ci: replace Dependabot/.github with self-hosted Renovate on Forgejo #2

Merged

alex merged 1 commit from pi/issue1-renovate into master

2026-06-29 05:02:35 +00:00

forgejo-actions commented

2026-06-29 04:58:29 +00:00

Summary

Implements Option A from the feasibility report in #1: replace the now-inert GitHub-side automation (dependabot.yml + the redundant .github/workflows/pi.yml) with Renovate, self-hosted as a Forgejo Action. This is a replacement, not a port — Forgejo ignores .github/dependabot.yml, so without this the load-bearing @earendil-works/pi-coding-agent bumps would silently stop.

Changes

File	Change
`renovate.json`	New — Renovate config covering both former Dependabot managers
`.forgejo/workflows/renovate.yml`	New — weekly cron that runs Renovate against this repo
`.github/dependabot.yml`	Deleted
`.github/workflows/pi.yml`	Deleted (already superseded by `.forgejo/workflows/pi.yml`)
`.github/`	Removed entirely (now empty)

What the Renovate config does

npm manager (enabled by default) → keeps @earendil-works/pi-coding-agent fresh in package.json/bun.lock (the repo's core purpose).
github-actions manager with a custom fileMatch for \.forgejo/workflows/[^/]+\.ya?ml$ → also bumps actions/checkout@v7 in the Forgejo workflows (Dependabot could never see these).
dependencyDashboard: true → a control issue to review/trigger updates before they land (useful for the initial rollout).
Weekly schedule (before 6am on Monday) — matches the old Dependabot cadence.
Ignores shaftoe/pi-coding-agent-action — it's intentionally pinned to the moving develop branch.

⚠️ Required setup (ops / repo settings)

The workflow won't run until these are in place:

RENOVATE_TOKEN (secret, required) — a Forgejo PAT with repository, issue and workflow write scopes, so Renovate can open branches/PRs and touch workflow files.
MY_FORGEJO_PUBLIC_URL (repo/owner var, already used by the pi workflow) — must be the base URL without a trailing slash (the workflow appends /api/v1/).
GITHUB_COM_TOKEN (secret, recommended) — a classic GitHub PAT to avoid github.com rate limits when Renovate resolves release metadata for actions/checkout, the Renovate action, and npm packages.

The renovatebot/github-action ref is pinned to the verified-latest v46.1.17; once Renovate is running it keeps that ref (and actions/checkout) up to date automatically.

Verification checklist (per the report)

First scheduled run (or workflow_dispatch) completes green.
Dependency Dashboard issue is created.
At least one @earendil-works/pi-coding-agent bump PR lands — only then is the regression risk from dropping Dependabot fully closed.

Closes #1.

## Summary Implements **Option A** from the feasibility report in #1: replace the now-inert GitHub-side automation (`dependabot.yml` + the redundant `.github/workflows/pi.yml`) with **Renovate**, self-hosted as a Forgejo Action. This is a *replacement*, not a port — Forgejo ignores `.github/dependabot.yml`, so without this the load-bearing `@earendil-works/pi-coding-agent` bumps would silently stop. ## Changes | File | Change | |------|--------| | `renovate.json` | **New** — Renovate config covering both former Dependabot managers | | `.forgejo/workflows/renovate.yml` | **New** — weekly cron that runs Renovate against this repo | | `.github/dependabot.yml` | **Deleted** | | `.github/workflows/pi.yml` | **Deleted** (already superseded by `.forgejo/workflows/pi.yml`) | | `.github/` | **Removed entirely** (now empty) | ## What the Renovate config does - **`npm` manager** (enabled by default) → keeps `@earendil-works/pi-coding-agent` fresh in `package.json`/`bun.lock` (the repo's core purpose). - **`github-actions` manager** with a custom `fileMatch` for `\.forgejo/workflows/[^/]+\.ya?ml$` → also bumps `actions/checkout@v7` in the Forgejo workflows (Dependabot could never see these). - **`dependencyDashboard: true`** → a control issue to review/trigger updates before they land (useful for the initial rollout). - **Weekly schedule** (`before 6am on Monday`) — matches the old Dependabot cadence. - **Ignores `shaftoe/pi-coding-agent-action`** — it's intentionally pinned to the moving `develop` branch. ## ⚠️ Required setup (ops / repo settings) The workflow won't run until these are in place: 1. **`RENOVATE_TOKEN`** *(secret, required)* — a Forgejo PAT with `repository`, `issue` and `workflow` write scopes, so Renovate can open branches/PRs and touch workflow files. 2. **`MY_FORGEJO_PUBLIC_URL`** *(repo/owner var, already used by the pi workflow)* — must be the base URL **without** a trailing slash (the workflow appends `/api/v1/`). 3. **`GITHUB_COM_TOKEN`** *(secret, recommended)* — a classic GitHub PAT to avoid github.com rate limits when Renovate resolves release metadata for `actions/checkout`, the Renovate action, and npm packages. > The `renovatebot/github-action` ref is pinned to the verified-latest `v46.1.17`; once Renovate is running it keeps that ref (and `actions/checkout`) up to date automatically. ## Verification checklist (per the report) - [ ] First scheduled run (or `workflow_dispatch`) completes green. - [ ] Dependency Dashboard issue is created. - [ ] At least one `@earendil-works/pi-coding-agent` bump PR lands — **only then** is the regression risk from dropping Dependabot fully closed. Closes #1.

forgejo-actions added 1 commit

2026-06-29 04:58:29 +00:00

ci: replace Dependabot/.github with self-hosted Renovate on Forgejo d9c054d931

Drop the now-inert GitHub-side automation (dependabot.yml + the redundant
.github/workflows/pi.yml) and replace it with Renovate, self-hosted as a
Forgejo Action — the replacement for Dependabot on Forgejo (option A).

- renovate.json: npm manager keeps @earendil-works/pi-coding-agent fresh;
  github-actions manager extended (fileMatch) to also scan .forgejo/workflows
  so actions/checkout etc. get bumped; ignores the moving @develop action ref.
- .forgejo/workflows/renovate.yml: weekly cron running renovatebot/github-action
  against this repo.
- Removes .github/ entirely.

Requires secrets/vars: RENOVATE_TOKEN, GITHUB_COM_TOKEN, MY_FORGEJO_PUBLIC_URL.

Closes #1.

forgejo-actions referenced this pull request

2026-06-29 04:58:47 +00:00

Update workflows #1