ci: fix Renovate on Forgejo (PAT + forgejo platform + token validation) #5

Merged

alex merged 1 commit from pi/issue1-renovate-forgejo-fix into master

2026-06-29 09:16:03 +00:00

forgejo-actions commented

2026-06-29 09:14:24 +00:00

Root cause

I pulled the logs from the failing run #8 and reproduced it locally. There are two distinct problems, and PR #4's github.token fallback cannot fix either:

1. The built-in github.token cannot drive Renovate on Forgejo.
The auto token authenticates as the forgejo-actions ghost user (uid -2). Renovate passes init, then dies in repo init when it lists its own PRs:

ERROR: Repository has unknown error (repository=alex/pi-shared)
  message: "Request failed with status code 400 (Bad Request):
           GET .../pulls?state=all&sort=recentupdate&limit=100&poster=forgejo-actions"
  message: "user does not exist [uid: 0, name: forgejo-actions]"

Forgejo refuses to resolve forgejo-actions as a PR poster because it isn't a real user. Verified with both the gitea and forgejo platforms, so secrets.RENOVATE_TOKEN || github.token is a dead end.

2. The RENOVATE_TOKEN secret is stale/invalid.
Run #8 failed at init with the opaque Authentication failure, which the ghost token does not produce (it passes init). So the workflow used a non-empty-but-invalid secrets.RENOVATE_TOKEN — the || fallback only triggers when the secret is empty.

The correct setup is the standard Renovate-on-Forgejo one: a dedicated PAT for a real account (a real user is resolvable as a PR poster).

Changes

.forgejo/workflows/renovate.yml
- RENOVATE_PLATFORM: gitea -> forgejo (Renovate explicitly recommends this).
- Drop the broken github.token fallback; use secrets.RENOVATE_TOKEN exclusively.
- Add a Validate Renovate token step that fails fast with an actionable message (checks the secret is present and accepted by GET /user on the in-cluster endpoint).
- Define FORGEJO_API once as workflow-level env; tighten permissions to contents: read.
renovate.json
- github-actions.fileMatch -> managerFilePatterns (current schema) to silence the "Config needs migrating" warning.

⚠️ One manual step still required

This PR makes the workflow correct, but it will keep failing until the RENOVATE_TOKEN repo secret holds a valid Forgejo PAT for a real account. @alex please:

Create a Forgejo PAT (Settings -> Applications -> Manage Access Tokens) with scopes issue, repository, workflow.
Store it as the repo secret RENOVATE_TOKEN (Settings -> Actions -> Secrets).

Until then the job fails with the clear message above instead of the cryptic Authentication failure.

Fixes #1 (the .github -> Forgejo port is already done; this makes the ported Renovate job actually work).

## Root cause I pulled the logs from the failing [run #8](https://forge.l3x.in/alex/pi-shared/actions/runs/8) and reproduced it locally. There are **two** distinct problems, and PR #4's `github.token` fallback cannot fix either: **1. The built-in `github.token` cannot drive Renovate on Forgejo.** The auto token authenticates as the `forgejo-actions` **ghost user** (uid `-2`). Renovate passes init, then dies in repo init when it lists its own PRs: ``` ERROR: Repository has unknown error (repository=alex/pi-shared) message: "Request failed with status code 400 (Bad Request): GET .../pulls?state=all&sort=recentupdate&limit=100&poster=forgejo-actions" message: "user does not exist [uid: 0, name: forgejo-actions]" ``` Forgejo refuses to resolve `forgejo-actions` as a PR poster because it isn't a real user. Verified with both the `gitea` and `forgejo` platforms, so `secrets.RENOVATE_TOKEN || github.token` is a dead end. **2. The `RENOVATE_TOKEN` secret is stale/invalid.** Run #8 failed *at init* with the opaque `Authentication failure`, which the ghost token does **not** produce (it passes init). So the workflow used a non-empty-but-invalid `secrets.RENOVATE_TOKEN` — the `||` fallback only triggers when the secret is *empty*. The correct setup is the standard Renovate-on-Forgejo one: **a dedicated PAT for a real account** (a real user is resolvable as a PR poster). ## Changes - `.forgejo/workflows/renovate.yml` - `RENOVATE_PLATFORM: gitea` -> `forgejo` (Renovate explicitly recommends this). - Drop the broken `github.token` fallback; use `secrets.RENOVATE_TOKEN` exclusively. - Add a **`Validate Renovate token`** step that fails fast with an actionable message (checks the secret is present *and* accepted by `GET /user` on the in-cluster endpoint). - Define `FORGEJO_API` once as workflow-level `env`; tighten `permissions` to `contents: read`. - `renovate.json` - `github-actions.fileMatch` -> `managerFilePatterns` (current schema) to silence the *"Config needs migrating"* warning. ## ⚠️ One manual step still required This PR makes the workflow correct, but it will keep failing until the **`RENOVATE_TOKEN`** repo secret holds a **valid Forgejo PAT** for a real account. @alex please: 1. Create a Forgejo PAT (Settings -> Applications -> Manage Access Tokens) with scopes **`issue`**, **`repository`**, **`workflow`**. 2. Store it as the repo secret **`RENOVATE_TOKEN`** (Settings -> Actions -> Secrets). Until then the job fails with the clear message above instead of the cryptic `Authentication failure`. Fixes #1 (the `.github` -> Forgejo port is already done; this makes the ported Renovate job actually work).

forgejo-actions added 1 commit

2026-06-29 09:14:24 +00:00

ci: fix Renovate on Forgejo (PAT + forgejo platform + token validation) 09d1814d13

- switch RENOVATE_PLATFORM gitea -> forgejo (Renovate's recommendation)
- drop the github.token fallback: it authenticates as the 'forgejo-actions'
  ghost user, which Forgejo rejects when Renovate filters PRs by that poster
  (GET .../pulls?poster=forgejo-actions -> 400 'user does not exist')
- require secrets.RENOVATE_TOKEN (a real-account PAT) and add a 'Validate
  Renovate token' step that fails fast with an actionable message instead of
  the opaque 'Authentication failure'
- define FORGEJO_API as workflow env; tighten permissions to contents:read
- renovate.json: fileMatch -> managerFilePatterns (silences config migration warn)

Refs #1

forgejo-actions referenced this pull request

2026-06-29 09:14:47 +00:00

Update workflows #1