From ae1479f55b894e64b3620ca26fc66313cc70009c Mon Sep 17 00:00:00 2001 From: lilleman Date: Sun, 2 Aug 2026 15:43:38 +0200 Subject: [PATCH] Renovate: set GITHUB_COM_TOKEN for authenticated github.com lookups --- .gitea/workflows/renovate.yml | 2 ++ README.md | 5 ++++- todo.md | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml index fd29ea7..bd54fd8 100644 --- a/.gitea/workflows/renovate.yml +++ b/.gitea/workflows/renovate.yml @@ -10,9 +10,11 @@ jobs: steps: - name: Run Renovate against this repo env: + GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }} RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} run: | docker run --rm \ + -e GITHUB_COM_TOKEN \ -e LOG_LEVEL=info \ -e RENOVATE_ENDPOINT=https://gitea.larvit.se/api/v1 \ -e RENOVATE_GIT_AUTHOR="Renovate Bot " \ diff --git a/README.md b/README.md index 776b3aa..d78373a 100644 --- a/README.md +++ b/README.md @@ -1250,7 +1250,10 @@ fast-forward-only merge still holds) — routine bumps land untouched; only a re human. One-time setup: reuse the shared `renovate@larvit.se` bot — give it write access to this repo and store its Gitea PAT as the Actions **secret** `RENOVATE_TOKEN`. Until it exists, the nightly job fails loud (and, like the other secrets, a `GITEA_` prefix is -rejected). +rejected). Also store a **scopeless** (read-only) github.com PAT as the secret +`RENOVATE_GITHUB_TOKEN` — the workflow hands it to Renovate as `GITHUB_COM_TOKEN`, so +lookups of github.com-hosted deps (actions, Playwright, changelogs) run authenticated +instead of tripping the anonymous 60-requests/hour limit. **Auto-release on dependency updates** — a second job in `renovate.yml` (`auto-release`, `needs: renovate`) cuts **one** `vX.Y.Z` tag per run covering the renovate-bot commits merged to `main` diff --git a/todo.md b/todo.md index 9fcf88d..cd348c2 100644 --- a/todo.md +++ b/todo.md @@ -11,7 +11,7 @@ - [x] CI/CD - Sync docker images to docker hub after each re-tag to git tags. (`release.yml` pushes the same `X.Y.Z`/`X.Y`/`X`/`latest` tags to `docker.io/larvit/plainpages` after the Gitea re-tag — releases only, no hash tags; auth via the `DOCKERHUB_USER` variable + `DOCKERHUB_TOKEN` secret; documented in README → CI/CD.) - [x] Write a short text on how to use this docker image to publish on docker hub and save it to README-dockerhub.md (tagline, tags, clone-free quick start — the image ships the Ory config, extracted via `docker run … tar` + a self-contained compose.yml — env table, first plugin; pasted into the Docker Hub overview by hand — noted in README → CI/CD.) - [x] CI/CD - Setup renovate bot. Check how other repos on this Gitea is setup you can get access to, there should be a number of renovate bot activated ones. (`renovate.yml` runs the self-hosted `renovate/renovate` image nightly against `renovate.json` — this repo only, via the shared `renovate@larvit.se` bot + `RENOVATE_TOKEN` secret, mirroring the `pwrpln/core` pattern; standard managers cover npm/Dockerfiles/compose/gitea-action pins, two custom regex managers cover the image tags embedded in workflow `run:` steps, the Ory + Playwright lockstep sets are grouped, every bump stays an exact pin, and each PR automerges once the gate is green; documented in README → CI/CD.) -- [ ] CI/CD - Renovate: set a read-only `GITHUB_COM_TOKEN` env in `renovate.yml` so Renovate stops hitting github.com rate limits when resolving github-hosted deps (Playwright, lucide, `actions/checkout`) and can fetch changelogs. Non-blocking refinement; needs a read-only GitHub PAT stored as an Actions secret. +- [x] CI/CD - Renovate: set a read-only `GITHUB_COM_TOKEN` env in `renovate.yml` so Renovate stops hitting github.com rate limits when resolving github-hosted deps (Playwright, lucide, `actions/checkout`) and can fetch changelogs. Non-blocking refinement; needs a read-only GitHub PAT stored as an Actions secret. (The renovate job forwards the `RENOVATE_GITHUB_TOKEN` secret — a scopeless read-only github.com PAT; Gitea rejects `GITHUB_`-prefixed secret names — into the container as `GITHUB_COM_TOKEN`; documented in README → CI/CD.) - [x] CI/CD - When renovate updates a dependency - also release a new version of plainpages based on what got updated with Renovate. Major typescript? New apiVersion + new major. A tiny patch to ejs? Only patch release etc. Before implementing, explain in detail how you will solve this. (`renovate.yml` gains an `auto-release` job (`needs: renovate`) that cuts one `vX.Y.Z` tag per run for what Renovate merged; level = highest `Release-Bump:` trailer Renovate stamps via `commitBody`, any dep's major/minor/patch mapped straight through (default patch). Decoupled from `apiVersion` (tag-only, `HOST_API_VERSION` untouched — a "major" is just a bigger image tag, never a plugin break); pre-1.0 shifts down so nothing auto-crosses into 1.0.0. Pure `auto-release/next-version.ts` + unit tests; tag pushed with renovate-bot's PAT so `release.yml` fires; documented in README → CI/CD.) - [ ] Add an e2e test for the admin plugin's OAuth2-clients (Hydra) screen. The full-flow e2e suite runs without Hydra (compose.full.yml), so /admin/clients register/detail/delete is only unit-covered (src/http/app.test.ts); wire Hydra into an e2e stack and drive the screen in the browser. - [ ] Build and publish docker image as CI/CD.