Renovate + Gitea Actions for Gitea

This repo runs Renovate via Gitea Actions, currently every 6 hours. Renovate autodiscovers all Gitea repositories the bot user can access and opens PRs for dependency updates (including OSV-backed vulnerability fixes).

How it works

• Gitea Actions runs a single job from .gitea/workflows/renovate.yml on a cron schedule and on manual dispatch.
• The job installs a pinned renovate from package.json / package-lock.json and runs it with config from renovate.json.
• Renovate processes every non-mirror Gitea repo the bot token can access (push/pull, PRs enabled), opening and updating PRs. Minor and patch updates are grouped into one PR per repo; major updates use separate PRs.
• Known vulnerable packages get prioritized PRs labeled security and skip the normal release-age wait.

Setup

1. Gitea Actions workflow & schedule

The workflow lives in .gitea/workflows/renovate.yml and currently runs every 6 hours:

on:
  workflow_dispatch:
  schedule:
    - cron: "0 */6 * * *"

To change the schedule (e.g. daily or weekly), edit the cron expression there and push a commit.

2. Gitea Actions secrets

Configure these repository or organization secrets in Gitea:

Secret	Required	Description
RENOVATE_TOKEN	Yes	Gitea Personal Access Token (PAT) for the bot account
RENOVATE_GITHUB_COM_TOKEN	No	Recommended. Read-only GitHub PAT so Renovate can fetch changelogs and release notes without hitting anonymous rate limits. Create at GitHub → Settings → Developer settings → Personal access tokens with scope read:packages (or no scopes for public data). If you don’t want GitHub integration, remove the RENOVATE_GITHUB_COM_TOKEN lines from .gitea/workflows/renovate.yml.

The Gitea endpoint (RENOVATE_ENDPOINT) is set in .gitea/workflows/renovate.yml; change it there if your instance has a different URL. The workflow passes RENOVATE_GITHUB_COM_TOKEN to Renovate when the secret is set.

3. Gitea Personal Access Token (PAT)

Create a dedicated Renovate bot user in Gitea (or your IdP) so PRs and commits are attributed correctly, and give it access to all repos you want updated. Then:

1. Log in to Gitea as the bot user and open Settings → Applications (or https://your-gitea/user/settings/applications).
2. Under Manage Access Tokens, generate a token (e.g. renovate-bot) with: repository (read/write), user (read), issue (read/write), organization (read), and package (read) if you use packages.
3. Copy the token (shown only once) and store it as the RENOVATE_TOKEN secret for this repo (or org) in Gitea Actions.
4. In renovate.json, set gitAuthor to match the bot (e.g. "Renovate Bot <renovate-bot@your-domain>").

4. Labels

Create these labels on repos (or org-wide) so Renovate can apply them:

• dependencies — normal update PRs
• security — vulnerability-driven PRs

Configuration

Renovate is configured in renovate.json. It sets the platform, autodiscovery, grouping (group:allNonMajor), best-practices-ish presets, OSV vulnerability alerts, abandonment reporting, PR rate limits, and disables the Dependency Dashboard via the :disableDependencyDashboard preset (so it stays off even if other presets enable it). Token and endpoint are provided only via environment (secrets).

Target repos: If a repo has its own renovate.json, it is merged on top of this global config. A repo that sets its own extends (e.g. "extends": ["config:recommended"]) can effectively replace the global presets, lose grouping, or re-enable the dashboard. To keep bundled PRs and no dashboard, either omit per-repo configs or ensure they do not override extends / dashboard settings.

The workflow pins Renovate via npm so runs are reproducible; Renovate can open PRs against this repo to bump its own renovate dependency.

Narrowing scope

To limit which repos Renovate processes, add autodiscoverFilter (e.g. ["my-org/*"]) or autodiscoverNamespaces in renovate.json, or set RENOVATE_AUTODISCOVER_FILTER in the pipeline environment.