feat(renovate): add self-hosted Renovate config and Gitea Actions workflow

Run the pinned renovate/renovate image on the host runner every weekday at
04:17 (plus workflow_dispatch) against the gitea platform, authenticating with
the renovate-bot RENOVATE_TOKEN Actions secret. Minor and patch updates are
grouped and automerged only after CI passes; majors wait for dashboard
approval. Document the bot, secret rotation and the minimumReleaseAge policy in
the error-centre runbook.

.gitea/workflows/renovate.yaml

@@ -0,0 +1,42 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "17 4 * * 1-5"
+  workflow_dispatch:
+    inputs:
+      debug:
+        description: "Debug-loglevel"
+        type: boolean
+        default: false
+
+# Niet overlappen met zichzelf; een tweede start wacht tot de eerste klaar is.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+env:
+  RENOVATE_VERSION: 44.164.10 # renovate: datasource=npm depName=renovate
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          LOG_LEVEL: ${{ github.event.inputs.debug == 'true' && 'debug' || 'info' }}
+        shell: bash
+        run: |
+          docker run --rm \
+            --memory=6g \
+            --memory-swap=6g \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT=https://gitlab.epicnabbo.nl/ \
+            -e RENOVATE_TOKEN \
+            -e RENOVATE_REPOSITORIES='["remco/EpicNext-Cms"]' \
+            -e RENOVATE_AUTODISCOVER=false \
+            -e RENOVATE_BINARY_SOURCE=install \
+            -e LOG_LEVEL \
+            "renovate/renovate:${RENOVATE_VERSION}"

docs/operations/cms-error-center.md

@@ -56,9 +56,18 @@ Lenis has been removed; the public site now uses native scrolling. Other used
 runtime libraries remain. Vitest and its coverage provider are upgraded together;
 `clearMocks: false` preserves initialization-time permission contract assertions.
 
-Dependency updates are manual: Renovate has been removed, so there is no bot
-opening upgrade pull requests. Node/pnpm upgrades remain coordinated with
-Docker and the runner toolchain.
+Dependency updates run through self-hosted Renovate: `renovate.json` plus
+`.gitea/workflows/renovate.yaml` run the pinned `renovate/renovate` image on the
+host runner every weekday at 04:17 (and via `workflow_dispatch`). Minor and patch
+updates are grouped into one PR and automerged only after CI is green
+(`platformAutomerge: false`, so Renovate waits on the checks itself); major
+updates require approval on the dependency dashboard. The job authenticates with
+the `renovate-bot` account token stored as the repo Actions secret
+`RENOVATE_TOKEN`; rotation only requires overwriting that secret (the bot
+password lives in `/root/.gitea-renovate-bot.env` on the host). `minimumReleaseAge`
+is 3 days in `renovate.json` and 60 hours in `pnpm-workspace.yaml`, so neither the
+installer nor the bot picks up a fresh release on day zero. Node/pnpm upgrades
+remain coordinated with Docker and the runner toolchain.
 Obsolete global overrides were removed; a scoped esbuild override remains because
 Drizzle Kit's loader still resolves a vulnerable legacy development-server build.
 The two deprecated esbuild-kit packages remain upstream dependencies of Drizzle

renovate.json

@@ -0,0 +1,37 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": [
+		"config:recommended",
+		":timezone(Europe/Amsterdam)",
+		":semanticCommits",
+		"workarounds:all"
+	],
+	"labels": ["dependencies"],
+	"dependencyDashboard": true,
+	"prConcurrentLimit": 5,
+	"prHourlyLimit": 3,
+	"minimumReleaseAge": "3 days",
+	"lockFileMaintenance": {
+		"enabled": true
+	},
+	"packageRules": [
+		{
+			"description": "Minor en patch: één groeps-PR, automerge pas na groene CI",
+			"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+			"groupName": "all non-major dependencies",
+			"automerge": true,
+			"platformAutomerge": false
+		},
+		{
+			"description": "Major updates vragen goedkeuring via het dependency-dashboard",
+			"matchUpdateTypes": ["major"],
+			"labels": ["major"],
+			"dependencyDashboardApproval": true
+		},
+		{
+			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
+			"matchManagers": ["docker-compose"],
+			"pinDigests": false
+		}
+	]
+}