The repository was renamed from infrastructure to iac. Renovate looks
repositories up by name, and with push-to-create on, the old name now
belongs to a different, empty repository.
Assisted-by: Claude:opus-5-5
Versions are pinned across the Ansible vars, compose files, Terraform
providers and workflows, and nothing says when one is behind. Run
Renovate daily from Forgejo Actions: one PR per available bump, with
the upstream changelog in the body, which the deploy pipeline then
dry-runs like any other branch.
Variables are tracked through a "# renovate: datasource=... depName=..."
comment above them; Forgejo, Traefik, the runner and its nix image get
one here. The Paper JRE tag is left alone, the runner and nix bumps
carry their manual follow-up steps in the PR, and Renovate's own image
is bumped monthly.
Needs the repository secrets RENOVATE_TOKEN (bot user with write
access) and GH_COM_TOKEN (read-only github.com token for release
notes).
Assisted-by: Claude:opus-5-5
