jakman85andClaude Opus 5.5
365e43cdea
renovatebot/github-action is a wrapper around `docker run`. On this runner a job has no Docker daemon by decision (decisions/2026-10-29-image-pipeline.md), so every run, including dispatch run 343, died before Renovate started: failed to connect to the docker API at unix:///var/run/docker.sock ... no such file or directory The pinned image ghcr.io/renovatebot/renovate:44.167.0 is now the job container, and a run step execs renovate-entrypoint.sh. actions/checkout is dropped, since Renovate clones the repo itself. An optional RENOVATE_GITHUB_COM_TOKEN secret feeds GITHUB_COM_TOKEN. Local dry run (--platform=local, uid 12021, the step body verbatim): 179 deps extracted, 42 updates, and all 4 own-image digest lookups against the Gitea registry succeed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
238 lines
16 KiB
YAML
238 lines
16 KiB
YAML
# Renovate — the dependency/image update automation. SCHEDULED, self-hosted against this Gitea.
|
|
#
|
|
# ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
# WHY THIS FILE EXISTS: renovate.json HAS BEEN IN THIS REPO AND HAS NEVER ONCE RUN.
|
|
# ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
# Measured 2026-10-17: `renovate.json` is present, complete and thoughtfully written — it declares
|
|
# managers, schedules, automerge classes and grouping. Nothing executes it. There is no Renovate
|
|
# workflow (this is the first), no Renovate CronJob or Deployment in the cluster
|
|
# (`kubectl get cronjob,deploy,job -A | grep -i renovate` -> nothing), and no bot account doing it
|
|
# from outside. Meanwhile SEVEN files carry comments asserting "Renovate maintains this pin"
|
|
# (platform/homepage/deployment.yaml:40, runbooks/serving/deployment.yaml:87,
|
|
# platform/crafty/deployment.yaml:63, platform/vpn-ingress/daemonset.yaml:259,
|
|
# platform/keycloak/postgres-cluster.yaml:75, apps/wave-0/nextcloud-db.yaml:302, and
|
|
# platform/headlamp/helmrepository.yaml:2). Those comments have been false for the life of the file.
|
|
#
|
|
# The cost is measurable. With nothing bumping anything: the six per-app oauth2-proxy auth sidecars
|
|
# sit on v7.8.1 while the platform oauth2-proxy in the SAME cluster runs v7.15.5; Keycloak (the IdP)
|
|
# runs 26.0.6, a November-2024 release, 8 minors behind; Velero runs a RELEASE CANDIDATE
|
|
# (velero-plugin-for-aws v1.14.3-rc.2) with a stable available; the CNPG Postgres image is 16.4,
|
|
# missing every 16.5+ security release. A pin nothing maintains is not a pin, it is a fossil.
|
|
#
|
|
# ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
# WHY RENOVATE AND NOT FLUX IMAGE-AUTOMATION (the decision, and it reverses ADR-0009's split)
|
|
# ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
# ADR-0009 divided the work: Renovate owns Helm chart/dependency bumps, Flux image-automation owns
|
|
# per-service container image TAGS, deliberately non-overlapping. The second half of that split
|
|
# cannot be delivered on this repo's terms, for three measured reasons:
|
|
#
|
|
# 1. IT WOULD BYPASS THE MERGE GATE, WHICH CLAUDE.md §1 FORBIDS. ImageUpdateAutomation does not
|
|
# open pull requests; it COMMITS AND PUSHES. Its default target is the source's own branch —
|
|
# `main` — so it would write straight past the PR flow. It can be pointed at a side branch
|
|
# instead, but then nothing opens the PR and bumps silently accumulate on a branch nobody
|
|
# merges. Either way a human or a second bot has to close the loop.
|
|
# 2. ON THIS CLUSTER IT CANNOT EVEN DO THAT. Measured 2026-10-17: `main` is protected with
|
|
# `user_can_push: false`, and the `flux-system` GitRepository has NO `spec.secretRef` at all —
|
|
# the source is anonymous and read-only. Enabling write-back means minting an in-cluster git
|
|
# WRITE credential for the repository that defines the cluster, which is a materially larger
|
|
# blast radius than a CI-scoped token.
|
|
# 3. RENOVATE ALREADY OPENS PRs NATIVELY, so every change it proposes goes through the gate with
|
