Renovate

CodeFloe runs an instance-wide Renovate bot that automatically keeps your dependencies up to date. It is managed by the renovate-operator and runs every two hours at :30 (Europe/Berlin).

You can opt in by granting the bot access to your repositories, or you can run your own Renovate instance instead.

Opting In

Renovate automatically discovers all repositories that the renovate-bot user has access to.

1. Grant the renovate-bot user access to your repositories. The easiest way is to create a team containing the repos you want processed and add renovate-bot to it. Grant write access so the bot can create update branches and pull requests. Administrator permissions are not required for webhook support.

2. Add a renovate.json to each repository. At minimum:

   {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json"
   }

   The platform-wide defaults from codefloe/renovate-config are applied automatically. You can extend them with your own settings or reference your own config repo:

   {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
     "extends": ["myorg/renovate-config"]
   }

Once discovered, Renovate will create a Dependency Dashboard issue in your repository and open pull requests for dependency updates according to the configured schedule and automerge rules.

Webhooks

CodeFloe manages a Forgejo system webhook that sends issue and pull request events to the Renovate operator. Once the operator has discovered your repository, supported events can schedule a run between the regular two-hour runs. These include checked Dependency Dashboard checkboxes and supported changes to Renovate pull requests.

No repository webhook, shared secret, or administrator access for renovate-bot is needed. The operator only schedules repositories in its discovered project list, so you still need to grant the bot access as described above.

Existing Repository Webhooks

The system webhook replaces the earlier repository webhook integrations. You do not need to create a hook pointing to either forgejo-webhook.renovate.codefloe.com/webhook or webhook.renovate.codefloe.com/webhook/v1/forgejo. The earlier instructions to request a shared webhook secret no longer apply.

The system webhook credential is managed by CodeFloe admins and is not distributed to repository owners. If webhook interactions do not trigger a run after your repository has been discovered, contact CodeFloe admins with the repository name and the time of the interaction. Regular scheduled runs remain available.

Trust & Privacy

The bot is operated by CodeFloe admins, so the same trust policy applies as for private repositories stored on CodeFloe. CodeFloe admins have the permissions to potentially access any private repository. This also applies to the S3 bucket which stores the Renovate repository cache.

Note

If you have previously used the hosted Renovate bot on GitHub, trust concepts are similar: the GitHub bot also caches repository data and you trust the service operators not to misuse access.

Running Your Own Bot

If you prefer full control, you can run your own Renovate instance instead of using the platform bot.

Caution

When going this route, configure a dependency and repository cache. Without caching, Renovate will run slowly and put unnecessary load on CI runners.

Also consider your run frequency: a homelab with a few repos may only need daily runs, while a high-activity project benefits from more frequent scheduling.

Trade-offs

Running your own bot gives you full control over scheduling, on-demand runs, and repository access. However, you are responsible for maintaining the bot, managing caches, and creating a dedicated bot account if needed.