From 588e9aabb5f8d32c4975e45f10a50577ae354d0d Mon Sep 17 00:00:00 2001
From: fpotier <frederic.potier@protonmail.com>
Date: Wed, 9 Sep 2026 14:43:24 +0200
Subject: [PATCH] Add opt-in automated image updates with renovate

---
 .gitea/renovate.json           | 30 +++++++++++++++++++++++++++
 .gitea/workflows/renovate.yaml | 38 ++++++++++++++++++++++++++++++++++
 docker-compose.yaml            |  1 +
 3 files changed, 69 insertions(+)
 create mode 100644 .gitea/renovate.json
 create mode 100644 .gitea/workflows/renovate.yaml

diff --git a/.gitea/renovate.json b/.gitea/renovate.json
new file mode 100644
index 0000000..bfb93ad
--- /dev/null
+++ b/.gitea/renovate.json
@@ -0,0 +1,30 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "dependencyDashboard": false,
+  "prBodyColumns": [
+    "Package",
+    "Type",
+    // Default has "Update" but seems to be blocked by the WAF
+    "Change"
+  ],
+  "enabledManagers": [
+    "custom.regex"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Compose services that opt in with a \"# renovate: enabled\" marker",
+      "managerFilePatterns": [
+        "/(^|/)docker-compose\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "#[ \\t]*renovate:[ \\t]*enabled[ \\t]*\\n[ \\t]+image:[ \\t]*[\"']?(?<depName>[^\\s\"'${}@]+):(?<currentValue>[A-Za-z0-9_][A-Za-z0-9._-]*)(?:@(?<currentDigest>sha256:[0-9a-f]+))?[\"']?[ \\t]*(?:\\n|$)"
+      ],
+      "datasourceTemplate": "docker",
+      "versioningTemplate": "docker"
+    }
+  ]
+}
diff --git a/.gitea/workflows/renovate.yaml b/.gitea/workflows/renovate.yaml
new file mode 100644
index 0000000..5665279
--- /dev/null
+++ b/.gitea/workflows/renovate.yaml
@@ -0,0 +1,38 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '@daily'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run without creating branches or pull requests'
+        type: boolean
+        default: false
+      log_level:
+        description: 'Renovate log level'
+        type: choice
+        options:
+          - info
+          - debug
+        default: info
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44
+    steps:
+      - name: Run Renovate
+        run: renovate
+        env:
+          LOG_LEVEL: ${{ inputs.log_level || 'info' }}
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_CONFIG_FILE_NAMES: .gitea/renovate.json
+          RENOVATE_ONBOARDING: 'false'
+          RENOVATE_AUTODISCOVER: 'false'
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_FORK_PROCESSING: enabled
+          RENOVATE_DRY_RUN: ${{ inputs.dry_run == 'true' && 'full' || 'null' }}
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 09d4efe..bce4738 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -378,6 +378,7 @@ services:
       - /mount/rocrate_qa:/rocrate:rw
 
   scicat-rocrate:
+    # renovate: enabled
     image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.5
     container_name: scicat-rocrate
     restart: always