ci: fix Renovate auth failure by pointing it at the in-cluster Forgejo endpoint #4

Merged

alex merged 2 commits from fix/renovate-auth-endpoint into master

2026-06-29 07:49:07 +00:00

forgejo-actions commented

2026-06-29 07:45:50 +00:00

Root cause of the "Authentication failure"

The Renovate run (#5/#6) aborted with:

FATAL: Initialization error
       "errorMessage": "Authentication failure"

I pulled the run logs and traced it to the network topology, not the token. The action runner lives on an internal IPv4 podman network (10.89.0.x) with no IPv6 egress, while forge.l3x.in resolves to an IPv6-only address:

forge.l3x.in -> 2001:41d0:302:2200::2308   (unreachable: port 80/443 refused)
forgejo      -> 10.89.0.52                 (reachable)

So RENOVATE_ENDPOINT: ${{ vars.MY_FORGEJO_PUBLIC_URL }}/api/v1/ (= https://forge.l3x.in/api/v1/) was unreachable from the runner - Renovate couldn't contact its platform API at all. (actions/checkout and the Pi agent already work because they talk to the internal http://forgejo:3000; the public URL is only used for display links.)

Fix

.forgejo/workflows/renovate.yml

Point RENOVATE_ENDPOINT at the reachable in-cluster service http://forgejo:3000/api/v1/ instead of the public, unreachable URL.
Use RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN || github.token }} - prefer a dedicated PAT if set, otherwise fall back to the always-available per-job github.token, which already authenticates against the in-cluster API (verified: login: forgejo-actions). This makes it work with zero secret setup.
Add a permissions: block (contents/pull-requests/issues: write) so the built-in token can push branches and open PRs/the dependency dashboard.

renovate.json

Add "gitUrl": "endpoint" so git clone/push is derived from the (internal) endpoint rather than the repo's reported clone_url (which is the unreachable public https://forge.l3x.in/...git).

Verification

Confirmed against the actual Renovate 43.246.1 source (getRepoUrl / initPlatform in the installed package) and from inside the runner:

Check	Result
`curl /api/v1/user` with `github.token` via `http://forgejo:3000`	login: forgejo-actions
`permissions.push` on `alex/pi-shared` (job token)	true (Renovate's usableRepo passes)
`git ls-remote http://<token>@forgejo:3000/alex/pi-shared.git` (the exact URL `gitUrl: endpoint` produces)	returns `c9b4aff` HEAD
Renovate `trimTrailingApiPath` -> API calls resolve to `http://forgejo:3000/api/v1/...`	confirmed in source

Note: the .github/ removal requested in #1 was already done in d9c054d; this PR addresses the follow-up auth error.

Refs #1

## Root cause of the "Authentication failure" The Renovate run (#5/#6) aborted with: ``` FATAL: Initialization error "errorMessage": "Authentication failure" ``` I pulled the run logs and traced it to the **network topology**, not the token. The action runner lives on an internal IPv4 podman network (`10.89.0.x`) with **no IPv6 egress**, while `forge.l3x.in` resolves to an **IPv6-only** address: ``` forge.l3x.in -> 2001:41d0:302:2200::2308 (unreachable: port 80/443 refused) forgejo -> 10.89.0.52 (reachable) ``` So `RENOVATE_ENDPOINT: ${{ vars.MY_FORGEJO_PUBLIC_URL }}/api/v1/` (= `https://forge.l3x.in/api/v1/`) was unreachable from the runner - Renovate couldn't contact its platform API at all. (`actions/checkout` and the Pi agent already work because they talk to the internal `http://forgejo:3000`; the public URL is only used for display links.) ## Fix **`.forgejo/workflows/renovate.yml`** - Point `RENOVATE_ENDPOINT` at the reachable in-cluster service `http://forgejo:3000/api/v1/` instead of the public, unreachable URL. - Use `RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN || github.token }}` - prefer a dedicated PAT if set, otherwise fall back to the always-available per-job `github.token`, which already authenticates against the in-cluster API (verified: `login: forgejo-actions`). This makes it work with **zero secret setup**. - Add a `permissions:` block (`contents`/`pull-requests`/`issues: write`) so the built-in token can push branches and open PRs/the dependency dashboard. **`renovate.json`** - Add `"gitUrl": "endpoint"` so git clone/push is derived from the (internal) endpoint rather than the repo's reported `clone_url` (which is the unreachable public `https://forge.l3x.in/...git`). ## Verification Confirmed against the actual Renovate 43.246.1 source (`getRepoUrl` / `initPlatform` in the installed package) and from inside the runner: | Check | Result | |---|---| | `curl /api/v1/user` with `github.token` via `http://forgejo:3000` | login: forgejo-actions | | `permissions.push` on `alex/pi-shared` (job token) | true (Renovate's usableRepo passes) | | `git ls-remote http://<token>@forgejo:3000/alex/pi-shared.git` (the exact URL `gitUrl: endpoint` produces) | returns c9b4aff HEAD | | Renovate `trimTrailingApiPath` -> API calls resolve to `http://forgejo:3000/api/v1/...` | confirmed in source | Note: the `.github/` removal requested in #1 was already done in d9c054d; this PR addresses the follow-up auth error. Refs #1

forgejo-actions added 1 commit

2026-06-29 07:45:50 +00:00

ci: fix Renovate auth failure by pointing it at the in-cluster endpoint 6abdb91ae1

Run #5/#6 aborted with FATAL 'Authentication failure'. Root cause is
network topology, not the token: the action runner is on an IPv4 podman
network with no IPv6 route, while forge.l3x.in is IPv6-only, so the
configured public RENOVATE_ENDPOINT was unreachable from the runner.

- Point RENOVATE_ENDPOINT at the reachable in-cluster http://forgejo:3000/api/v1/
  (same host actions/checkout and the Pi agent use; the public URL is display-only).
- RENOVATE_TOKEN falls back to the always-available github.token (authenticates
  to the in-cluster API as forgejo-actions) when secrets.RENOVATE_TOKEN is unset,
  so it works with zero secret setup.
- Add permissions (contents/pull-requests/issues: write) for the built-in token.
- renovate.json: gitUrl=endpoint so git clone/push stays on the internal host
  instead of the repo's unreachable public clone_url.

Verified end-to-end from the runner: API auth via github.token, push permission,
and git ls-remote of the exact endpoint-derived URL all succeed. Behaviour
confirmed against Renovate 43.246.1 source (getRepoUrl/initPlatform).

Refs #1

forgejo-actions referenced this pull request

2026-06-29 07:46:11 +00:00

Update workflows #1

alex added 1 commit

2026-06-29 07:48:30 +00:00