renovate — automatic dependency updates for Forgejo

Periodically scans every raf/* repo on ps1raf's Forgejo and opens PRs for out-of-date dependencies. Runs daily via systemd user timer.

How it works

• config.js — renovate config (platform=forgejo, autodiscover, filters, schedule)
• run.sh — wrapper: pulls ghcr.io/renovatebot/renovate:latest, mounts config + step-CA root, passes RENOVATE_TOKEN from ~/.env
• ~/.config/systemd/user/renovate.service — one-shot unit calling run.sh
• ~/.config/systemd/user/renovate.timer — daily trigger
• logs/ — per-run log files

Token

Forgejo PAT renovate-bot owned by raf (admin), scope all. Created via forgejo admin user generate-access-token. Saved to ~/.env as RENOVATE_TOKEN. Rotate by re-running:

podman exec -u git forgejo forgejo admin user generate-access-token \
  --username raf --token-name renovate-bot --scopes all

SSL

The Forgejo instance terminates TLS with a cert from the local step-CA. Both node (NODE_EXTRA_CA_CERTS) and git (GIT_SSL_CAINFO) inside the renovate container are pointed at /home/raf/CERTS/root_ca.crt mounted read-only.

Onboarding

On first encounter of a repo, renovate opens a renovate/configure PR adding renovate.json with config:recommended + :dependencyDashboard. Merge it to opt in; close it to opt out. The dependency dashboard issue then tracks ongoing update PRs.

Operations

# Dry-run a single repo (no PRs created)
./run.sh --dry-run=full raf/scannerserver

# Trigger a full run now
systemctl --user start renovate.service

# Tail latest log
tail -f $(ls -t /home/raf/renovate/logs/*.log | head -1)

# Check schedule
systemctl --user list-timers renovate.timer

Filters

autodiscoverFilter: ['raf/*'] limits scope to the raf user's repos. Add patterns like '!raf/scratch-*' to exclude.

Throttling

prHourlyLimit: 4, prConcurrentLimit: 10 keep PR floods bounded across the ~50 repos. The onboarding PR each repo asks for schedule: after 4am and before 8am on monday so update PRs only land in the weekly window.