lyrathorpe
29706867cd
renovate / renovate (push) Successful in 58s
Let the self-hosted Renovate bot authenticate to the `code.emmathe.dev` container registry so it can read and update digests for the **private** images pinned in the Terraform repo — `whyisthedlrshut.today` (dlr) and `docs-site`. Without this, Renovate can't reach those images and the digests never get bumped (they stay pinned but stale). - Adds a `hostRules` entry: `matchHost: code.emmathe.dev`, `hostType: docker`, `username: renovate-bot`, `password: process.env.RENOVATE_REGISTRY_TOKEN`. - Scoped to the docker datasource only — the existing Gitea platform/git auth is untouched. - Digest updates already `automerge` (packageRules) and `pinDigests` is on (config:best-practices), so once auth works these images auto-bump. **Owner action:** create the secret and expose it to the bot as the env var **`RENOVATE_REGISTRY_TOKEN`** — a Gitea PAT (user `renovate-bot`, or adjust the `username` in the rule) with **`read:package`** scope. That's the only thing needed. The images are matched by the Terraform repo's existing `customManager` (docker datasource on `variables.tf`); no change needed there. Reviewed-on: #54
49 lines
1.7 KiB
JavaScript
49 lines
1.7 KiB
JavaScript
module.exports = {
|
|
"endpoint": "https://code.emmathe.dev/api/v1",
|
|
"gitAuthor": "Renovate Bot <renovate-bot@iam.emmathe.dev>",
|
|
"platform": "gitea",
|
|
"onboardingConfigFileName": ".renovaterc.json",
|
|
"autodiscover": true,
|
|
"optimizeForDisabled": true,
|
|
"extends": ["config:best-practices"],
|
|
"schedule": ["* * * * 1-5"],
|
|
"timezone": "Europe/London",
|
|
"minimumReleaseAge": "3 days",
|
|
"labels": ["dependencies"],
|
|
"reviewers": ["lyrathorpe"],
|
|
"hostRules": [
|
|
{
|
|
// Authenticate to the code.emmathe.dev container registry so Renovate can read and
|
|
// update digests for private images (e.g. code.emmathe.dev/lyrathorpe/whyisthedlrshut.today
|
|
// and .../docs-site, pinned in the Terraform repo). Token = a Gitea PAT with read:package;
|
|
// supplied via the RENOVATE_REGISTRY_TOKEN environment variable on the bot (a PAT for
|
|
// the "lyrathorpe" account with read:package is sufficient; the registry images are its own).
|
|
"matchHost": "code.emmathe.dev",
|
|
"hostType": "docker",
|
|
"username": "lyrathorpe",
|
|
"password": process.env.RENOVATE_REGISTRY_TOKEN
|
|
}
|
|
],
|
|
"prHourlyLimit": 10,
|
|
"prConcurrentLimit": 10,
|
|
"branchConcurrentLimit": 10,
|
|
"packageRules": [
|
|
{
|
|
"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
|
|
"automerge": true
|
|
},
|
|
{
|
|
"matchUpdateTypes": ["major"],
|
|
"automerge": false
|
|
}
|
|
],
|
|
"lockFileMaintenance": {
|
|
"enabled": true,
|
|
"schedule": ["before 4am on monday"]
|
|
},
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"schedule": ["at any time"]
|
|
}
|
|
};
|