Renovate in Altinn Studio (Gitea)

[altinnadmin]

Description

As more and more apps are developed in Altinn Studio, we need a scalable way to easily communicate when app dependencies should be updated.

Describe the solution you'd like

The ideal way to do this would be the same as for our code on GitHub, using Renovate.

• Renovate identifies dependencies that should be updated for an app repo
• Renovate creates a pull request for the app repo, inkluding links describing vulnerabilities
• App developer merges the pull requests, testes and re-deploys the app

Lucky for us, Renovate supports Gitea, which is used in Altinn Studio Repos :)

https://about.gitea.com/resources/tutorials/use-gitea-and-renovate-bot-to-automatically-monitor-software-packages

Describe alternatives you've considered

• Dependabot, but it does not support Gitea.

Tasks

• Set up server
• Set up PAT for Renovate user
• Set up configuration for Renovate
• Update documentation
• Push play :)
• Run demo on Altinn kaffe

[altinnadmin]

Re-purposed this issue from Dependabot to Renovate.

[mijohansen]

This issue is connected to the demo from @bengtfredh today.

Check: https://blog.gitea.io/2022/12/feature-preview-gitea-actions/

[nkylstad]

As of v21 of Gitea (we are currently on 21.8), Gitea ships with actions enabled by default.
To get workflows running through Gitea actions:

• The repo to run workflows in must have actions enabled through repo settings
• A runner must be set up (either from repo or from org)
  • Using the docker image that Gitea provides seems to be the fastest way forward here, alternative is prebuilt binaries. Regardless of which method one uses, the runners should be running on a different machine than Gitea to avoid performance issues. I tested with setting up a runner on my own machine using the Docker image using these instructions, and it worked perfectly.
• A workflow must be set up in the Gitea repo, under the .gitea/workflows folder.

We should look into how we can generalize this setup to make it available for everyone, and not just those who decide to set up their own runners.

Some relevant documentation:
https://docs.gitea.com/usage/actions/quickstart
https://docs.gitea.com/usage/actions/overview
https://docs.gitea.com/usage/actions/act-runner