feat: authenticate Renovate to the private container registry #54

2026-07-06T14:34:42+01:00

lyrathorpe commented

2026-07-06 14:34:42 +01:00

Let the self-hosted Renovate bot authenticate to the code.emmathe.dev container registry so it can read and update digests for the private images pinned in the Terraform repo — whyisthedlrshut.today (dlr) and docs-site. Without this, Renovate can't reach those images and the digests never get bumped (they stay pinned but stale).

Adds a hostRules entry: matchHost: code.emmathe.dev, hostType: docker, username: renovate-bot, password: process.env.RENOVATE_REGISTRY_TOKEN.
Scoped to the docker datasource only — the existing Gitea platform/git auth is untouched.
Digest updates already automerge (packageRules) and pinDigests is on (config:best-practices), so once auth works these images auto-bump.

Owner action: create the secret and expose it to the bot as the env var RENOVATE_REGISTRY_TOKEN — a Gitea PAT (user renovate-bot, or adjust the username in the rule) with read:package scope. That's the only thing needed.

The images are matched by the Terraform repo's existing customManager (docker datasource on variables.tf); no change needed there.

Let the self-hosted Renovate bot authenticate to the `code.emmathe.dev` container registry so it can read and update digests for the **private** images pinned in the Terraform repo — `whyisthedlrshut.today` (dlr) and `docs-site`. Without this, Renovate can't reach those images and the digests never get bumped (they stay pinned but stale). - Adds a `hostRules` entry: `matchHost: code.emmathe.dev`, `hostType: docker`, `username: renovate-bot`, `password: process.env.RENOVATE_REGISTRY_TOKEN`. - Scoped to the docker datasource only — the existing Gitea platform/git auth is untouched. - Digest updates already `automerge` (packageRules) and `pinDigests` is on (config:best-practices), so once auth works these images auto-bump. **Owner action:** create the secret and expose it to the bot as the env var **`RENOVATE_REGISTRY_TOKEN`** — a Gitea PAT (user `renovate-bot`, or adjust the `username` in the rule) with **`read:package`** scope. That's the only thing needed. The images are matched by the Terraform repo's existing `customManager` (docker datasource on `variables.tf`); no change needed there.

lyrathorpe added 1 commit 2026-07-06 14:34:42 +01:00

feat: authenticate Renovate to the code.emmathe.dev container registry ff1f7ec3a5

Add a docker hostRule so Renovate can read/update digests for private images
(dlr, docs-site) pinned in the Terraform repo. Token via RENOVATE_REGISTRY_TOKEN env.

lyrathorpe added 1 commit 2026-07-06 14:34:44 +01:00

feat: authenticate Renovate to the code.emmathe.dev container registry ff1f7ec3a5

Add a docker hostRule so Renovate can read/update digests for private images
(dlr, docs-site) pinned in the Terraform repo. Token via RENOVATE_REGISTRY_TOKEN env.

lyrathorpe added 1 commit 2026-07-06 14:44:56 +01:00

fix: use the lyrathorpe account for registry read auth fd491cd2e3

lyrathorpe merged commit 29706867cd into main

2026-07-06 14:46:35 +01:00

lyrathorpe deleted branch feat/registry-hostrules

2026-07-06 14:46:36 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lyrathorpe/renovate-config#54