From 8c925d2b397e21f3f46a0e94d4f8a5eef95e3efc Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Mon, 13 Jul 2026 15:50:20 -0400
Subject: [PATCH] fix: harden renovate datasource access and registry
 reliability

---
 .gitea/workflows/renovate.yml | 25 ++++++++++++++++++++++++-
 Dockerfile.e2e-tester         |  2 +-
 scripts/run-ci-e2e-compose.sh |  2 +-
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index da978ea..4ba4159 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -103,6 +103,7 @@ jobs:
         env:
           # Prefer dedicated Renovate token, then fall back to existing CI tokens.
           RENOVATE_TOKEN_SECRET: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
           ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
           PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           RENOVATE_DRY_RUN: ${{ inputs.dry_run }}
@@ -120,6 +121,7 @@ jobs:
           RENOVATE_BRANCH_CONCURRENT_LIMIT: "5"
           RENOVATE_NODE_ARGS: --max-old-space-size=768
           RENOVATE_OSV_VULNERABILITY_ALERTS: "false"
+          RENOVATE_FETCH_CHANGELOGS: "off"
           LOG_LEVEL: debug
         run: |
           set -euo pipefail
@@ -288,7 +290,18 @@ jobs:
           SELECTED_TOKEN_SOURCE="${SELECTED_TOKEN_RESULT%%:*}"
           SELECTED_TOKEN="${SELECTED_TOKEN_RESULT#*:}"
           export RENOVATE_TOKEN="${SELECTED_TOKEN}"
-          export RENOVATE_HOST_RULES="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"}]"
+          RENOVATE_HOST_RULES_PAYLOAD="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"},{\"matchHost\":\"registry.npmjs.org\",\"timeout\":180000,\"concurrentRequestLimit\":4},{\"matchHost\":\"mcr.microsoft.com\",\"timeout\":180000,\"concurrentRequestLimit\":2}]"
+
+          # Authenticate GitHub datasource calls to avoid anonymous GraphQL rate limiting.
+          if [ -n "${RENOVATE_GITHUB_COM_TOKEN:-}" ]; then
+            RENOVATE_HOST_RULES_PAYLOAD="${RENOVATE_HOST_RULES_PAYLOAD%]}"
+            RENOVATE_HOST_RULES_PAYLOAD="${RENOVATE_HOST_RULES_PAYLOAD},{\"matchHost\":\"api.github.com\",\"hostType\":\"github\",\"token\":\"${RENOVATE_GITHUB_COM_TOKEN}\"}]"
+            echo "✓ Using RENOVATE_GITHUB_COM_TOKEN for GitHub datasource requests"
+          else
+            echo "⚠ RENOVATE_GITHUB_COM_TOKEN is not set; GitHub datasource may hit anonymous rate limits"
+          fi
+
+          export RENOVATE_HOST_RULES="${RENOVATE_HOST_RULES_PAYLOAD}"
           # Rewrite external clone URLs to local-network git transport.
           export RENOVATE_GIT_REWRITE_FROM="https://dogar.darkhelm.org/"
           export RENOVATE_GIT_REWRITE_TO="http://${RENOVATE_GIT_USERNAME}:${SELECTED_TOKEN}@kankali.darkhelm.lan:3001/"
@@ -327,6 +340,14 @@ jobs:
             unset RENOVATE_DRY_RUN
           fi
 
+          # Manual workflow dispatch should execute immediately, regardless of repository schedule windows.
+          if [ "${GITHUB_EVENT_NAME:-}" = "workflow_dispatch" ]; then
+            export RENOVATE_IGNORE_SCHEDULE="true"
+            echo "✓ Manual run detected: ignoring Renovate schedule constraints"
+          else
+            unset RENOVATE_IGNORE_SCHEDULE
+          fi
+
           run_renovate_with_endpoint() {
             endpoint="$1"
             export RENOVATE_ENDPOINT="${endpoint}"
@@ -355,6 +376,8 @@ jobs:
               -e RENOVATE_BRANCH_CONCURRENT_LIMIT \
               -e RENOVATE_NODE_ARGS \
               -e RENOVATE_OSV_VULNERABILITY_ALERTS \
+              -e RENOVATE_FETCH_CHANGELOGS \
+              -e RENOVATE_IGNORE_SCHEDULE \
               --entrypoint /bin/sh \
               "${RENOVATE_IMAGE}" \
                 -lc 'set -e
diff --git a/Dockerfile.e2e-tester b/Dockerfile.e2e-tester
index a79f3ea..1d4f5c4 100644
--- a/Dockerfile.e2e-tester
+++ b/Dockerfile.e2e-tester
@@ -1,4 +1,4 @@
-ARG PLAYWRIGHT_BASE_IMAGE=mcr.microsoft/playwright:v1.56.1-jammy
+ARG PLAYWRIGHT_BASE_IMAGE=mcr.microsoft.com/playwright:v1.56.1-jammy
 FROM ${PLAYWRIGHT_BASE_IMAGE}
 
 WORKDIR /workspace/frontend
diff --git a/scripts/run-ci-e2e-compose.sh b/scripts/run-ci-e2e-compose.sh
index bf0e55b..6627171 100644
--- a/scripts/run-ci-e2e-compose.sh
+++ b/scripts/run-ci-e2e-compose.sh
@@ -34,5 +34,5 @@ docker run --rm \
   -e PLAYWRIGHT_JUNIT_OUTPUT_FILE=/tmp/playwright-artifacts/playwright-results.xml \
   -v "${ROOT_DIR}/frontend:/workspace/frontend" \
   -v "${E2E_ARTIFACT_DIR}:/tmp/playwright-artifacts" \
-  mcr.microsoft/playwright:v1.56.1-jammy \
+  mcr.microsoft.com/playwright:v1.56.1-jammy \
   bash -lc "cd /workspace/frontend && corepack enable && yarn install --immutable && yarn test:e2e --reporter=list --timeout=90000"