Add opt-in automated image updates with renovate

.gitea/renovate.json5

@@ -0,0 +1,23 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'config:recommended',
+  ],
+  enabledManagers: [
+    'custom.regex',
+  ],
+  customManagers: [
+    {
+      customType: 'regex',
+      description: 'Compose services that opt in with a "# renovate: enabled" marker',
+      managerFilePatterns: [
+        '/(^|/)docker-compose\\.ya?ml$/',
+      ],
+      matchStrings: [
+        "#[ \\t]*renovate:[ \\t]*enabled[ \\t]*\\n[ \\t]+image:[ \\t]*[\"']?(?<depName>[^\\s\"'${}@]+):(?<currentValue>[A-Za-z0-9_][A-Za-z0-9._-]*)(?:@(?<currentDigest>sha256:[0-9a-f]+))?[\"']?[ \\t]*(?:\\n|$)",
+      ],
+      datasourceTemplate: 'docker',
+      versioningTemplate: 'docker',
+    },
+  ],
+}

.gitea/workflows/renovate.yaml

@@ -0,0 +1,42 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '15 3 * * 1-5'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run without creating branches or pull requests'
+        type: boolean
+        default: false
+      log_level:
+        description: 'Renovate log level'
+        type: choice
+        options:
+          - info
+          - debug
+        default: info
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44
+    steps:
+      - name: Run Renovate
+        run: renovate
+        env:
+          LOG_LEVEL: ${{ inputs.log_level || 'info' }}
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN || secrets.GITEA_TOKEN }}
+          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate@psi.ch>
+          RENOVATE_AUTODISCOVER: 'false'
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_FORK_PROCESSING: enabled
+          RENOVATE_HOST_RULES: >-
+            [{"matchHost": "gitea.psi.ch",
+              "hostType": "docker",
+              "username": "${{ secrets.REGISTRY_USERNAME || github.actor }}",
+              "password": "${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}"}]
+          RENOVATE_DRY_RUN: ${{ inputs.dry_run == 'true' && 'full' || 'null' }}

docker-compose.yaml

@@ -378,6 +378,7 @@ services:
       - /mount/rocrate_qa:/rocrate:rw
 
   scicat-rocrate:
+    # renovate: enabled
     image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.5
     container_name: scicat-rocrate
     restart: always