chore(deps): pin dependencies

.gitea/workflows/renovate.yaml

@@ -2,26 +2,20 @@ name: renovate
 
 on:
   schedule:
-    - cron: "@hourly"
+    - cron: "@daily"
   push:
     branches:
       - main
 
-# Serialize runs: the hourly schedule and a push to main can otherwise overlap,
-# producing duplicate PRs and concurrent writes to Gitea.
-concurrency:
-  group: renovate
-  cancel-in-progress: false
-
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.226.1@sha256:0b678d3b80ec23a7bf8c967b7796d9df09c50eac7fa16c7b4fd5761a9f4a7be0
+    container: ghcr.io/renovatebot/renovate:43.168.6@sha256:545f682571aac1efdbe7a945681c6dede8c7944c3bdc600c1f4dd22ef4634ee4
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: renovate
         env:
-          RENOVATE_CONFIG_FILE: "/workspace/lyrathorpe/renovate-config/config.js"
-          LOG_LEVEL: "info"
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_CONFIG_FILE: "/workspace/lyrathorpe/renovate-config/config.js" # replace it with your config.js path
+          LOG_LEVEL: "debug"
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} # your Revonate bot token
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}

config.js

@@ -8,25 +8,12 @@ module.exports = {
     "extends": ["config:best-practices"],
     "schedule": ["* * * * 1-5"],
     "timezone": "Europe/London",
-    "minimumReleaseAge": "3 days",
     "labels": ["dependencies"],
+    "assignees": ["lyrathorpe"],
     "reviewers": ["lyrathorpe"],
-    "hostRules": [
-        {
-            // Authenticate to the code.emmathe.dev container registry so Renovate can read and
-            // update digests for private images (e.g. code.emmathe.dev/lyrathorpe/whyisthedlrshut.today
-            // and .../docs-site, pinned in the Terraform repo). Token = a Gitea PAT with read:package;
-            // supplied via the RENOVATE_REGISTRY_TOKEN environment variable on the bot (a PAT for
-            // the "lyrathorpe" account with read:package is sufficient; the registry images are its own).
-            "matchHost": "code.emmathe.dev",
-            "hostType": "docker",
-            "username": "lyrathorpe",
-            "password": process.env.RENOVATE_REGISTRY_TOKEN
-        }
-    ],
     "prHourlyLimit": 10,
-    "prConcurrentLimit": 10,
-    "branchConcurrentLimit": 10,
+    "prConcurrentLimit": 50,
+    "branchConcurrentLimit": 5,
     "packageRules": [
         {
             "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
@@ -42,7 +29,6 @@ module.exports = {
         "schedule": ["before 4am on monday"]
     },
     "vulnerabilityAlerts": {
-        "enabled": true,
-        "schedule": ["at any time"]
+        "enabled": true
     }
 };