feat(renovate): add the update scanner that tells us an update exists #172

Merged

kblack0610 merged 1 commit from feat/renovate-update-scanner into master

2026-08-11 17:03:43 +00:00

kblack0610 commented

2026-08-11 17:03:30 +00:00

Owner

Second half of the update-automation work (first was #171, pinning the floating tags Renovate needs in order to see anything).

Runs as a Flux-managed CronJob, not a Forgejo Actions workflow: .forgejo/workflows/openclaw-image.yaml is marked KNOWN-BROKEN (dind-on-bridge hangs on the runner) and Renovate needs no docker daemon. 16 CronJobs are already the idiom here.

Two silent-failure modes, both caught by dry-run

The kubernetes manager ships no default file pattern. Without managerFilePatterns, Renovate runs clean, reports success, and finds zero images.
The flux manager default only matches clusters/**, so the crowdsec (0.22.1) and langfuse (1.5.39) chart versions were invisible. The dry-run reported 1 flux dep where it should have reported 3 - that is how this was caught.

Verification

Tokenless local extraction (RENOVATE_PLATFORM=local), which is also the documented way to re-measure:

kubernetes      249 deps / 127 files
cargo            33 / kustomize 10 / dockerfile 6
gomod 4 / ansible-galaxy 3 / docker-compose 3 / github-actions 3
flux              3 (crowdsec 0.22.1, langfuse 1.5.39, flux2 v2.7.5)
                ---
                313 deps, 112 distinct packages

Baseline is recorded in apps/renovate/README.md so a future run reporting far fewer reads as a manager pattern broke, not no updates available.

Also: renovate-config-validator passes, kubectl kustomize builds clean for apps/renovate/ and apps/, and the secret is SOPS-encrypted.

Automerge policy

patch + digest automerge on green CI; minor + major wait for review. Home Assistant (breaking config in minor releases), Immich (server and ML must move together) and the databases never automerge. git.kblab.me/kblack0610/* and the kustomize-overridden openclaw ref are excluded.

Ships SUSPENDED

It needs a Forgejo PAT that only you can mint - the API refuses to create one without write:user or basic auth. apps/renovate/README.md has the three commands. Flip suspend: false in the same commit that sets the token.

Caveat worth stating: automerge + Flux is a live deploy path. A patch bump reconciles to the cluster without a human, and today no CI covers apps/** - so CI-green is a gate that does not currently exist.

Second half of the update-automation work (first was #171, pinning the floating tags Renovate needs in order to see anything). Runs as a **Flux-managed CronJob**, not a Forgejo Actions workflow: `.forgejo/workflows/openclaw-image.yaml` is marked KNOWN-BROKEN (dind-on-bridge hangs on the runner) and Renovate needs no docker daemon. 16 CronJobs are already the idiom here. ## Two silent-failure modes, both caught by dry-run - The **`kubernetes` manager ships no default file pattern.** Without `managerFilePatterns`, Renovate runs clean, reports success, and finds **zero** images. - The **`flux` manager default only matches `clusters/**`**, so the `crowdsec` (0.22.1) and `langfuse` (1.5.39) chart versions were invisible. The dry-run reported 1 flux dep where it should have reported 3 - that is how this was caught. ## Verification Tokenless local extraction (`RENOVATE_PLATFORM=local`), which is also the documented way to re-measure: ``` kubernetes 249 deps / 127 files cargo 33 / kustomize 10 / dockerfile 6 gomod 4 / ansible-galaxy 3 / docker-compose 3 / github-actions 3 flux 3 (crowdsec 0.22.1, langfuse 1.5.39, flux2 v2.7.5) --- 313 deps, 112 distinct packages ``` Baseline is recorded in `apps/renovate/README.md` so a future run reporting far fewer reads as *a manager pattern broke*, not *no updates available*. Also: `renovate-config-validator` passes, `kubectl kustomize` builds clean for `apps/renovate/` and `apps/`, and the secret is SOPS-encrypted. ## Automerge policy patch + digest automerge on green CI; minor + major wait for review. Home Assistant (breaking config in minor releases), Immich (server and ML must move together) and the databases never automerge. `git.kblab.me/kblack0610/*` and the kustomize-overridden `openclaw` ref are excluded. ## Ships SUSPENDED It needs a Forgejo PAT that only you can mint - the API refuses to create one without `write:user` or basic auth. `apps/renovate/README.md` has the three commands. Flip `suspend: false` in the same commit that sets the token. > Caveat worth stating: automerge + Flux is a live deploy path. A patch bump reconciles to the cluster without a human, and today **no CI covers `apps/**`** - so CI-green is a gate that does not currently exist.

kblack0610 added 1 commit

2026-08-11 17:03:30 +00:00

feat(renovate): add the update scanner that tells us an update exists 16c395ffb6

Nothing in this cluster watched upstream. Actual Budget sat six months on
26.2.0 and only moved because a bank sync broke; Home Assistant was serving
2025.11.3 from a tag called :stable. Flux's own image-automation controllers
are not deployed, and there was no Renovate, Dependabot or scanner of any
kind - the only upgrade mechanism was a human editing a tag by hand.

Renovate runs as a Flux-managed CronJob rather than a Forgejo Actions
workflow: .forgejo/workflows/openclaw-image.yaml is marked KNOWN-BROKEN
because dind-on-bridge hangs on the runner, and Renovate needs no docker
daemon at all. 16 CronJobs are already the idiom here.

Two config details are load-bearing, and both fail SILENTLY when wrong:

- The kubernetes manager ships NO default file pattern. Without
  managerFilePatterns, Renovate runs clean, reports success and finds zero
  images.
- The flux manager's default pattern only matches clusters/**, so the
  crowdsec (0.22.1) and langfuse (1.5.39) HelmRelease chart versions were
  invisible until an explicit pattern was added. Caught by dry-run: the
  flux manager reported 1 dep when it should have reported 3.

Verified by a tokenless local extraction (RENOVATE_PLATFORM=local), which
is also the documented way to re-measure:

  kubernetes 249 / cargo 33 / kustomize 10 / dockerfile 6 / gomod 4
  ansible-galaxy 3 / docker-compose 3 / github-actions 3 / flux 3
  = 313 deps, 112 distinct packages

That baseline is recorded in the README so a future run that reports far
fewer reads as "a manager pattern broke", not as "no updates available".

Automerge: patch and digest land on green CI; minor and major wait for
review. Home Assistant, Immich and the databases never automerge. Our own
git.kblab.me images and the kustomize-overridden openclaw ref are excluded.

Ships SUSPENDED: it needs a Forgejo PAT that only the repo owner can mint
(the API refuses to create one without write:user or basic auth). See
apps/renovate/README.md for the three commands to enable it.