediate security-alert PRs. All update PRs ride the existing required CI gates (build/tests/gitleaks/vuln/live-db/format), so merging one is as safe as any other PR. ONE MANUAL STEP remains: create a Gitea PAT (repo rw, user r, issue rw, org r) and add it as the RENOVATE_TOKEN Actions secret — the workflow fails fast with instructions until then. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
name: Renovate
|
|
|
|
# RECOMMENDATIONS #2: automated dependency-update PRs (NuGet, npm, Dockerfiles, Actions)
|
|
# that ride the existing required CI gates. Runs weekly + on demand.
|
|
#
|
|
# ONE-TIME SETUP (manual): create a Gitea personal access token with scopes
|
|
# repo (rw) + user (r) + issue (rw) + organization (r), and add it as the Actions
|
|
# secret RENOVATE_TOKEN (repo Settings -> Actions -> Secrets). Without the secret this
|
|
# workflow fails fast with a clear message. See https://docs.renovatebot.com/modules/platform/gitea/
|
|
on:
|
|
schedule:
|
|
- cron: '30 4 * * 1' # Mondays 04:30 UTC
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Require RENOVATE_TOKEN
|
|
run: |
|
|
if [ -z "${{ secrets.RENOVATE_TOKEN }}" ]; then
|
|
echo "RENOVATE_TOKEN secret is not set — see the comment at the top of this workflow." >&2
|
|
exit 1
|
|
fi
|
|
- name: Run Renovate
|
|
uses: https://github.com/renovatebot/github-action@v40.3.6
|
|
with:
|
|
token: ${{ secrets.RENOVATE_TOKEN }}
|
|
env:
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://git.cesnimda.uk/api/v1
|
|
RENOVATE_REPOSITORIES: cesnimda/Inboxintel
|
|
RENOVATE_ONBOARDING: "false"
|
|
RENOVATE_REQUIRE_CONFIG: optional
|
|
LOG_LEVEL: info
|