jaredandClaude Opus 5
09562061a4
- "Verify lockfile is in sync" (git diff --exit-code package-lock.json after npm ci) replaces the deleted GitHub lockfile workflow (#99). - gitleaks 8.30.1 binary scan on push + PR with a small allowlist for the public homeserver/registry URLs (#95). - docker job builds the image, runs it and asserts 200 + the security headers; continue-on-error until the runner is confirmed to have a Docker daemon (#93). .dockerignore keeps the context small. - docker-nginx.conf now sends a CSP (frame-src allowlist matching videoEmbed.ts), frame-ancestors 'none', Referrer-Policy and nosniff — shipped config, verify against the live chat.lotusguild.org headers before adopting in prod nginx (#95, #44 shipped-config half). - renovate.json + weekly renovate workflow for cinny and element-call; needs a RENOVATE_TOKEN secret (names starting GITEA_ are reserved) and stays continue-on-error until it exists (#94). - e2e job appended for the Playwright smoke test (#90), continue-on-error until green on the runner. Fixes #93 Fixes #94 Fixes #95 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
name: Renovate
|
|
|
|
# Gitea #94 — no dependency update automation existed at all. Runs the
|
|
# official renovate/renovate Docker image against this Gitea instance.
|
|
#
|
|
# Requires a `RENOVATE_TOKEN` repo/org secret: a Gitea access token with
|
|
# read/write on LotusGuild/cinny and LotusGuild/element-call, created by a
|
|
# maintainer — this workflow does not (and cannot) create one for you.
|
|
# Note: Gitea reserves the `GITEA_` secret-name prefix, so the token cannot
|
|
# be named e.g. `GITEA_TOKEN` — hence `RENOVATE_TOKEN`.
|
|
on:
|
|
schedule:
|
|
- cron: '0 4 * * 1' # weekly, Monday 04:00 UTC
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
renovate:
|
|
name: Renovate
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true # informational until RENOVATE_TOKEN is confirmed present
|
|
steps:
|
|
- name: Run Renovate
|
|
uses: docker://renovate/renovate:44
|
|
env:
|
|
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://code.lotusguild.org/api/v1
|
|
RENOVATE_REPOSITORIES: LotusGuild/cinny,LotusGuild/element-call
|