fix(ci): run Renovate via official Docker image #12

2026-05-04T18:13:12+02:00

julien commented

2026-05-04 18:13:12 +02:00

Summary

First Renovate run failed with reference not found on renovatebot/github-action@v40 — act_runner's go-git clone couldn't resolve the major-rolling tag (whether the upstream tag is missing or it's a go-git tag-fetch quirk doesn't really matter — the wrapper action is the wrong layer to fight).

Switch to invoking the official renovate/renovate:40 Docker image directly. The job container already has the host Docker socket mounted (per ci-runners.compose.yml), so the sibling docker run works out of the box. Renovate clones the target repo itself via API + token, so no actions/checkout or bind-mount is needed.

Net result:

Decoupled from third-party action-tag resolution.
Renovate runtime version explicitly pinned (reproducible).
One fewer indirection to debug.

Test plan

After merge, trigger the workflow manually (Actions → Renovate → Run workflow).
Job pulls renovate/renovate:40 (~1 GB, one-time on this runner host) and runs without "reference not found".
Renovate creates the onboarding PR ("Configure Renovate") visible in the repo's PR list, signed by apf-portal-bot.

## Summary First Renovate run failed with `reference not found` on `renovatebot/github-action@v40` — act_runner's go-git clone couldn't resolve the major-rolling tag (whether the upstream tag is missing or it's a go-git tag-fetch quirk doesn't really matter — the wrapper action is the wrong layer to fight). Switch to invoking the official `renovate/renovate:40` Docker image directly. The job container already has the host Docker socket mounted (per `ci-runners.compose.yml`), so the sibling `docker run` works out of the box. Renovate clones the target repo itself via API + token, so no `actions/checkout` or bind-mount is needed. Net result: - Decoupled from third-party action-tag resolution. - Renovate runtime version explicitly pinned (reproducible). - One fewer indirection to debug. ## Test plan - [x] After merge, trigger the workflow manually (Actions → Renovate → Run workflow). - [x] Job pulls `renovate/renovate:40` (~1 GB, one-time on this runner host) and runs without "reference not found". - [ ] Renovate creates the onboarding PR ("Configure Renovate") visible in the repo's PR list, signed by `apf-portal-bot`.

julien added 1 commit 2026-05-04 18:13:12 +02:00

fix(ci): run Renovate via official Docker image

CI / commits (pull_request) Successful in 58s

Details

CI / check (pull_request) Successful in 1m5s

Details

CI / a11y (pull_request) Successful in 1m10s

Details

CI / scan (pull_request) Failing after 3m13s

Details

CI / perf (pull_request) Successful in 2m16s

Details

d3fc13e467

`renovatebot/github-action@v40` failed to resolve on Gitea Actions
with `reference not found` when act_runner attempted the go-git
clone. Whether the issue is a missing major-rolling tag upstream or
a go-git tag-fetch quirk, the wrapper action is the wrong layer to
fight: it just shells out to the same `renovate/renovate` image we
can run ourselves.

Switch to a direct `docker run renovate/renovate:40` invocation:

- decouples from third-party action-tag resolution;
- pins the Renovate runtime version explicitly (reproducible);
- one fewer indirection to debug.

The job container already has access to the host Docker daemon
(per ci-runners.compose.yml mounting /var/run/docker.sock), so the
sibling `docker run` works out of the box. Renovate clones the
target repo itself using the API token, so no `actions/checkout`
or host bind-mount is needed.

julien merged commit 399a14e0f4 into main

2026-05-05 11:42:04 +02:00

julien deleted branch fix/ci/renovate-via-docker

2026-05-05 11:42:05 +02:00

julien referenced this pull request

2026-05-05 13:46:51 +02:00

fix(ci): give Renovate a git identity and a github.com token #13

julien referenced this issue from a commit

2026-05-05 13:47:33 +02:00

fix(ci): give Renovate a git identity and a github.com token (#13)

Sign in to join this conversation.