improve renovate: osv alerts, pin cli, slower cron

Prioritize vulnerability fix PRs, pin Renovate via package-lock for
reproducible runs, and drop the hourly schedule to every 6 hours.

.gitea/workflows/renovate.yml

@@ -3,7 +3,8 @@ name: Renovate
 on:
   workflow_dispatch:
   schedule:
-    - cron: "0 * * * *"
+    # Every 6 hours is enough once deps are caught up; use workflow_dispatch to run now.
+    - cron: "0 */6 * * *"
 
 jobs:
   renovate:
@@ -16,20 +17,11 @@ jobs:
       - name: Set up Node.js
         uses: https://git.keligrubb.com/actions/setup-node@v6
         with:
-          node-version: '24'
+          node-version: "24"
+          cache: npm
 
-      - name: Cache npm and Renovate
-        uses: https://git.keligrubb.com/actions/cache@v6
-        with:
-          path: |
-            ~/.npm
-            ~/.cache/renovate
-          key: renovate-${{ runner.os }}-${{ hashFiles('renovate.json') }}
-          restore-keys: |
-            renovate-${{ runner.os }}-
-
-      - name: Install Renovate
-        run: npm i -g renovate
+      - name: Install dependencies
+        run: npm ci
 
       - name: Run Renovate
         env:
@@ -39,4 +31,4 @@ jobs:
           RENOVATE_AUTODISCOVER: "true"
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
           RENOVATE_CONFIG_FILE: renovate.json
-        run: renovate
+        run: npx renovate

.gitignore

@@ -0,0 +1 @@
+node_modules/

README.md

@@ -1,12 +1,13 @@
 # Renovate + Gitea Actions for Gitea
 
-This repo runs [Renovate](https://docs.renovatebot.com/) via **Gitea Actions**, currently every hour. Renovate autodiscovers all Gitea repositories the bot user can access and opens PRs for dependency updates.
+This repo runs Renovate via **Gitea Actions**, currently every 6 hours. Renovate autodiscovers all Gitea repositories the bot user can access and opens PRs for dependency updates (including OSV-backed vulnerability fixes).
 
 ## How it works
 
-- **Gitea Actions** runs a single job from `.gitea/workflows/renovate.yml` on a **cron schedule** and on **manual dispatch**.
-- The job uses the official `renovatebot/github-action` and reads config from **renovate.json** in this repo.
-- Renovate processes every non-mirror Gitea repo the bot token can access (push/pull, PRs enabled), opening and updating PRs. Minor and patch updates are grouped into one PR per repo; major updates use separate PRs.
+* **Gitea Actions** runs a single job from `.gitea/workflows/renovate.yml` on a **cron schedule** and on **manual dispatch**.
+* The job installs a **pinned** `renovate` from `package.json` / `package-lock.json` and runs it with config from **renovate.json**.
+* Renovate processes every non-mirror Gitea repo the bot token can access (push/pull, PRs enabled), opening and updating PRs. Minor and patch updates are grouped into one PR per repo; major updates use separate PRs.
+* Known vulnerable packages get prioritized PRs labeled `security` and skip the normal release-age wait.
 
 ## Setup
 
@@ -28,11 +29,11 @@ To change the schedule (e.g. daily or weekly), edit the cron expression there an
 Configure these **repository** or **organization** secrets in Gitea:
 
 | Secret | Required | Description |
-|--------|----------|-------------|
+| --- | --- | --- |
 | `RENOVATE_TOKEN` | Yes | Gitea Personal Access Token (PAT) for the bot account |
-| `RENOVATE_GITHUB_COM_TOKEN` | No | **Recommended.** Read-only GitHub PAT so Renovate can fetch changelogs and release notes without hitting anonymous rate limits. Create at [GitHub → Settings → Developer settings → Personal access tokens](https://github.com/settings/tokens) with scope `read:packages` (or no scopes for public data). If you don’t want GitHub integration, remove the `RENOVATE_GITHUB_COM_TOKEN` lines from [.gitea/workflows/renovate.yml](.gitea/workflows/renovate.yml). |
+| `RENOVATE_GITHUB_COM_TOKEN` | No | **Recommended.** Read-only GitHub PAT so Renovate can fetch changelogs and release notes without hitting anonymous rate limits. Create at [GitHub → Settings → Developer settings → Personal access tokens](https://github.com/settings/tokens) with scope `read:packages` (or no scopes for public data). If you don’t want GitHub integration, remove the `RENOVATE_GITHUB_COM_TOKEN` lines from [`.gitea/workflows/renovate.yml`](./.gitea/workflows/renovate.yml). |
 
