ci: add workflows to correct repository path

.gitea/workflows/ci.yaml

@@ -1,4 +1,5 @@
 name: CI
+
 on:
   push:
     branches:
@@ -11,38 +12,43 @@ on:
 
 jobs:
   check:
-    runs-on: shell
+    runs-on: ubuntu-latest
+    
+    env:
+      SKIP_ENV_VALIDATION: 1
+      ARGON2_MEMORY_SIZE: 1024
+      ARGON2_ITERATIONS: 1
+      BCRYPT_ROUNDS: 4
+      DATABASE_URL: "mysql://ci:[email protected]:3306/ci"
+
     steps:
-      - name: Typecheck, lint, security audit, and test
-        run: |
-          set -e
-          WORK="$(mktemp -d /var/tmp/epicnext-ci.XXXXXX)"
-          cleanup() { rm -rf "${WORK}"; }
-          trap cleanup EXIT
+      - name: Checkout code
+        uses: actions/checkout@v4
 
-          echo "--- CI checks (${WORK}) ---"
-          git clone --depth 50 \
-            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
-            "${WORK}"
-          cd "${WORK}"
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
 
-          REF="${{ gitea.sha }}"
-          if [ -z "${REF}" ]; then
-            echo "ERROR: missing gitea.sha" >&2
-            exit 1
-          fi
-          git fetch --depth 50 origin "${REF}"
-          git checkout -f "${REF}"
+      - name: Setup PNPM
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
 
-          export SKIP_ENV_VALIDATION=1
-          export ARGON2_MEMORY_SIZE=1024
-          export ARGON2_ITERATIONS=1
-          export BCRYPT_ROUNDS=4
-          export DATABASE_URL="mysql://ci:[email protected]:3306/ci"
-          pnpm install --frozen-lockfile
-          pnpm prisma:generate
-          pnpm audit --audit-level=high || echo "WARNING: pnpm audit found high/critical vulnerabilities"
-          pnpm biome:lint
-          pnpm typecheck
-          pnpm test
-          echo "--- CI checks passed ---"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Prisma Client
+        run: pnpm prisma:generate
+
+      - name: Security Audit
+        run: pnpm audit --audit-level=high || echo "WARNING: pnpm audit found vulnerabilities"
+
+      - name: Biome Linter
+        run: pnpm biome:lint
+
+      - name: TypeScript Typecheck
+        run: pnpm typecheck
+
+      - name: Run Tests
+        run: pnpm test

.gitea/workflows/renovate.yaml

@@ -1,8 +1,8 @@
 name: Renovate
 on:
   schedule:
-    - cron: "0 5 * * *" # every day at 05:00
-  workflow_dispatch: # manual trigger
+    - cron: "0 5 * * *" # Every day at 05:00 UTC
+  workflow_dispatch: # Manual trigger
 
 jobs:
   renovate:
@@ -11,7 +11,13 @@ jobs:
       - name: Self-hosted Renovate
         run: |
           set -e
+          
+          # Zorg ervoor dat de cache-map lokaal bestaat vóór Docker start
+          # Dit voorkomt dat Docker de map automatisch als 'root' aanmaakt
+          mkdir -p /var/tmp/renovate-cache
+
           docker run --rm \
+            --user "$(id -u):$(id -g)" \
             -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
             -e RENOVATE_AUTODISCOVER=false \
             -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \