jaredandClaude Opus 5
2f47fa32ee
CI / Build & Quality Checks (push) Successful in 1m39s
CI / Docker image build & smoke test (push) Skipped
CI / Secret scan (gitleaks) (push) Successful in 8s
CI / Trigger Desktop Build (push) Successful in 12s
CI / Playwright smoke (e2e) (push) Successful in 1m59s
- gitleaks flagged `STORAGE_KEY = 'cinny_recent_gifs_v1'` (a localStorage key name) as a generic API key. Allowlist namespaced cinny_/lotus- key names on *_KEY assignment lines, and skip dist/, node_modules/ and the vendored Element Call bundle (minified matrix-js-sdk crypto identifiers trip the same rule locally after a build). Verified: 0 findings on this tree with and without dist/ present. - The runner has no `docker` binary and Gitea ignores job-level continue-on-error for the run conclusion, so the docker job painted the run red. It now runs only when the Actions variable CI_HAS_DOCKER is "true"; the weekly renovate job likewise only when RENOVATE_ENABLED is "true" (set alongside the RENOVATE_TOKEN secret). - The Playwright e2e job passed on the runner, so it's a hard gate now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
34 lines
1.4 KiB
YAML
34 lines
1.4 KiB
YAML
name: Renovate
|
|
|
|
# Gitea #94 — no dependency update automation existed at all. Runs the
|
|
# official renovate/renovate Docker image against this Gitea instance.
|
|
#
|
|
# Requires a `RENOVATE_TOKEN` repo/org secret: a Gitea access token with
|
|
# read/write on LotusGuild/cinny and LotusGuild/element-call, created by a
|
|
# maintainer — this workflow does not (and cannot) create one for you.
|
|
# Note: Gitea reserves the `GITEA_` secret-name prefix, so the token cannot
|
|
# be named e.g. `GITEA_TOKEN` — hence `RENOVATE_TOKEN`.
|
|
on:
|
|
schedule:
|
|
- cron: '0 4 * * 1' # weekly, Monday 04:00 UTC
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
renovate:
|
|
name: Renovate
|
|
runs-on: ubuntu-latest
|
|
# Gated on the Actions VARIABLE `RENOVATE_ENABLED` == "true" (set it together
|
|
# with the RENOVATE_TOKEN secret). Gitea ignores job-level continue-on-error
|
|
# for the run conclusion, so without the gate every weekly run would be red
|
|
# until the token exists. Also needs a Docker-capable runner (uses the
|
|
# renovate/renovate image) — see CI_HAS_DOCKER in ci.yml.
|
|
if: ${{ vars.RENOVATE_ENABLED == 'true' }}
|
|
steps:
|
|
- name: Run Renovate
|
|
uses: docker://renovate/renovate:44
|
|
env:
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://code.lotusguild.org/api/v1
|
|
RENOVATE_REPOSITORIES: LotusGuild/cinny,LotusGuild/element-call
|