|
# no extra machinery.
|
|
#
|
|
# So: Renovate owns BOTH halves, and Flux image-automation stays disabled. Note this is a change of
|
|
# plan, not a change of state — image-automation has been commented out at
|
|
# platform/kustomization.yaml:52 since it was authored, and the cluster has ZERO
|
|
# ImageRepository/ImagePolicy/ImageUpdateAutomation objects (measured). Its two controllers ARE
|
|
# installed and have idled for 43 days. Nothing is being torn down here; a path that was never
|
|
# taken is being formally closed, and renovate.json's `docker`/`kubernetes` managers — disabled
|
|
# purely to avoid fighting a controller that never ran — are switched on to fill the gap.
|
|
#
|
|
# ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
# THIS WORKFLOW MUST NOT BE ABLE TO SUCCEED SILENTLY
|
|
# ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
# A SKIPPED Gitea job reports `success` (CLAUDE.md §2), so "green" is not evidence this ran. Two
|
|
# guards:
|
|
# * The preflight step FAILS HARD (exit 1) if RENOVATE_TOKEN is absent, rather than skipping.
|
|
# A missing credential on a dependency bot is indistinguishable from "nothing to update", and
|
|
# that is precisely how renovate.json stayed inert for months.
|
|
# * The summary step records what ran into the job summary unconditionally.
|
|
# What this still does NOT give you is an alert when the SCHEDULE stops firing. See the handoff
|
|
# entry's "What I did NOT verify" — that gap is stated, not papered over.
|
|
#
|
|
# OPERATOR PREREQUISITE — ONE SECRET, NOT COMMITTED HERE:
|
|
# `RENOVATE_TOKEN` — a Gitea access token for the bot account, scopes `write:repository`,
|
|
# `read:user` and (since 2026-10-29) `read:package`. Set it as an Actions secret on this
|
|
# repository. Nothing in this repo mints,
|
|
# stores or references its value; it is consumed by name only.
|
|
# Until it exists, this workflow FAILS LOUDLY on every scheduled run. That is intended: a
|
|
# visible red is the correct state for "automation configured but not credentialed".
|
|
#
|
|
# THE FIRST RUN WILL WANT TO OPEN A LOT OF PRs. ~30 dependencies are behind. renovate.json caps the
|
|
# blast radius (`prConcurrentLimit: 5`, `prHourlyLimit: 2`), but run it manually with
|
|
# `dry_run: true` FIRST and read the log before letting the schedule loose. That is what
|
|
# workflow_dispatch's default is for.
|
|
name: renovate
|
|
|
|
on:
|
|
schedule:
|
|
# 08:15 UTC daily. renovate.json ALSO carries `"schedule": ["after 3am and before 6am"]` with
|
|
# `"timezone": "America/New_York"`, and THAT inner schedule is authoritative — Renovate re-checks
|
|
# it and DECLINES TO OPEN PRs outside it. So this cron must fire INSIDE the local window, not
|
|
# merely near it.
|
|
#
|
|
# WAS `15 3 * * *`, WHICH NEVER WOULD HAVE WORKED (fixed 2026-10-18, before the first scheduled
|
|
# run). Gitea Actions cron is UTC, so 03:15 UTC is 23:15 the PREVIOUS EVENING in New York --
|
|
# 3h45m BEFORE the window opens, not "slightly ahead" of it as the original comment claimed.
|
|
# Every nightly run would have started, logged "not within schedule", opened zero PRs and
|
|
# exited SUCCESSFULLY. A green tick forever, and no updates ever: the exact "failure mode is a
|
|
# green tick" shape this repo keeps getting burned by, and indistinguishable from "nothing
|
|
# needed updating".
|
|
#
|
|
# THE WINDOW IN UTC MOVES WITH US DST, and a cron cannot follow it:
|
|
# EDT (UTC-4, Mar-Nov): local 03:00-06:00 == 07:00-10:00 UTC
|
|
# EST (UTC-5, Nov-Mar): local 03:00-06:00 == 08:00-11:00 UTC
|
|
# 08:15 UTC is the only quarter-hour comfortably inside BOTH (04:15 EDT / 03:15 EST), so the
|
|
# schedule keeps working across both switchovers without an edit. Do not "tidy" this back to an
|
|
# early-morning-UTC value without redoing this arithmetic.
|
|
- cron: "15 8 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: "Dry run (no PRs, no branches). Leave true for the first run."
