Update dependencies on Codeberg using Renovate

When trying to setup Renovate as an alternative to Dependabot i found the resources online a bit confusing at times. So here is what i’ve learned about setting up Renovate on Codeberg.

Prerequisites

Before you begin, make sure you have the following:

• Codeberg account
• A repository at Codeberg
• GitHub Account

Codeberg

To activate Codeberg Actions, in your repository go to Settings -> Units -> Overview and activate Actions.

We will want another account to create our commits, so create another Codeberg account. For example myproject-bot.

On this new account we will need to create a token that our CI will use. For your account, go to Settings -> Applications -> New access token

Create a token with:

• only public repositories
• issue: Read and Write
• misc: Read
• organization: Read
• repository: Read and Write
• user: Read

Add this user as a collaborator for the repository: Settings -> Collaborators

We will also create a Github token for Renovate to be able to get Release Notes.

In GitHub, go to Settings -> Developer settings -> Personal access tokens -> Tokens (classic) and give it these permissions:

• repo: public_repo

Now we will add both these tokens as secrets in your repository. Go to Settings -> Actions -> Secrets and create these secrets

• RENOVATE_GITHUB_COM_TOKEN (our github token)
• RENOVATE_TOKEN (our codeberg token)

Now we have things ready to add Renovate to our repository.

Renovate

Create a file called .forgejo/workflows/renovate.yaml

name: Renovate

on:
  schedule:
    # every sunday at 04:00 utc
    - cron: '0 4 * * 0'
  # allow manual runs from the Actions UI
  workflow_dispatch:

  jobs:
    renovate:
      # small runners have 5-min runtime timeout, needed for our job
      runs-on: codeberg-small
      container:
        image: ghcr.io/renovatebot/renovate:latest
      steps:
        - name: Checkout
          uses: https://data.forgejo.org/actions/checkout@v7

        - name: Run Renovate
          run: renovate
          env:
            # we are using codeberg/forgejo
            RENOVATE_PLATFORM: forgejo
            # talk to Codeberg api, forgejo actions use github naming for compatiblity
            RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
            # account that will talk to codeberg API
            RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
            # renovate uses github for release notes
            RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
            # run only on this repo, even though the token could give wider access
            RENOVATE_REPOSITORIES: ${{ github.repository }}
            # again, only this repo
            RENOVATE_AUTODISCOVER: 'false'
            LOG_LEVEL: info

I have not used pinned images for easiness, that will be the first issues Renovate will raise.

We will also create a renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices",
    ":semanticCommits",
  ],
  "timezone": "UTC",
  "lockFileMaintenance": [
    "enabled": true,
    "schedule": [
      "at any time"
    ]
  ],
  "packageRules": [
    {
      "description": "Group non-major npm updates into a single PR",
      "matchManagers": [
        "npm"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch"
      ],
      "groupName": "npm minor and patch"
    }
  ],
  "timezone": "UTC"
}

Now Renovate will run every sunday morning at 04:00 UTC and look for dependencies to update. It will also create an issue called Dependency Dashboard where you can see current status of what Renovate is doing.