feat(renovate): add a Renovate bot on Forgejo Actions

hutao commented

2026-09-12 15:57:56 +00:00

Owner

Weekly cron over every repo under hutao and skavex, opening dependency
pull requests on git.hu-tao.dev. It covers three things the tree updates
by hand today: flake inputs, flake.lock, and the container image tags in
modules/containers.

runs-on: nix rather than ghcr.io/renovatebot/renovate. Renovate does not
edit flake.lock itself, it shells out to nix flake update, and
containerbase ships no nix — on the official image every container tag
would update while every flake input silently stopped. The nix label
already exists for ci.yml, and Renovate comes from a .#renovate dev
shell instead, which pins it in flake.lock and so lets
lockFileMaintenance update Renovate itself.

The dev shell is separate from .#ci deliberately: ci runs on every push
and every pull request, and an entry there would make all of them
download Renovate's closure for a job that never calls it.

Config is json5, not json — Renovate's validator rejects unknown keys,
so JSON has nowhere to put the reasoning. The split between the two
files is by scope: the workflow holds instance-wide settings, and
renovate.json5 is this repo's own config, read from the clone Renovate
makes like any other repo's would be.

No RENOVATE_GIT_AUTHOR. Renovate takes the value from the token's own
account, and it decides "did a human edit my branch?" by comparing
commit authors against it — an override that disagrees with the account
makes Renovate read its own commits as someone else's and stop updating
the branch.

The token is a Forgejo Actions secret rather than a sops one: sops-nix
decrypts onto the host, and this runs in a job container that cannot
read the host filesystem. Its provenance is written into the workflow
header the same way the runner record's is in forgejo-runner.nix.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

Weekly cron over every repo under hutao and skavex, opening dependency pull requests on git.hu-tao.dev. It covers three things the tree updates by hand today: flake inputs, flake.lock, and the container image tags in modules/containers. runs-on: nix rather than ghcr.io/renovatebot/renovate. Renovate does not edit flake.lock itself, it shells out to `nix flake update`, and containerbase ships no nix — on the official image every container tag would update while every flake input silently stopped. The nix label already exists for ci.yml, and Renovate comes from a .#renovate dev shell instead, which pins it in flake.lock and so lets lockFileMaintenance update Renovate itself. The dev shell is separate from .#ci deliberately: ci runs on every push and every pull request, and an entry there would make all of them download Renovate's closure for a job that never calls it. Config is json5, not json — Renovate's validator rejects unknown keys, so JSON has nowhere to put the reasoning. The split between the two files is by scope: the workflow holds instance-wide settings, and renovate.json5 is this repo's own config, read from the clone Renovate makes like any other repo's would be. No RENOVATE_GIT_AUTHOR. Renovate takes the value from the token's own account, and it decides "did a human edit my branch?" by comparing commit authors against it — an override that disagrees with the account makes Renovate read its own commits as someone else's and stop updating the branch. The token is a Forgejo Actions secret rather than a sops one: sops-nix decrypts onto the host, and this runs in a job container that cannot read the host filesystem. Its provenance is written into the workflow header the same way the runner record's is in forgejo-runner.nix. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hutao added 1 commit

2026-09-12 15:57:56 +00:00

feat(renovate): add a Renovate bot on Forgejo Actions

CI / Format, lint and evaluate (pull_request) Successful in 7m26s

Details

aa31826ba8

Weekly cron over every repo under hutao and skavex, opening dependency
pull requests on git.hu-tao.dev. It covers three things the tree updates
by hand today: flake inputs, flake.lock, and the container image tags in
modules/containers.

runs-on: nix rather than ghcr.io/renovatebot/renovate. Renovate does not
edit flake.lock itself, it shells out to `nix flake update`, and
containerbase ships no nix — on the official image every container tag
would update while every flake input silently stopped. The nix label
already exists for ci.yml, and Renovate comes from a .#renovate dev
shell instead, which pins it in flake.lock and so lets
lockFileMaintenance update Renovate itself.

The dev shell is separate from .#ci deliberately: ci runs on every push
and every pull request, and an entry there would make all of them
download Renovate's closure for a job that never calls it.

Config is json5, not json — Renovate's validator rejects unknown keys,
so JSON has nowhere to put the reasoning. The split between the two
files is by scope: the workflow holds instance-wide settings, and
renovate.json5 is this repo's own config, read from the clone Renovate
makes like any other repo's would be.

No RENOVATE_GIT_AUTHOR. Renovate takes the value from the token's own
account, and it decides "did a human edit my branch?" by comparing
commit authors against it — an override that disagrees with the account
makes Renovate read its own commits as someone else's and stop updating
the branch.

The token is a Forgejo Actions secret rather than a sops one: sops-nix
decrypts onto the host, and this runs in a job container that cannot
read the host filesystem. Its provenance is written into the workflow
header the same way the runner record's is in forgejo-runner.nix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hutao merged commit 65aa428894 into main

2026-09-12 16:08:31 +00:00

hutao deleted branch feat/renovate

2026-09-12 16:08:31 +00:00

hutao referenced this pull request from a commit

2026-09-12 16:08:32 +00:00

Merge pull request 'feat(renovate): add a Renovate bot on Forgejo Actions' (#1) from feat/renovate into main

Rows
Columns

feat(renovate): add a Renovate bot on Forgejo Actions #1