|
|
required: false
|
|
default: "true"
|
|
log_level:
|
|
description: "Renovate LOG_LEVEL (info | debug)"
|
|
required: false
|
|
default: "info"
|
|
|
|
concurrency:
|
|
# Never two Renovate runs at once: concurrent runs race on the same branches and can open
|
|
# duplicate PRs. Not cancel-in-progress — a half-finished Renovate run can leave a branch pushed
|
|
# with no PR, so let the first one finish.
|
|
group: renovate
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: ubuntu-latest
|
|
# RENOVATE RUNS AS THE JOB CONTAINER, NOT THROUGH renovatebot/github-action. FIXED 2026-10-30.
|
|
# That action does exactly one thing: `docker run ghcr.io/renovatebot/renovate:<version>`. On
|
|
# this runner a job has NO Docker daemon, by decision (decisions/2026-10-29-image-pipeline.md:
|
|
# act_runner sets container.docker_host to `-` when DOCKER_HOST is tcp://, and the DinD daemon
|
|
# is privileged, so a job that could reach it would be root on the node). So every run of the
|
|
# action died before Renovate started. Dispatch run 343 (2026-10-30), verbatim:
|
|
# [command]/usr/bin/docker run --env LOG_LEVEL ... --env RENOVATE_TOKEN=*** ...
|
|
# failed to connect to the docker API at unix:///var/run/docker.sock; ... no such file or directory
|
|
# ::error::Error: The process '/usr/bin/docker' failed with exit code 1
|
|
# No auth, scope, config or network question was ever reached. Making the Renovate image the
|
|
# job container needs no daemon: act starts it through the runner's own DinD exactly as it
|
|
# starts the default ubuntu image, then `exec`s each step inside it.
|
|
#
|
|
# PINNED here (was the action's `renovate-version: 44.167.0`). renovate.json5 is validated
|
|
# against this exact tag — keep them in step. Renovate's github-actions manager reads
|
|
# `.gitea/workflows` and extracts `container.image`, so this pin is still self-maintained.
|
|
#
|
|
# The image runs as uid 12021 (`ubuntu`), and that is fine under act: the step command files
|
|
# ($GITHUB_STEP_SUMMARY etc.) are created mode 0666 (gitea/act v0.261.2 pkg/runner/step.go),
|
|
# HOME comes from the image env, and no step writes the workspace. There is deliberately NO
|
|
# actions/checkout: Renovate clones the repo itself from RENOVATE_ENDPOINT, and as uid 12021
|
|
# checkout could not `git init` the root-owned workspace volume anyway.
|
|
container:
|
|
image: ghcr.io/renovatebot/renovate:44.167.0
|
|
# Renovate scans every manager across the whole repo; 40m is generous for this repo's size and
|
|
# well under a runner's patience. Without a timeout a wedged run holds the `renovate`
|
|
# concurrency group and silently blocks every subsequent scheduled run.
|
|
timeout-minutes: 40
|
|
steps:
|
|
- name: Preflight - the token must exist, and its absence must be LOUD
|
|
shell: bash
|
|
env:
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${RENOVATE_TOKEN:-}" ]; then
|
|
echo "::error::RENOVATE_TOKEN is not set on this repository." >&2
|
|
cat >&2 <<'MSG'
|
|
|
|
Renovate cannot run without a Gitea access token, and this step fails rather than
|
|
skipping ON PURPOSE: a skipped Gitea job reports `success`, so skipping here would make
|
|
"dependency automation is not running" look exactly like "everything is up to date".
|
|
That is the failure mode that let renovate.json sit inert in this repo for months while
|
|
seven files claimed "Renovate maintains this pin".
|
|
|
|
TO FIX: create a Gitea access token for the bot account with scopes
|
|
`write:repository`, `read:user` and `read:package` (the last one lets Renovate read
|
|
this repo's own images in the Gitea registry), then add it to this repository as the
|
|
Actions secret RENOVATE_TOKEN. Do not commit it anywhere.
