From 35c6ab5e3091698d3fb8e9b192cdf101a41bbaed Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Fri, 13 Nov 2026 00:00:06 +0400
Subject: [PATCH] ci: run Renovate from asxpi/renovate

Renovate now runs from its own repository for every repo, with the
shared rules in its preset. Extend that preset here and keep only what
is specific to this repo (the Ansible var manager, the Paper JRE, the
runner and nix notes); drop the workflow that ran it for iac alone.

Assisted-by: Claude:opus-5-5
---
 .forgejo/workflows/renovate.yaml | 32 ---------------------------
 renovate.json                    | 38 ++++++++++++++++++--------------
 2 files changed, 21 insertions(+), 49 deletions(-)
 delete mode 100644 .forgejo/workflows/renovate.yaml

diff --git a/.forgejo/workflows/renovate.yaml b/.forgejo/workflows/renovate.yaml
deleted file mode 100644
index 8120ac5..0000000
--- a/.forgejo/workflows/renovate.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: renovate
-
-# Opens a PR per available version bump (image tags, restic, ...), with
-# the upstream release notes in the PR body. Configuration: renovate.json.
-#
-# Secrets: RENOVATE_TOKEN (Forgejo token of the renovate-bot user, a
-# collaborator with write access) and GH_COM_TOKEN (read-only github.com
-# token, only for fetching release notes; without it PRs have none).
-
-on:
-  schedule:
-    - cron: "17 5 * * *"
-  workflow_dispatch:
-
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/renovatebot/renovate:44.236.2
-    steps:
-      - name: Run Renovate
-        env:
-          RENOVATE_PLATFORM: forgejo
-          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
-          RENOVATE_REPOSITORIES: asxpi/iac
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
-          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
-          RENOVATE_ONBOARDING: "false"
-          RENOVATE_REQUIRE_CONFIG: required
-          LOG_LEVEL: info
-        run: renovate
diff --git a/renovate.json b/renovate.json
index 0aefbf6..10094d0 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,16 +1,15 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", ":disableDependencyDashboard"],
-  "timezone": "Europe/Helsinki",
-  "labels": ["dependencies"],
-  "prHourlyLimit": 0,
-  "prConcurrentLimit": 10,
-  "commitMessagePrefix": "deps:",
+  "extends": [
+    "local>asxpi/renovate"
+  ],
   "customManagers": [
     {
       "description": "Versions in Ansible vars, marked with a comment: # renovate: datasource=<ds> depName=<name>",
       "customType": "regex",
-      "managerFilePatterns": ["/^ansible/.+\\.ya?ml$/"],
+      "managerFilePatterns": [
+        "/^ansible/.+\\.ya?ml$/"
+      ],
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+[a-z_0-9]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
       ]
@@ -19,23 +18,28 @@
   "packageRules": [
     {
       "description": "Paper needs Java 21; the tag is a floating JRE line",
-      "matchPackageNames": ["eclipse-temurin"],
+      "matchPackageNames": [
+        "eclipse-temurin"
+      ],
       "enabled": false
     },
     {
       "description": "Every job runs this image and a nix-store volume tied to its version",
-      "matchPackageNames": ["nixos/nix"],
-      "prBodyNotes": ["After merging, remove the old `nix-store-<old version>` volume on asxpio-services (see forgejo_runner.yaml)."]
+      "matchPackageNames": [
+        "nixos/nix"
+      ],
+      "prBodyNotes": [
+        "After merging, remove the old `nix-store-<old version>` volume on asxpio-services (see forgejo_runner.yaml)."
+      ]
     },
     {
       "description": "A runner change recreates the runner mid-job",
-      "matchPackageNames": ["code.forgejo.org/forgejo/runner"],
-      "prBodyNotes": ["The deploy job that applies this shows as cancelled; the next run confirms the result."]
-    },
-    {
-      "description": "Renovate itself releases daily; once a month is enough",
-      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
-      "schedule": ["* * 1 * *"]
+      "matchPackageNames": [
+        "code.forgejo.org/forgejo/runner"
+      ],
+      "prBodyNotes": [
+        "The deploy job that applies this shows as cancelled; the next run confirms the result."
+      ]
     }
   ]
 }