From 7f0bd5f609d4547d782c46ccb031c1258f0d35e9 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Fri, 18 Sep 2026 19:15:11 +0200 Subject: [PATCH] feat(renovate): add manual run pipeline and sync configs renovate-run workflow_dispatch runs pinned renovate via docker on self-hosted runner. Sync helm-values manager into config.js/configmap, bump compose and validator pins to 44.97.2. --- .gitea/workflows/renovate-ci.yaml | 2 +- .gitea/workflows/renovate-run.yaml | 52 ++++++++++++++++++++++++++++++ renovate/README.md | 15 ++++++++- renovate/config.js | 5 ++- renovate/k8s/configmap.yaml | 10 ++++-- renovate/renovate-compose.yaml | 2 +- 6 files changed, 80 insertions(+), 6 deletions(-) create mode 100644 .gitea/workflows/renovate-run.yaml diff --git a/.gitea/workflows/renovate-ci.yaml b/.gitea/workflows/renovate-ci.yaml index a86f372..b26b053 100644 --- a/.gitea/workflows/renovate-ci.yaml +++ b/.gitea/workflows/renovate-ci.yaml @@ -48,5 +48,5 @@ jobs: docker run --rm \ -v "$PWD:/work" \ -w /work \ - renovate/renovate:44.83.2 \ + renovate/renovate:44.97.2 \ renovate-config-validator renovate.json diff --git a/.gitea/workflows/renovate-run.yaml b/.gitea/workflows/renovate-run.yaml new file mode 100644 index 0000000..4947759 --- /dev/null +++ b/.gitea/workflows/renovate-run.yaml @@ -0,0 +1,52 @@ +name: renovate-run + +on: + workflow_dispatch: + inputs: + repositories: + description: "Repositories to scan (comma-separated)" + required: false + default: "forust/homelab" + log_level: + description: "Renovate log level" + required: false + default: "info" + type: choice + options: + - info + - debug + +concurrency: + group: renovate-run + cancel-in-progress: false + +jobs: + run-renovate: + runs-on: [self-hosted, linux, arch, homelab] + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run Renovate + shell: bash + env: + RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} + RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }} + RENOVATE_REPOSITORIES: ${{ inputs.repositories }} + LOG_LEVEL: ${{ inputs.log_level }} + run: | + set -euo pipefail + + : "${RENOVATE_TOKEN:?missing RENOVATE_TOKEN secret — add a renovate-bot PAT in repo/org Actions secrets}" + + docker run --rm \ + -v "$PWD/renovate/config.js:/opt/renovate/config.js:ro" \ + -e RENOVATE_PLATFORM=gitea \ + -e RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1 \ + -e RENOVATE_TOKEN="$RENOVATE_TOKEN" \ + -e RENOVATE_GITHUB_COM_TOKEN="${RENOVATE_GITHUB_COM_TOKEN:-}" \ + -e RENOVATE_REPOSITORIES="${RENOVATE_REPOSITORIES:-forust/homelab}" \ + -e RENOVATE_CONFIG_FILE=/opt/renovate/config.js \ + -e RENOVATE_BASE_DIR=/tmp/renovate \ + -e LOG_LEVEL="${LOG_LEVEL:-info}" \ + renovate/renovate:44.97.2 diff --git a/renovate/README.md b/renovate/README.md index 93741ca..f9c1c50 100644 --- a/renovate/README.md +++ b/renovate/README.md @@ -24,12 +24,25 @@ The `renovate/k8s/active` marker makes the normal deployment workflow include the namespace, ConfigMap, and CronJob. The Secret is intentionally excluded from Git and must be applied separately after every new cluster. -Run it immediately instead of waiting for the six-hour schedule: +Run it immediately instead of waiting for the six-hour schedule. + +Two options, both use the same `renovate/config.js`: ```sh kubectl create job --from=cronjob/renovate renovate-manual-$(date +%s) -n renovate ``` +or the `renovate-run` Actions workflow (Actions tab → `renovate-run` → +Run workflow). It runs `renovate/renovate:44.97.2` on the self-hosted +runner via Docker. Required Actions secrets (repo or org settings): + +- `RENOVATE_TOKEN` — renovate-bot PAT (repository + issue read/write). +- `RENOVATE_GITHUB_COM_TOKEN` — optional, for changelogs and GitHub rate limits. + +Inputs: `repositories` (default `forust/homelab`), `log_level` +(`info`/`debug`). Only one run at a time (concurrency group +`renovate-run`), same as the CronJob `Forbid` policy. + Inspect runs with: ```sh diff --git a/renovate/config.js b/renovate/config.js index 7681799..fb01dd9 100644 --- a/renovate/config.js +++ b/renovate/config.js @@ -1,7 +1,10 @@ module.exports = { platform: 'gitea', endpoint: process.env.RENOVATE_ENDPOINT, - enabledManagers: ['docker-compose', 'kubernetes'], + enabledManagers: ['docker-compose', 'kubernetes', 'helm-values'], + 'helm-values': { + managerFilePatterns: ['/k8s/.+values\\.ya?ml$/'], + }, kubernetes: { managerFilePatterns: ['/k8s/.+\\.ya?ml$/'], }, diff --git a/renovate/k8s/configmap.yaml b/renovate/k8s/configmap.yaml index e98fb92..ee8bfcb 100644 --- a/renovate/k8s/configmap.yaml +++ b/renovate/k8s/configmap.yaml @@ -8,7 +8,10 @@ data: module.exports = { platform: 'gitea', endpoint: process.env.RENOVATE_ENDPOINT, - enabledManagers: ['docker-compose', 'kubernetes'], + enabledManagers: ['docker-compose', 'kubernetes', 'helm-values'], + 'helm-values': { + managerFilePatterns: ['/k8s/.+values\\.ya?ml$/'], + }, kubernetes: { managerFilePatterns: ['/k8s/.+\\.ya?ml$/'], }, @@ -22,7 +25,10 @@ data: dependencyDashboard: true, prCreation: 'immediate', labels: ['dependencies', 'automated'], - extends: ['config:recommended', ':dependencyDashboard'], + extends: [ + 'config:recommended', + ':dependencyDashboard', + ], packageRules: [ { description: 'Do not update private homelab images', diff --git a/renovate/renovate-compose.yaml b/renovate/renovate-compose.yaml index 68f92d2..b6700f2 100644 --- a/renovate/renovate-compose.yaml +++ b/renovate/renovate-compose.yaml @@ -1,6 +1,6 @@ services: renovate: - image: renovate/renovate:44.83.2 + image: renovate/renovate:44.97.2 container_name: renovate restart: "no" env_file: