fix(ci): skip heavy jobs on renovate branches, automerge digest and patch

Renovate branches only carry version/digest bumps, so scan-deps, test-backend, test-frontend and build just burn runner time on the box that also serves prod. Static checks and validate still run. Digest and patch updates automerge (playwright, helm and major rules below still override to no-automerge). Also replaces deprecated helm --atomic with --wait --rollback-on-failure.

.gitea/workflows/ci.yaml

@@ -221,6 +221,10 @@ jobs:
   # Deleting an entry here is how you accept a new advisory, so the diff says
   # so out loud.
   scan-deps:
+    # Renovate branches only ever carry version/digest bumps: nothing here can
+    # change the shipped dependency tree, so the audits would just burn runner
+    # time on the same box that serves prod. Static checks still run.
+    if: ${{ !startsWith(github.head_ref, 'renovate/') && !startsWith(github.ref_name, 'renovate/') }}
     runs-on: [self-hosted, linux, arch, homelab]
     timeout-minutes: 15
     steps:
@@ -268,6 +272,8 @@ jobs:
           npm audit --omit=dev --audit-level=high
 
   test-backend:
+    # Same as scan-deps: renovate bumps cannot break panel tests.
+    if: ${{ !startsWith(github.head_ref, 'renovate/') && !startsWith(github.ref_name, 'renovate/') }}
     runs-on: [self-hosted, linux, arch, homelab]
     timeout-minutes: 15
     steps:
@@ -313,6 +319,8 @@ jobs:
           "$venv/bin/python" -m pytest tests/ -q
 
   test-frontend:
+    # Same as scan-deps: renovate bumps cannot break panel tests.
+    if: ${{ !startsWith(github.head_ref, 'renovate/') && !startsWith(github.ref_name, 'renovate/') }}
     runs-on: [self-hosted, linux, arch, homelab]
     timeout-minutes: 15
     steps:
@@ -482,7 +490,7 @@ jobs:
         test-frontend,
         validate,
       ]
-    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
+    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev') && !startsWith(github.ref_name, 'renovate/')
     runs-on: [self-hosted, linux, arch, homelab]
     timeout-minutes: 60
     outputs: