fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get #84

2026-10-30T06:27:15Z

gitea-admin commented

2026-10-30 06:27:15 +00:00

Root cause

Renovate has never started in this repo. renovatebot/github-action is a wrapper around docker run, and on this runner a job deliberately gets no Docker daemon (decisions/2026-10-29-image-pipeline.md). Every run died before Renovate started. That includes the operator's workflow_dispatch run 343 (2026-10-30 06:14 UTC) and the scheduled runs 312–322. From run 343's log:

RENOVATE_TOKEN is present (value not printed).
[command]/usr/bin/docker run --env LOG_LEVEL ... --env RENOVATE_TOKEN=*** ...
failed to connect to the docker API at unix:///var/run/docker.sock; check if the path is correct and if the daemon is running: dial unix /var/run/docker.sock: connect: no such file or directory
::error::Error: The process '/usr/bin/docker' failed with exit code 1

This is a platform-compatibility failure. The run never reached authentication, token scopes, config or the network, so the re-minted token is not implicated. This log also cannot show whether its scopes are right.

Fix

The pinned image ghcr.io/renovatebot/renovate:44.167.0 is now the job's container:. act starts it through the runner's own DinD, as it does ubuntu-latest, and execs the steps inside it, so no daemon is needed. A run: step calls renovate-entrypoint.sh renovate.
actions/checkout is dropped, because Renovate clones the repo itself.
New optional secret RENOVATE_GITHUB_COM_TOKEN → GITHUB_COM_TOKEN. Without it, 17 GitHub-hosted deps are skipped with github-token-required.
The preflight prints renovate --version, which proves the step is inside the pinned image.
renovate.json5: one comment now names the new pin location. The config is unchanged.

Evidence (local reproduction)

renovate-config-validator on 44.167.0: Config validated successfully.
I ran a dry run of the pinned image in podman, emulating act: entrypoint /bin/sleep, uid 12021, and the step's run: body exec'd verbatim. It used --platform=local and --dry-run=full, with a docker host rule for the Gitea registry. It exited 0.
- Extracted 179 deps across 92 files: flux 15, github-actions 24, kubernetes 131, kustomize 2, regex 7.
- Found 42 updates, 7 of them major.
- All 4 # renovate-digest: lookups against the Gitea registry succeeded (/v2/token then HEAD .../manifests/main). They proposed real digests for the zero placeholders.
- The new container.image pin is extracted by the github-actions manager.

Not verified

The workflow on the real act_runner, the Gitea platform path, and the token's real scopes. My reproduction had no access token. See decisions/2026-10-30-renovate-first-run.md.

Gate

The local toolbox gate returned rc 3 (UNDETERMINED, not green). gitea-settings is the only stage that did not run. approval-policy will FAIL in CI because .gitea/** is a sensitive path, and the PR needs the operator's /approve-override <reason> posted as a PR review. An agent did not, and must not, post it.

Operator actions after merge

Optional: add the Actions secret RENOVATE_GITHUB_COM_TOKEN. Use a github.com fine-grained PAT with no permissions (public read only).
Dispatch renovate with dry_run: true, ideally with log_level: debug, or inside 07:00–10:00 UTC.
What success looks like in the log:
- the preflight prints renovate 44.167.0;
- Repository started, then Dependency extraction complete with roughly the counts above;
- no Authentication failure or 401/403 on /api/v1/user or /v2/token;
- Repository finished;
- the job ends success.

🤖 Generated with Claude Code

## Root cause Renovate has never started in this repo. `renovatebot/github-action` is a wrapper around `docker run`, and on this runner a job deliberately gets **no Docker daemon** (`decisions/2026-10-29-image-pipeline.md`). Every run died before Renovate started. That includes the operator's `workflow_dispatch` run 343 (2026-10-30 06:14 UTC) and the scheduled runs 312–322. From run 343's log: ``` RENOVATE_TOKEN is present (value not printed). [command]/usr/bin/docker run --env LOG_LEVEL ... --env RENOVATE_TOKEN=*** ... failed to connect to the docker API at unix:///var/run/docker.sock; check if the path is correct and if the daemon is running: dial unix /var/run/docker.sock: connect: no such file or directory ::error::Error: The process '/usr/bin/docker' failed with exit code 1 ``` This is a platform-compatibility failure. The run never reached authentication, token scopes, config or the network, so the re-minted token is not implicated. This log also cannot show whether its scopes are right. ## Fix - The pinned image `ghcr.io/renovatebot/renovate:44.167.0` is now the job's `container:`. act starts it through the runner's own DinD, as it does `ubuntu-latest`, and `exec`s the steps inside it, so no daemon is needed. A `run:` step calls `renovate-entrypoint.sh renovate`. - `actions/checkout` is dropped, because Renovate clones the repo itself. - New **optional** secret `RENOVATE_GITHUB_COM_TOKEN` → `GITHUB_COM_TOKEN`. Without it, 17 GitHub-hosted deps are skipped with `github-token-required`. - The preflight prints `renovate --version`, which proves the step is inside the pinned image. - `renovate.json5`: one comment now names the new pin location. The config is unchanged. ## Evidence (local reproduction) - `renovate-config-validator` on 44.167.0: `Config validated successfully`. - I ran a dry run of the pinned image in podman, emulating act: entrypoint `/bin/sleep`, uid 12021, and the step's `run:` body exec'd verbatim. It used `--platform=local` and `--dry-run=full`, with a docker host rule for the Gitea registry. It exited 0. - **Extracted 179 deps across 92 files:** flux 15, github-actions 24, kubernetes 131, kustomize 2, regex 7. - **Found 42 updates**, 7 of them major. - **All 4 `# renovate-digest:` lookups against the Gitea registry succeeded** (`/v2/token` then `HEAD .../manifests/main`). They proposed real digests for the zero placeholders. - The new `container.image` pin is extracted by the github-actions manager. ## Not verified The workflow on the real act_runner, the Gitea platform path, and the token's real scopes. My reproduction had no access token. See `decisions/2026-10-30-renovate-first-run.md`. ## Gate The local toolbox gate returned **rc 3** (UNDETERMINED, not green). `gitea-settings` is the only stage that did not run. **`approval-policy` will FAIL in CI** because `.gitea/**` is a sensitive path, and the PR needs the operator's `/approve-override <reason>` posted as a PR **review**. An agent did not, and must not, post it. ## Operator actions after merge 1. Optional: add the Actions secret `RENOVATE_GITHUB_COM_TOKEN`. Use a github.com fine-grained PAT with no permissions (public read only). 2. Dispatch `renovate` with `dry_run: true`, ideally with `log_level: debug`, or inside 07:00–10:00 UTC. 3. What success looks like in the log: - the preflight prints `renovate 44.167.0`; - `Repository started`, then `Dependency extraction complete` with roughly the counts above; - no `Authentication failure` or 401/403 on `/api/v1/user` or `/v2/token`; - `Repository finished`; - the job ends `success`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-10-30 06:27:15 +00:00

fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get

gate / gate (pull_request) Successful in 2m52s

Details

gate / conformance (pull_request) Has been skipped

Details

365e43cdea

renovatebot/github-action is a wrapper around `docker run`. On this runner a job has no Docker
daemon by decision (decisions/2026-10-29-image-pipeline.md), so every run, including dispatch
run 343, died before Renovate started:

  failed to connect to the docker API at unix:///var/run/docker.sock ... no such file or directory

The pinned image ghcr.io/renovatebot/renovate:44.167.0 is now the job container, and a run step
execs renovate-entrypoint.sh. actions/checkout is dropped, since Renovate clones the repo itself.
An optional RENOVATE_GITHUB_COM_TOKEN secret feeds GITHUB_COM_TOKEN.

Local dry run (--platform=local, uid 12021, the step body verbatim): 179 deps extracted, 42
updates, and all 4 own-image digest lookups against the Gitea registry succeed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 approved these changes

2026-10-30 06:33:01 +00:00

jakman85 merged commit d550a501e2 into main

2026-10-30 06:36:11 +00:00

jakman85 referenced this issue from a commit

2026-10-30 06:36:12 +00:00

Merge pull request 'fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get' (#84) from fix/renovate-first-run into main

gitea-admin referenced this pull request

2026-10-30 06:58:57 +00:00

fix(renovate): document and probe the five token scopes Renovate needs; lint daemon-bound actions #85

gitea-admin referenced this issue from a commit

2026-10-30 06:58:57 +00:00