home-network-k3s-impl/.gitea/workflows/renovate.yaml

# Renovate — the dependency/image update automation. SCHEDULED, self-hosted against this Gitea.
#
# ═══════════════════════════════════════════════════════════════════════════════════════════════
# WHY THIS FILE EXISTS: renovate.json HAS BEEN IN THIS REPO AND HAS NEVER ONCE RUN.
# ═══════════════════════════════════════════════════════════════════════════════════════════════
# Measured 2026-10-17: `renovate.json` is present, complete and thoughtfully written — it declares
# managers, schedules, automerge classes and grouping. Nothing executes it. There is no Renovate
# workflow (this is the first), no Renovate CronJob or Deployment in the cluster
# (`kubectl get cronjob,deploy,job -A | grep -i renovate` -> nothing), and no bot account doing it
# from outside. Meanwhile SEVEN files carry comments asserting "Renovate maintains this pin"
# (platform/homepage/deployment.yaml:40, runbooks/serving/deployment.yaml:87,
# platform/crafty/deployment.yaml:63, platform/vpn-ingress/daemonset.yaml:259,
# platform/keycloak/postgres-cluster.yaml:75, apps/wave-0/nextcloud-db.yaml:302, and
# platform/headlamp/helmrepository.yaml:2). Those comments have been false for the life of the file.
#
# The cost is measurable. With nothing bumping anything: the six per-app oauth2-proxy auth sidecars
# sit on v7.8.1 while the platform oauth2-proxy in the SAME cluster runs v7.15.5; Keycloak (the IdP)
# runs 26.0.6, a November-2024 release, 8 minors behind; Velero runs a RELEASE CANDIDATE
# (velero-plugin-for-aws v1.14.3-rc.2) with a stable available; the CNPG Postgres image is 16.4,
# missing every 16.5+ security release. A pin nothing maintains is not a pin, it is a fossil.
#
# ═══════════════════════════════════════════════════════════════════════════════════════════════
# WHY RENOVATE AND NOT FLUX IMAGE-AUTOMATION (the decision, and it reverses ADR-0009's split)
# ═══════════════════════════════════════════════════════════════════════════════════════════════
# ADR-0009 divided the work: Renovate owns Helm chart/dependency bumps, Flux image-automation owns
# per-service container image TAGS, deliberately non-overlapping. The second half of that split
# cannot be delivered on this repo's terms, for three measured reasons:
#
#   1. IT WOULD BYPASS THE MERGE GATE, WHICH CLAUDE.md §1 FORBIDS. ImageUpdateAutomation does not
#      open pull requests; it COMMITS AND PUSHES. Its default target is the source's own branch —
#      `main` — so it would write straight past the PR flow. It can be pointed at a side branch
#      instead, but then nothing opens the PR and bumps silently accumulate on a branch nobody
#      merges. Either way a human or a second bot has to close the loop.
#   2. ON THIS CLUSTER IT CANNOT EVEN DO THAT. Measured 2026-10-17: `main` is protected with
#      `user_can_push: false`, and the `flux-system` GitRepository has NO `spec.secretRef` at all —
#      the source is anonymous and read-only. Enabling write-back means minting an in-cluster git
#      WRITE credential for the repository that defines the cluster, which is a materially larger
#      blast radius than a CI-scoped token.
#   3. RENOVATE ALREADY OPENS PRs NATIVELY, so every change it proposes goes through the gate with
#      no extra machinery.
#
# So: Renovate owns BOTH halves, and Flux image-automation stays disabled. Note this is a change of
# plan, not a change of state — image-automation has been commented out at
# platform/kustomization.yaml:52 since it was authored, and the cluster has ZERO
# ImageRepository/ImagePolicy/ImageUpdateAutomation objects (measured). Its two controllers ARE
# installed and have idled for 43 days. Nothing is being torn down here; a path that was never
# taken is being formally closed, and renovate.json's `docker`/`kubernetes` managers — disabled
# purely to avoid fighting a controller that never ran — are switched on to fill the gap.
#
# ═══════════════════════════════════════════════════════════════════════════════════════════════
# THIS WORKFLOW MUST NOT BE ABLE TO SUCCEED SILENTLY
# ═══════════════════════════════════════════════════════════════════════════════════════════════
# A SKIPPED Gitea job reports `success` (CLAUDE.md §2), so "green" is not evidence this ran. Two
# guards:
#   * The preflight step FAILS HARD (exit 1) if RENOVATE_TOKEN is absent, rather than skipping.
#     A missing credential on a dependency bot is indistinguishable from "nothing to update", and
#     that is precisely how renovate.json stayed inert for months.
#   * The summary step records what ran into the job summary unconditionally.
# What this still does NOT give you is an alert when the SCHEDULE stops firing. See the handoff
# entry's "What I did NOT verify" — that gap is stated, not papered over.
#
# OPERATOR PREREQUISITE — ONE SECRET, NOT COMMITTED HERE:
#   `RENOVATE_TOKEN` — a Gitea access token for the bot account, scopes `write:repository` and
#   `read:user`. Set it as an Actions secret on this repository. Nothing in this repo mints,
#   stores or references its value; it is consumed by name only.
#   Until it exists, this workflow FAILS LOUDLY on every scheduled run. That is intended: a
#   visible red is the correct state for "automation configured but not credentialed".
#
# THE FIRST RUN WILL WANT TO OPEN A LOT OF PRs. ~30 dependencies are behind. renovate.json caps the
# blast radius (`prConcurrentLimit: 5`, `prHourlyLimit: 2`), but run it manually with
# `dry_run: true` FIRST and read the log before letting the schedule loose. That is what
# workflow_dispatch's default is for.
name: renovate

