ci: add Renovate and tag-driven releases #6

Merged

ryan.mcgee merged 4 commits from chore/renovate-and-release-automation into main 2026-10-16 23:07:24 +00:00

Conversation 0 Commits 4 Files changed 5 +242 -7

ryan.mcgee commented 2026-10-16 22:48:27 +00:00

Owner

Copy link

Summary

• Keep dependencies current with a scheduled self-hosted Renovate, and automate releases (zip, release, manifest PR) from a pushed tag.

Changes

• renovate.json + .gitea/workflows/renovate.yml: weekly pinned Renovate (44.165.1) covering NuGet, the SDK image, actions and the smoke-test images. Jellyfin packages and server stay on 10.11.x (together), the SDK on 9.0.x, no automerge. SHELLCHECK_VERSION is deliberately unmanaged (its checksum cannot be recomputed).
• scripts/release.sh + .gitea/workflows/release.yml: on a bare-version tag, refuse mismatched or non-main tags, build the zip, create the release with assets, open the manifest PR.
• README: setup, rules and release flow.

Verification

• Renovate config validator (--strict) passes; an offline dry run extracts every intended dependency. Control run without the version rules proposes Jellyfin 12.2.0 and SDK 10.0.402; with the real config neither is proposed. An empty GitHub token variable does not break a run.
• release.sh end to end against a throwaway local Gitea 1.22.6: created a public release with zip and SHA256SUMS, opened a mergeable manifest PR whose checksum equals the MD5 of the attached zip, and refused a second run. Rejects v-prefixed tags, version mismatch, missing tag, HEAD not on the tag, and a tag not on main.
• All CI workflow steps run in a fresh SDK container: build 0 warnings, format clean, 43 tests, shellcheck over the new scripts, package, manifest check.

Not verified here

• The real Renovate run and the real release workflow need the BOT_TOKEN repo secret (a dedicated account token); neither has run on this forge yet.

## Summary - Keep dependencies current with a scheduled self-hosted Renovate, and automate releases (zip, release, manifest PR) from a pushed tag. ## Changes - `renovate.json` + `.gitea/workflows/renovate.yml`: weekly pinned Renovate (44.165.1) covering NuGet, the SDK image, actions and the smoke-test images. Jellyfin packages and server stay on 10.11.x (together), the SDK on 9.0.x, no automerge. `SHELLCHECK_VERSION` is deliberately unmanaged (its checksum cannot be recomputed). - `scripts/release.sh` + `.gitea/workflows/release.yml`: on a bare-version tag, refuse mismatched or non-main tags, build the zip, create the release with assets, open the manifest PR. - README: setup, rules and release flow. ## Verification - Renovate config validator (`--strict`) passes; an offline dry run extracts every intended dependency. Control run without the version rules proposes Jellyfin 12.2.0 and SDK 10.0.402; with the real config neither is proposed. An empty GitHub token variable does not break a run. - `release.sh` end to end against a throwaway local Gitea 1.22.6: created a public release with zip and SHA256SUMS, opened a mergeable manifest PR whose checksum equals the MD5 of the attached zip, and refused a second run. Rejects v-prefixed tags, version mismatch, missing tag, HEAD not on the tag, and a tag not on main. - All CI workflow steps run in a fresh SDK container: build 0 warnings, format clean, 43 tests, shellcheck over the new scripts, package, manifest check. ## Not verified here - The real Renovate run and the real release workflow need the `BOT_TOKEN` repo secret (a dedicated account token); neither has run on this forge yet.

ryan.mcgee added 3 commits 2026-10-16 22:48:28 +00:00

ci: add scheduled Renovate dependency updates ... 2d2de28cba

- weekly self-hosted Renovate run from Gitea Actions with a bot token
- cover NuGet, the SDK image, actions and smoke-test images
- keep Jellyfin packages and server on 10.11.x and the SDK on 9.0.x
- no automerge

ci: automate releases from pushed tags ... 3a283f51a8

- release.sh builds the zip, creates the release with assets and
  opens a pull request adding the version to manifest.json
- release.yml runs it when a bare-version tag is pushed
- refuse tags that are not on main or do not match build.yaml

docs: describe Renovate and automated releases ... d73d9e4878

- document the Renovate rules, the Jellyfin and SDK pins and the
  unmanaged shellcheck pin
- document the BOT_TOKEN secret and the tag-driven release flow

ryan.mcgee added 1 commit 2026-10-16 23:04:12 +00:00

ci: use the RENOVATE_TOKEN secret name ... 840e1f5d81

- renovate and release workflows and README reference the secret as
  created in the repository settings

ryan.mcgee merged commit ad36d7aac2 into main 2026-10-16 23:07:24 +00:00

ryan.mcgee deleted branch chore/renovate-and-release-automation 2026-10-16 23:07:24 +00:00

ryan.mcgee referenced this pull request from a commit 2026-10-16 23:07:25 +00:00

ci: add Renovate and tag-driven releases (#6)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Enclave-Information-Systems/jellyfin-sso-plugin!6

No description provided.