Renovate preset and Forgejo repository policy

default.json is the shared local>nyyu/renovate-config Renovate preset.

Configure Forgejo repositories

scripts/configure_forgejo.py uses Python 3's standard library and the Forgejo REST API. Its default operation only reads settings and prints a JSON plan. By default it discovers writable repositories visible to the authenticated account and checks their default branch for standard Renovate configuration files: renovate.json, .jsonc, .json5, .renovaterc variants, configurations under .github/ and .gitlab/, and the deprecated package.json Renovate section. Archived and mirrored repositories are excluded. Custom Renovate config filenames are not auto-detected. File presence identifies the scope; it does not prove that Renovate is enabled or currently runs for that repository.

forgejo-policy.json defines a shared default requiring ci/woodpecker/push/woodpecker. Its repositories map contains only exceptions: multiple pipelines, a PR-only pipeline, Forgejo Actions, or manual merge. Newly discovered repositories use the default automatically. If a repository using that default lacks .woodpecker.yml or .woodpecker.yaml, application is blocked until CI is added or an override is configured. The presence of a workflow file does not prove its triggers run validation on Renovate commits. --listed-only restores the explicit selection list. Discovery uses the credentials passed to the script, so its visibility may differ from the Renovate bot account.

BellHappy is an explicit manual_merge: true exception: it receives the merge defaults and bot access, but no required CI check. Its own renovate.json disables automerge, including lock-file maintenance. The policy script does not edit repository files, so manual_merge alone does not disable Renovate automerge.

The policy sets these repository defaults:

• Enable pull requests before configuring merge methods.
• Merge with rebase then fast-forward (default_merge_style: rebase).
• Enable fast-forward-only merging and updating PR branches by rebase.
• Default PR branch updates to rebase.
• Default to deleting the source branch after merge. The merged PR is retained.
• Ensure the renovate-bot account has effective write access, adding a write collaborator only if needed. Existing write/admin/owner access is preserved.
• Require configured CI checks and an up-to-date source branch before PR merge, including merges by administrators.

Other merge methods remain available; these are defaults, not a ban on other methods. Existing review requirements, signatures, push permissions, whitelists, and unrelated protection rules are preserved. A new default-branch protection allows direct pushes so ArgoCD Image Updater and existing direct writers keep working. Required checks gate PR merges, not these direct pushes.

Authentication uses FORGEJO_TOKEN, or the local Git credential for the configured HTTPS host. The account needs repository admin permissions. Tokens are never written to the plan or backup.

The running Renovate instance uses renovate-bot. Override this with --renovate-user NAME or the top-level renovate_user policy setting. The account must already exist. Permissions are read through Forgejo's effective collaborator permission endpoint, so inherited team access also counts.

To grant bot write access without changing merge settings or requiring CI setup:

python3 scripts/configure_forgejo.py --access-only
python3 scripts/configure_forgejo.py --access-only \
  --apply --backup /tmp/forgejo-bot-access-backup.json

Access-only mode ignores missing CI requirements, but still requires admin access, backs up the prior permission, and verifies effective write permission afterward.

# Discover and audit; exit code 2 means some repositories need CI check names.
python3 scripts/configure_forgejo.py > /tmp/forgejo-plan.json

# Restrict the audit to entries explicitly listed in forgejo-policy.json.
python3 scripts/configure_forgejo.py --listed-only

# Audit just one discovered repository.
python3 scripts/configure_forgejo.py --repo nyyu/argocd-apps

In an explicit repository override, required_checks: null preserves enabled checks on an existing exact default-branch protection. If none exist, the script blocks apply until you supply exact CI context names, for example:

{
  "required_checks": ["ci/woodpecker/push/woodpecker"]
}

Choose names actually reported on the PR head commit by the repository's CI, not names copied from another repository. Existing protections are inherited without proving that their contexts still run. Check PR-triggered workflows too: a repository that only tests the default branch needs CI configuration changes before enabling platform auto-merge. A Forgejo Actions check may have a different name from a Woodpecker status.

Review the plan, then apply selected repositories:

python3 scripts/configure_forgejo.py \
  --repo nyyu/argocd-apps \
  --apply --backup /tmp/forgejo-policy-backup.json

The backup path must not exist. Before any changes, the script checks all selected repositories for blockers and writes a backup with owner-only permissions. It then rechecks for concurrent edits, sets protection before merge defaults, and reads each repository back to verify the result. It does not delete old rules such as BellHappy's main0; it creates protection for the actual default branch. Errors stop processing; earlier successful writes remain applied. The backup records prior settings for manual recovery. Re-running after a successful apply produces no changes.

This script does not merge/rebase open PRs, change server-wide defaults for future repositories, or enable Renovate platform auto-merge. Once the selected repos' CI requirements are verified, their Renovate configuration can use:

{
  "automergeType": "pr",
  "platformAutomerge": true,
  "automergeStrategy": "fast-forward"
}

Keep that configuration repository-specific until every repository inheriting the shared preset has suitable CI protection.

python3 -m unittest discover -s tests