From b5367327d8aef7bb59e7572c4b2c95f2977bcbf0 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 12 Nov 2026 23:59:51 +0400
Subject: [PATCH] Renovate for all repos, with a shared preset

Renovate ran from the iac repo for iac only. Run it from here for every
repo that should get version bump PRs, with the rules they share in
default.json (local>asxpi/renovate): bundler held at nixpkgs' 2.7.2,
Postgres majors flagged as migrations, action bumps grouped.

Repos without a renovate.json get an onboarding PR first, so nothing
changes in a repo until its config is merged.

Assisted-by: Claude:opus-5-5
---
 .forgejo/workflows/renovate.yaml | 36 +++++++++++++++++++++++++++++
 README.md                        | 18 +++++++++++++++
 default.json                     | 39 ++++++++++++++++++++++++++++++++
 3 files changed, 93 insertions(+)
 create mode 100644 .forgejo/workflows/renovate.yaml
 create mode 100644 README.md
 create mode 100644 default.json

diff --git a/.forgejo/workflows/renovate.yaml b/.forgejo/workflows/renovate.yaml
new file mode 100644
index 0000000..dfdaf53
--- /dev/null
+++ b/.forgejo/workflows/renovate.yaml
@@ -0,0 +1,36 @@
+name: renovate
+
+# One Renovate run for every repo listed below. A repo without a
+# renovate.json first gets a "Configure Renovate" PR (extending
+# local>asxpi/renovate); nothing else happens there until it is merged.
+#
+# Secrets: RENOVATE_TOKEN (renovate-bot, which needs Write access to each
+# repo) and GH_COM_TOKEN (read-only github.com token, for release notes).
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44.236.2
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
+          RENOVATE_REPOSITORIES: >-
+            ["asxpi/iac", "asxpi/asxpio", "asxpi/datacenterbingo",
+             "asxpi/storage", "asxpi/blog", "czsk/czsk",
+             "asxpi/veryhighpriestbot"]
+          RENOVATE_ONBOARDING: "true"
+          RENOVATE_ONBOARDING_CONFIG: '{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["local>asxpi/renovate"]}'
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info
+        run: renovate
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a04c9ff
--- /dev/null
+++ b/README.md
@@ -0,0 +1,18 @@
+# renovate
+
+Runs [Renovate](https://docs.renovatebot.com/) daily (05:17 UTC) for the
+repos in `.forgejo/workflows/renovate.yaml`, as the `renovate-bot` user:
+one PR per version bump, with release notes.
+
+- **Adding a repo:** add it to `RENOVATE_REPOSITORIES` and give
+  `renovate-bot` Write access. Its first PR is "Configure Renovate",
+  which adds a `renovate.json` extending this repo's preset; merge it
+  to start getting bumps.
+- **Shared rules:** `default.json`, used as `local>asxpi/renovate`:
+  `deps:` commit prefix, no dependency dashboard, bundler pinned to
+  2.7.2 (nixpkgs' version), Postgres majors flagged as migrations,
+  action bumps grouped, Renovate itself monthly.
+- **Secrets:** `RENOVATE_TOKEN` (renovate-bot's token) and
+  `GH_COM_TOKEN` (read-only github.com token for release notes).
+- **Run now:** Actions → renovate → Run workflow, or
+  `fj -H git.asxp.io actions dispatch -r asxpi/renovate renovate.yaml main`.
diff --git a/default.json b/default.json
new file mode 100644
index 0000000..089dc18
--- /dev/null
+++ b/default.json
@@ -0,0 +1,39 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Shared Renovate rules for asxpi/* and czsk/* (extend with local>asxpi/renovate)",
+  "extends": ["config:recommended", ":disableDependencyDashboard"],
+  "timezone": "Europe/Helsinki",
+  "labels": ["dependencies"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 10,
+  "commitMessagePrefix": "deps:",
+  "constraints": {
+    "bundler": "2.7.2"
+  },
+  "packageRules": [
+    {
+      "description": "Keep lock files on the bundler nixpkgs ships (BUNDLED WITH 2.7.2); a newer one makes CI install no gems",
+      "matchManagers": ["bundler"],
+      "matchPackageNames": ["bundler"],
+      "enabled": false
+    },
+    {
+      "description": "Postgres majors need a dump and restore: open the PR, never let it look routine",
+      "matchPackageNames": ["postgres", "docker.io/library/postgres"],
+      "matchUpdateTypes": ["major"],
+      "labels": ["dependencies", "needs-migration"],
+      "prBodyNotes": ["A Postgres major upgrade needs pg_dumpall + restore into a fresh volume (see storage/README.md). Do not merge as a routine bump."]
+    },
+    {
+      "description": "Group the patch and minor bumps of a repo's GitHub/Forgejo actions",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "CI actions"
+    },
+    {
+      "description": "Renovate itself releases daily; once a month is enough",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "schedule": ["* * 1 * *"]
+    }
+  ]
+}