on:
  schedule:
    # 03:15 UTC daily. renovate.json ALSO carries `"schedule": ["after 3am and before 6am"]` in
    # America/New_York, and that inner schedule is the authoritative one — Renovate re-checks it and
    # will decline to open PRs outside it. The two are deliberately both present: this cron decides
    # when the process RUNS, renovate.json decides when it may ACT. Keeping the cron slightly ahead
    # of the repo window means a run is always in flight when the window opens.
    - cron: "15 3 * * *"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Dry run (no PRs, no branches). Leave true for the first run."
        required: false
        default: "true"
      log_level:
        description: "Renovate LOG_LEVEL (info | debug)"
        required: false
        default: "info"

concurrency:
  # Never two Renovate runs at once: concurrent runs race on the same branches and can open
  # duplicate PRs. Not cancel-in-progress — a half-finished Renovate run can leave a branch pushed
  # with no PR, so let the first one finish.
  group: renovate
  cancel-in-progress: false

jobs:
  renovate:
    runs-on: ubuntu-latest
    # Renovate scans every manager across the whole repo; 40m is generous for this repo's size and
    # well under a runner's patience. Without a timeout a wedged run holds the `renovate`
    # concurrency group and silently blocks every subsequent scheduled run.
    timeout-minutes: 40
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Preflight - the token must exist, and its absence must be LOUD
        env:
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${RENOVATE_TOKEN:-}" ]; then
            echo "::error::RENOVATE_TOKEN is not set on this repository." >&2
            cat >&2 <<'MSG'

          Renovate cannot run without a Gitea access token, and this step fails rather than
          skipping ON PURPOSE: a skipped Gitea job reports `success`, so skipping here would make
          "dependency automation is not running" look exactly like "everything is up to date".
          That is the failure mode that let renovate.json sit inert in this repo for months while
          seven files claimed "Renovate maintains this pin".

          TO FIX: create a Gitea access token for the bot account with scopes
          `write:repository` and `read:user`, then add it to this repository as the Actions
          secret RENOVATE_TOKEN. Do not commit it anywhere.
          MSG
            exit 1
          fi
          echo "RENOVATE_TOKEN is present (value not printed)."

      - name: Run Renovate
        uses: renovatebot/[email protected]
        with:
          # Pinned, and Renovate maintains this pin itself: renovate.json's enabledManagers
          # includes `github-actions`, and `helpers:pinGitHubActionDigests` is in its `extends`.
          # This is the one dependency in the repo whose updater is its own updater.
          configurationFile: renovate.json
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          # Self-hosted Gitea. `platform` + `endpoint` were the two values renovate.json's own
          # header said were "set at runtime by the operator's renovate runner" — this is that
          # runner, so they are set here rather than in the repo config, which keeps renovate.json
          # portable and free of this instance's URL.
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: https://gitea.home.keithjackson.dev/api/v1
          RENOVATE_REPOSITORIES: Home-Network/home-network-k3s-impl
          # Renovate must never push to a protected branch; it works on its own branches and opens
          # PRs against this base. Stated explicitly rather than inherited, because this is the
          # property that keeps the whole mechanism inside CLAUDE.md §1's branch -> PR -> gate path.
          RENOVATE_BASE_BRANCHES: main
          RENOVATE_ONBOARDING: "false"
          RENOVATE_REQUIRE_CONFIG: "required"
          RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == 'true' && 'full' || '' }}
          LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.log_level || 'info' }}

      - name: Summary
        if: always()
        run: |
          {
            echo "## Renovate"
            echo
            echo "- trigger: \`${{ github.event_name }}\`"
            echo "- dry run: \`${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}\`"
            echo "- outcome: \`${{ job.status }}\`"
            echo
            echo "Renovate owns BOTH Helm chart bumps and container image tags here; Flux"
            echo "image-automation is deliberately disabled (platform/kustomization.yaml)."
            echo "Every change it proposes arrives as a pull request and must pass the merge gate."
          } >> "$GITHUB_STEP_SUMMARY"