Renovate

Keeps the dependencies of every repository on git.cisnt.uk current. Each night at 03:00 UTC a Forgejo Actions job runs Renovate as Hammer, the forge's bot account, across every repository Hammer can write to.

What it does

• One pull request per repository gathers every minor, patch and digest update. Major releases get a pull request each, since they usually need code changes.
• Security fixes from the OSV database are labelled security and opened straight away.
• A dependency dashboard issue in each repository lists what's pending, what's been held back and anything Renovate couldn't parse.
• Branches stay rebased on main, so every pull request merges fast-forward, and CI on the pull request shows whether the update still builds and passes its tests.

Commits follow the house style, e.g. build(deps): update dependencies, and are signed with Hammer's GPG key as Hammer <noreply@cisnt.uk>.

Configuration

• default.json holds the rules every repository inherits.
• The workflow in .forgejo/workflows/renovate.yml holds the global settings: the forge, Hammer's identity, and which repositories to leave out (.profile repositories and private ones with nothing to update).
• A project that needs something different (a pinned dependency, an ignored path) adds a renovate.json of its own, which is applied on top of default.json.

Hammer has write access through a Hammer team in each organisation and as a collaborator on Morgan's repositories. A new repository in an organisation is covered automatically; a new one under morgan needs Hammer added as a collaborator.

Running it by hand

Run the workflow from the Actions tab. Tick dry-run to see what Renovate would do without pushing anything.