feat: public renovate-bot with workflow_call + config

.gitea/workflows/renovate.yaml

@@ -0,0 +1,28 @@
+name: Renovate
+
+on:
+  workflow_call:
+    inputs:
+      log_level:
+        description: "Log level for Renovate (debug, info, warn, error)"
+        required: false
+        type: string
+        default: "info"
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: renovate/renovate:43
+    steps:
+      - name: Checkout central config
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Run Renovate
+        run: renovate
+        env:
+          RENOVATE_CONFIG_FILE: config.json
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_SSH_KEY }}
+          LOG_LEVEL: ${{ inputs.log_level }}

README.md

@@ -1,3 +1,54 @@
 # renovate-bot
 
-Central Renovate configuration — reusable Gitea Actions workflow + global config
+Central Renovate configuration for all repos on scm.cabillot.eu.
+
+## How it works
+
+This repo (public) contains:
+- `config.json` — global Renovate config (no secrets, only placeholders resolved at runtime)
+- `.gitea/workflows/renovate.yaml` — reusable Gitea Actions workflow (`workflow_call`)
+
+Being public allows the Gitea Actions runner to clone this repo for reusable
+workflow calls. No secrets are stored here — they come from org-level secrets
+on the calling repo's org.
+
+## Adopting Renovate in a repo
+
+Add this workflow file to your repo at `.gitea/workflows/renovate.yaml`:
+
+```yaml
+name: Renovate
+
+on:
+  schedule:
+    - cron: '0 0 */2 * *'
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    uses: perso/renovate-bot/.gitea/workflows/renovate.yaml@main
+    secrets: inherit
+```
+
+That's it. Renovate will:
+- Scan every 2 days for dependency updates
+- Re-run on every push to `main` (after merges) to rebase stale PRs
+- Be triggerable manually via `workflow_dispatch` (UI or API)
+
+## Per-repo overrides
+
+Add a `renovate.json` at the root of your repo. It will be merged with the
+global config.
+
+## Required secrets
+
+These must be set as **org-level secrets** in the Gitea org of the consumer repo:
+
+| Secret | Purpose |
+|--------|---------|
+| `RENOVATE_TOKEN` | Gitea API token for the renovate bot |
+| `RENOVATE_GITHUB_TOKEN` | GitHub token for GitHub-hosted dependencies |
+| `RENOVATE_SSH_KEY` | SSH private key for git operations (optional) |

config.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", "config:best-practices", "group:recommended"],
+  "ignorePresets": ["docker:pinDigests"],
+  "assignees": ["jcabillot"],
+  "dependencyDashboard": true,
+  "endpoint": "https://scm.cabillot.eu/api/v1",
+  "gitAuthor": "Renovate Bot <renovate@cabillot.eu>",
+  "platform": "gitea",
+  "requireConfig": "optional",
+  "onboarding": false,
+  "rebaseWhen": "behind-base-branch",
+  "minimumReleaseAge": "2 days",
+  "minimumReleaseAgeBehaviour": "timestamp-optional",
+  "branchConcurrentLimit": 0,
+  "prConcurrentLimit": 0,
+  "prHourlyLimit": 0,
+  "gitlabci": {
+    "enabled": false
+  },
+  "jenkins": {
+    "enabled": false
+  },
+  "hostRules": [
+    {
+      "matchHost": "github.com",
+      "token": "${RENOVATE_GITHUB_TOKEN}"
+    },
+    {
+      "matchHost": "api.github.com",
+      "token": "${RENOVATE_GITHUB_TOKEN}"
+    }
+  ]
+}