From 3fbd97a0bdf0ef0ddf4ad590fef7fa7d5df1b407 Mon Sep 17 00:00:00 2001
From: Roman Priesol <roman@priesol.net>
Date: Thu, 27 Aug 2026 19:31:24 +0200
Subject: [PATCH] Add a weekly Renovate workflow for dependency updates

Runs renovate/renovate against this Gitea instance on the native
deploy runner, opening PRs for outdated Bundler dependencies instead
of relying on manually noticing (as happened with puma/mustermann
earlier).
---
 .gitea/workflows/renovate.yml | 24 ++++++++++++++++++++++++
 docs/development.adoc         | 14 ++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 .gitea/workflows/renovate.yml

diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
new file mode 100644
index 0000000..9ecdfdf
--- /dev/null
+++ b/.gitea/workflows/renovate.yml
@@ -0,0 +1,24 @@
+name: Renovate
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Gitea extends standard cron syntax with an optional "TZ=" prefix.
+    - cron: "TZ=Europe/Bratislava 0 6 * * 1"
+
+jobs:
+  renovate:
+    # The native deploy runner (see docs/deployment.adoc) already has
+    # Docker access — Renovate itself is a one-shot batch job, not a
+    # long-running service, so `docker run`, not docker-compose.
+    runs-on: deploy
+    steps:
+      - name: Run Renovate
+        run: |
+          docker run --rm \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT="${{ gitea.server_url }}/api/v1/" \
+            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
+            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
+            -e RENOVATE_ONBOARDING=false \
+            renovate/renovate
diff --git a/docs/development.adoc b/docs/development.adoc
index d21cd58..b67d6c2 100644
--- a/docs/development.adoc
+++ b/docs/development.adoc
@@ -98,3 +98,17 @@ Gitea Actions runner: `ruby -c` on every `.rb` file, a `require_relative
 "app"` smoke check that the app loads without error, and `node --check`
 on every file under `public/js/`. There is no test suite yet — these
 are cheap syntax/load checks, not behavioral tests.
+
+`.gitea/workflows/renovate.yml` runs
+https://docs.renovatebot.com[Renovate] (the `renovate/renovate` image)
+weekly (Mondays, also triggerable manually), opening PRs for outdated
+dependencies (Bundler `Gemfile`/`Gemfile.lock`, auto-detected — no
+`renovate.json` needed) against this Gitea instance
+(`RENOVATE_PLATFORM=gitea`). It runs on the native `deploy` runner (see
+`docs/deployment.adoc`) as a one-shot `docker run`, not a persistent
+service. Needs a `RENOVATE_TOKEN` repo secret — a Gitea personal
+access token (*Settings → Applications → Generate New Token*, with
+repository read/write scope) from whichever account should author the
+PRs; `RENOVATE_ONBOARDING=false` skips Renovate's usual first-PR
+"configure me" step and goes straight to dependency update PRs using
+its defaults.