-The Gitea endpoint (`RENOVATE_ENDPOINT`) is set in [.gitea/workflows/renovate.yml](.gitea/workflows/renovate.yml); change it there if your instance has a different URL. The workflow passes `RENOVATE_GITHUB_COM_TOKEN` to Renovate when the secret is set.
+The Gitea endpoint (`RENOVATE_ENDPOINT`) is set in `.gitea/workflows/renovate.yml`; change it there if your instance has a different URL. The workflow passes `RENOVATE_GITHUB_COM_TOKEN` to Renovate when the secret is set.
 
 ### 3. Gitea Personal Access Token (PAT)
 
@@ -43,13 +44,20 @@ Create a dedicated Renovate bot user in Gitea (or your IdP) so PRs and commits a
 3. Copy the token (shown only once) and store it as the `RENOVATE_TOKEN` secret for this repo (or org) in Gitea Actions.
 4. In **renovate.json**, set `gitAuthor` to match the bot (e.g. `"Renovate Bot <renovate-bot@your-domain>"`).
 
+### 4. Labels
+
+Create these labels on repos (or org-wide) so Renovate can apply them:
+
+* `dependencies` — normal update PRs
+* `security` — vulnerability-driven PRs
+
 ## Configuration
 
-Renovate is configured in **renovate.json**. It sets the platform, autodiscovery, grouping (`group:allNonMajor`), best-practices presets, and disables the Dependency Dashboard via the `:disableDependencyDashboard` preset (so it stays off even if other presets enable it). Token and endpoint are provided only via environment (secrets).
+Renovate is configured in **renovate.json**. It sets the platform, autodiscovery, grouping (`group:allNonMajor`), best-practices-ish presets, OSV vulnerability alerts, abandonment reporting, PR rate limits, and disables the Dependency Dashboard via the `:disableDependencyDashboard` preset (so it stays off even if other presets enable it). Token and endpoint are provided only via environment (secrets).
 
 **Target repos:** If a repo has its own **renovate.json**, it is merged on top of this global config. A repo that sets its own `extends` (e.g. `"extends": ["config:recommended"]`) can effectively replace the global presets, lose grouping, or re-enable the dashboard. To keep bundled PRs and no dashboard, either omit per-repo configs or ensure they do not override `extends` / dashboard settings.
 
-The workflow uses the official **renovatebot/github-action**, which runs the Renovate CLI with a full feature set, suitable for lock file updates (e.g. `package-lock.json`) and common package managers.
+The workflow pins Renovate via npm so runs are reproducible; Renovate can open PRs against this repo to bump its own `renovate` dependency.
 
 ## Narrowing scope
 

package.json

@@ -0,0 +1,8 @@
+{
+  "name": "renovate-runner",
+  "private": true,
+  "description": "Runs Renovate against git.keligrubb.com via Gitea Actions",
+  "dependencies": {
+    "renovate": "44.28.0"
+  }
+}

renovate.json

@@ -3,7 +3,8 @@
     "config:recommended",
     ":configMigration",
     "group:allNonMajor",
-    ":disableDependencyDashboard"
+    ":disableDependencyDashboard",
+    "abandonments:recommended"
   ],
   "gitAuthor": "Renovate Bot <renovate@keligrubb.com>",
   "semanticCommits": "enabled",
@@ -12,6 +13,15 @@
   "prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
   "minimumReleaseAge": "3 days",
   "rangeStrategy": "auto",
+  "labels": ["dependencies"],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security", "dependencies"],
+    "minimumReleaseAge": "0 days"
+  },
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 5,
   "dockerfile": {
     "digest": { "enabled": false }
   },