ci: Renovate opens version bump PRs with release notes

Versions are pinned across the Ansible vars, compose files, Terraform
providers and workflows, and nothing says when one is behind. Run
Renovate daily from Forgejo Actions: one PR per available bump, with
the upstream changelog in the body, which the deploy pipeline then
dry-runs like any other branch.

Variables are tracked through a "# renovate: datasource=... depName=..."
comment above them; Forgejo, Traefik, the runner and its nix image get
one here. The Paper JRE tag is left alone, the runner and nix bumps
carry their manual follow-up steps in the PR, and Renovate's own image
is bumped monthly.

Needs the repository secrets RENOVATE_TOKEN (bot user with write
access) and GH_COM_TOKEN (read-only github.com token for release
notes).

Assisted-by: Claude:opus-5-5

.forgejo/workflows/renovate.yaml

@@ -0,0 +1,32 @@
+name: renovate
+
+# Opens a PR per available version bump (image tags, restic, ...), with
+# the upstream release notes in the PR body. Configuration: renovate.json.
+#
+# Secrets: RENOVATE_TOKEN (Forgejo token of the renovate-bot user, a
+# collaborator with write access) and GH_COM_TOKEN (read-only github.com
+# token, only for fetching release notes; without it PRs have none).
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44.236.2
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
+          RENOVATE_REPOSITORIES: asxpi/infrastructure
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
+          RENOVATE_ONBOARDING: "false"
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info
+        run: renovate

ansible/inventory/group_vars/ops_servers/forgejo.yaml

@@ -1,4 +1,5 @@
 ---
+# renovate: datasource=docker depName=codeberg.org/forgejo/forgejo
 forgejo_version: "15.0.11"
 
 # The instance answers on every name below. forgejo_domain is the

ansible/inventory/group_vars/ops_servers/traefik.yaml

@@ -1,4 +1,5 @@
 ---
+# renovate: datasource=docker depName=traefik
 traefik_version: "v3.7.18"
 traefik_base_path: "{{ services_base_path }}/traefik"
 traefik_dashboard_port: 8080

ansible/inventory/group_vars/services_servers/forgejo_runner.yaml

@@ -2,6 +2,7 @@
 # Forgejo Runner (CI/CD) configuration
 
 # Runner version and settings
+# renovate: datasource=docker depName=code.forgejo.org/forgejo/runner
 forgejo_runner_version: "11"
 forgejo_runner_capacity: 4
 forgejo_runner_timeout: 3h
@@ -10,6 +11,7 @@ forgejo_runner_timeout: 3h
 # /nix, seeded from this image on first use; the image's /bin/sh and
 # /etc/nix/nix.conf link into that store, so a volume from another
 # version breaks them. Bumping this also switches to a fresh volume.
+# renovate: datasource=docker depName=nixos/nix
 forgejo_runner_nix_version: "2.35.3"
 forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
 

renovate.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", ":disableDependencyDashboard"],
+  "timezone": "Europe/Helsinki",
+  "labels": ["dependencies"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 10,
+  "commitMessagePrefix": "deps:",
+  "customManagers": [
+    {
+      "description": "Versions in Ansible vars, marked with a comment: # renovate: datasource=<ds> depName=<name>",
+      "customType": "regex",
+      "managerFilePatterns": ["/^ansible/.+\\.ya?ml$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+[a-z_0-9]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
+      ]
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Paper needs Java 21; the tag is a floating JRE line",
+      "matchPackageNames": ["eclipse-temurin"],
+      "enabled": false
+    },
+    {
+      "description": "Every job runs this image and a nix-store volume tied to its version",
+      "matchPackageNames": ["nixos/nix"],
+      "prBodyNotes": ["After merging, remove the old `nix-store-<old version>` volume on asxpio-services (see forgejo_runner.yaml)."]
+    },
+    {
+      "description": "A runner change recreates the runner mid-job",
+      "matchPackageNames": ["code.forgejo.org/forgejo/runner"],
+      "prBodyNotes": ["The deploy job that applies this shows as cancelled; the next run confirms the result."]
+    },
+    {
+      "description": "Renovate itself releases daily; once a month is enough",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "schedule": ["* * 1 * *"]
+    }
+  ]
+}