|
|
MSG
|
|
exit 1
|
|
fi
|
|
echo "RENOVATE_TOKEN is present (value not printed)."
|
|
# Proves the step is running INSIDE the pinned Renovate image, not the default job image.
|
|
echo "renovate $(renovate --version)"
|
|
|
|
- name: Run Renovate
|
|
shell: bash
|
|
# The repo config is discovered by Renovate from the cloned repo (renovate.json5,
|
|
# RENOVATE_REQUIRE_CONFIG=required). The action used to ALSO load it as the global config
|
|
# via RENOVATE_CONFIG_FILE; that double-loading is gone. ci/lint.sh's `configurationFile:`
|
|
# check therefore has nothing to resolve in this file, and passes.
|
|
env:
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
# Self-hosted Gitea. `platform` + `endpoint` were the two values renovate.json's own
|
|
# header said were "set at runtime by the operator's renovate runner" — this is that
|
|
# runner, so they are set here rather than in the repo config, which keeps renovate.json
|
|
# portable and free of this instance's URL.
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://gitea.home.keithjackson.dev/api/v1
|
|
RENOVATE_REPOSITORIES: Home-Network/home-network-k3s-impl
|
|
# Renovate must never push to a protected branch; it works on its own branches and opens
|
|
# PRs against this base. Stated explicitly rather than inherited, because this is the
|
|
# property that keeps the whole mechanism inside CLAUDE.md §1's branch -> PR -> gate path.
|
|
RENOVATE_BASE_BRANCHES: main
|
|
RENOVATE_ONBOARDING: "false"
|
|
RENOVATE_REQUIRE_CONFIG: "required"
|
|
RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == 'true' && 'full' || '' }}
|
|
LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.log_level || 'info' }}
|
|
# ADDED 2026-10-29: registry read access for this repo's OWN images (toolbox,
|
|
# agent-runner, conformance-runner — published by .gitea/workflows/images.yaml and
|
|
# followed through `# renovate-digest:` markers). The Gitea registry answers 401 to
|
|
# anonymous reads, and Renovate scopes the platform token to hostType `gitea`, which a
|
|
# docker lookup never matches — so without this rule every digest lookup fails. Same
|
|
# token; it therefore needs scope `read:package` in addition to the ones listed in the
|
|
# preflight above. Gitea ignores the username for token auth (services/auth/basic.go).
|
|
RENOVATE_HOST_RULES: '[{"hostType":"docker","matchHost":"gitea.home.keithjackson.dev","username":"renovate","password":"${{ secrets.RENOVATE_TOKEN }}"}]'
|
|
# OPTIONAL, ADDED 2026-10-30. A github.com token (a fine-grained PAT with NO permissions,
|
|
# public-repo read only) for lookups of GitHub-hosted dependencies. Without it Renovate
|
|
# SKIPS them with `github-token-required` — measured in a local dry run: 17 deps, i.e.
|
|
# every `uses: actions/*` here plus kubevirt/kubevirt, kubevirt/containerized-data-importer
|
|
# and intel/intel-device-plugins-for-kubernetes. Unset is safe: the step below drops the
|
|
# empty variable, and those deps simply stay unmaintained, with a WARN in the log.
|
|
GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
# An expression that evaluates to '' still EXPORTS the variable, as an empty string.
|
|
# Drop those so an unset value means "Renovate's default", never "set to empty".
|
|
for v in RENOVATE_DRY_RUN GITHUB_COM_TOKEN; do
|
|
[ -n "${!v:-}" ] || unset "$v"
|
|
done
|
|
# Through the image's entrypoint, as `docker run` would have gone: it sources the
|
|
# containerbase env and initialises the bundled tools before exec'ing Renovate.
|
|
exec renovate-entrypoint.sh renovate
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
{
|
|
echo "## Renovate"
|
|
echo
|
|
echo "- trigger: \`${{ github.event_name }}\`"
|
|
echo "- dry run: \`${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}\`"
|
|
echo "- outcome: \`${{ job.status }}\`"
|
|
echo
|
|
echo "Renovate owns BOTH Helm chart bumps and container image tags here; Flux"
|
|
echo "image-automation is deliberately disabled (platform/kustomization.yaml)."
|
|
echo "Every change it proposes arrives as a pull request and must pass the merge gate."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|