From 2aca0d7669686619c17c8f80e0b7e0e563963e1b Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Thu, 12 Nov 2026 21:20:47 +0400 Subject: [PATCH] ci: Renovate opens version bump PRs with release notes Versions are pinned across the Ansible vars, compose files, Terraform providers and workflows, and nothing says when one is behind. Run Renovate daily from Forgejo Actions: one PR per available bump, with the upstream changelog in the body, which the deploy pipeline then dry-runs like any other branch. Variables are tracked through a "# renovate: datasource=... depName=..." comment above them; Forgejo, Traefik, the runner and its nix image get one here. The Paper JRE tag is left alone, the runner and nix bumps carry their manual follow-up steps in the PR, and Renovate's own image is bumped monthly. Needs the repository secrets RENOVATE_TOKEN (bot user with write access) and GH_COM_TOKEN (read-only github.com token for release notes). Assisted-by: Claude:opus-5-5 --- .forgejo/workflows/renovate.yaml | 32 +++++++++++++++ .../group_vars/ops_servers/forgejo.yaml | 1 + .../group_vars/ops_servers/traefik.yaml | 1 + .../services_servers/forgejo_runner.yaml | 2 + renovate.json | 41 +++++++++++++++++++ 5 files changed, 77 insertions(+) create mode 100644 .forgejo/workflows/renovate.yaml create mode 100644 renovate.json diff --git a/.forgejo/workflows/renovate.yaml b/.forgejo/workflows/renovate.yaml new file mode 100644 index 0000000..bba8440 --- /dev/null +++ b/.forgejo/workflows/renovate.yaml @@ -0,0 +1,32 @@ +name: renovate + +# Opens a PR per available version bump (image tags, restic, ...), with +# the upstream release notes in the PR body. Configuration: renovate.json. +# +# Secrets: RENOVATE_TOKEN (Forgejo token of the renovate-bot user, a +# collaborator with write access) and GH_COM_TOKEN (read-only github.com +# token, only for fetching release notes; without it PRs have none). + +on: + schedule: + - cron: "17 5 * * *" + workflow_dispatch: + +jobs: + renovate: + runs-on: ubuntu-latest + container: + image: ghcr.io/renovatebot/renovate:44.236.2 + steps: + - name: Run Renovate + env: + RENOVATE_PLATFORM: forgejo + RENOVATE_ENDPOINT: https://git.asxp.io/api/v1 + RENOVATE_REPOSITORIES: asxpi/infrastructure + RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} + RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }} + RENOVATE_GIT_AUTHOR: "Renovate Bot " + RENOVATE_ONBOARDING: "false" + RENOVATE_REQUIRE_CONFIG: required + LOG_LEVEL: info + run: renovate diff --git a/ansible/inventory/group_vars/ops_servers/forgejo.yaml b/ansible/inventory/group_vars/ops_servers/forgejo.yaml index c8ef54d..be09d67 100644 --- a/ansible/inventory/group_vars/ops_servers/forgejo.yaml +++ b/ansible/inventory/group_vars/ops_servers/forgejo.yaml @@ -1,4 +1,5 @@ --- +# renovate: datasource=docker depName=codeberg.org/forgejo/forgejo forgejo_version: "15.0.11" # The instance answers on every name below. forgejo_domain is the diff --git a/ansible/inventory/group_vars/ops_servers/traefik.yaml b/ansible/inventory/group_vars/ops_servers/traefik.yaml index ce8f47c..0a55c8b 100644 --- a/ansible/inventory/group_vars/ops_servers/traefik.yaml +++ b/ansible/inventory/group_vars/ops_servers/traefik.yaml @@ -1,4 +1,5 @@ --- +# renovate: datasource=docker depName=traefik traefik_version: "v3.7.18" traefik_base_path: "{{ services_base_path }}/traefik" traefik_dashboard_port: 8080 diff --git a/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml b/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml index 93b47c4..a4f5315 100644 --- a/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml +++ b/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml @@ -2,6 +2,7 @@ # Forgejo Runner (CI/CD) configuration # Runner version and settings +# renovate: datasource=docker depName=code.forgejo.org/forgejo/runner forgejo_runner_version: "11" forgejo_runner_capacity: 4 forgejo_runner_timeout: 3h @@ -10,6 +11,7 @@ forgejo_runner_timeout: 3h # /nix, seeded from this image on first use; the image's /bin/sh and # /etc/nix/nix.conf link into that store, so a volume from another # version breaks them. Bumping this also switches to a fresh volume. +# renovate: datasource=docker depName=nixos/nix forgejo_runner_nix_version: "2.35.3" forgejo_runner_token: "{{ vault_forgejo_runner_token }}" diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..0aefbf6 --- /dev/null +++ b/renovate.json @@ -0,0 +1,41 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:recommended", ":disableDependencyDashboard"], + "timezone": "Europe/Helsinki", + "labels": ["dependencies"], + "prHourlyLimit": 0, + "prConcurrentLimit": 10, + "commitMessagePrefix": "deps:", + "customManagers": [ + { + "description": "Versions in Ansible vars, marked with a comment: # renovate: datasource= depName=", + "customType": "regex", + "managerFilePatterns": ["/^ansible/.+\\.ya?ml$/"], + "matchStrings": [ + "# renovate: datasource=(?\\S+) depName=(?\\S+)\\s+[a-z_0-9]+:\\s*\"?(?[^\"\\s]+)\"?" + ] + } + ], + "packageRules": [ + { + "description": "Paper needs Java 21; the tag is a floating JRE line", + "matchPackageNames": ["eclipse-temurin"], + "enabled": false + }, + { + "description": "Every job runs this image and a nix-store volume tied to its version", + "matchPackageNames": ["nixos/nix"], + "prBodyNotes": ["After merging, remove the old `nix-store-` volume on asxpio-services (see forgejo_runner.yaml)."] + }, + { + "description": "A runner change recreates the runner mid-job", + "matchPackageNames": ["code.forgejo.org/forgejo/runner"], + "prBodyNotes": ["The deploy job that applies this shows as cancelled; the next run confirms the result."] + }, + { + "description": "Renovate itself releases daily; once a month is enough", + "matchPackageNames": ["ghcr.io/renovatebot/renovate"], + "schedule": ["* * 1 * *"] + } + ] +}