Renovate for all repos, with a shared preset

Renovate ran from the iac repo for iac only. Run it from here for every
repo that should get version bump PRs, with the rules they share in
default.json (local>asxpi/renovate): bundler held at nixpkgs' 2.7.2,
Postgres majors flagged as migrations, action bumps grouped.

Repos without a renovate.json get an onboarding PR first, so nothing
changes in a repo until its config is merged.

Assisted-by: Claude:opus-5-5

.forgejo/workflows/renovate.yaml

@@ -0,0 +1,36 @@
+name: renovate
+
+# One Renovate run for every repo listed below. A repo without a
+# renovate.json first gets a "Configure Renovate" PR (extending
+# local>asxpi/renovate); nothing else happens there until it is merged.
+#
+# Secrets: RENOVATE_TOKEN (renovate-bot, which needs Write access to each
+# repo) and GH_COM_TOKEN (read-only github.com token, for release notes).
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44.236.2
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
+          RENOVATE_REPOSITORIES: >-
+            ["asxpi/iac", "asxpi/asxpio", "asxpi/datacenterbingo",
+             "asxpi/storage", "asxpi/blog", "czsk/czsk",
+             "asxpi/veryhighpriestbot"]
+          RENOVATE_ONBOARDING: "true"
+          RENOVATE_ONBOARDING_CONFIG: '{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["local>asxpi/renovate"]}'
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info
+        run: renovate

README.md

@@ -0,0 +1,18 @@
+# renovate
+
+Runs [Renovate](https://docs.renovatebot.com/) daily (05:17 UTC) for the
+repos in `.forgejo/workflows/renovate.yaml`, as the `renovate-bot` user:
+one PR per version bump, with release notes.
+
+- **Adding a repo:** add it to `RENOVATE_REPOSITORIES` and give
+  `renovate-bot` Write access. Its first PR is "Configure Renovate",
+  which adds a `renovate.json` extending this repo's preset; merge it
+  to start getting bumps.
+- **Shared rules:** `default.json`, used as `local>asxpi/renovate`:
+  `deps:` commit prefix, no dependency dashboard, bundler pinned to
+  2.7.2 (nixpkgs' version), Postgres majors flagged as migrations,
+  action bumps grouped, Renovate itself monthly.
+- **Secrets:** `RENOVATE_TOKEN` (renovate-bot's token) and
+  `GH_COM_TOKEN` (read-only github.com token for release notes).
+- **Run now:** Actions → renovate → Run workflow, or
+  `fj -H git.asxp.io actions dispatch -r asxpi/renovate renovate.yaml main`.

default.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Shared Renovate rules for asxpi/* and czsk/* (extend with local>asxpi/renovate)",
+  "extends": ["config:recommended", ":disableDependencyDashboard"],
+  "timezone": "Europe/Helsinki",
+  "labels": ["dependencies"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 10,
+  "commitMessagePrefix": "deps:",
+  "constraints": {
+    "bundler": "2.7.2"
+  },
+  "packageRules": [
+    {
+      "description": "Keep lock files on the bundler nixpkgs ships (BUNDLED WITH 2.7.2); a newer one makes CI install no gems",
+      "matchManagers": ["bundler"],
+      "matchPackageNames": ["bundler"],
+      "enabled": false
+    },
+    {
+      "description": "Postgres majors need a dump and restore: open the PR, never let it look routine",
+      "matchPackageNames": ["postgres", "docker.io/library/postgres"],
+      "matchUpdateTypes": ["major"],
+      "labels": ["dependencies", "needs-migration"],
+      "prBodyNotes": ["A Postgres major upgrade needs pg_dumpall + restore into a fresh volume (see storage/README.md). Do not merge as a routine bump."]
+    },
+    {
+      "description": "Group the patch and minor bumps of a repo's GitHub/Forgejo actions",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "CI actions"
+    },
+    {
+      "description": "Renovate itself releases daily; once a month is enough",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "schedule": ["* * 1 * *"]
+    }
+  ]
+}