Renovate: set GITHUB_COM_TOKEN for authenticated github.com lookups

2026-08-02 15:43:38 +02:00
parent bb6021adf7
commit ae1479f55b
3 changed files with 7 additions and 2 deletions
@@ -1250,7 +1250,10 @@ fast-forward-only merge still holds) — routine bumps land untouched; only a re
 human. One-time setup: reuse the shared `renovate@larvit.se` bot — give it write access to
 this repo and store its Gitea PAT as the Actions **secret** `RENOVATE_TOKEN`. Until it
 exists, the nightly job fails loud (and, like the other secrets, a `GITEA_` prefix is
-rejected).
+rejected). Also store a **scopeless** (read-only) github.com PAT as the secret
+`RENOVATE_GITHUB_TOKEN` — the workflow hands it to Renovate as `GITHUB_COM_TOKEN`, so
+lookups of github.com-hosted deps (actions, Playwright, changelogs) run authenticated
+instead of tripping the anonymous 60-requests/hour limit.

 **Auto-release on dependency updates** — a second job in `renovate.yml` (`auto-release`, `needs:
 renovate`) cuts **one** `vX.Y.Z` tag per run covering the renovate-bot commits merged to `main`