docs(dev): document Renovate manual dispatch behavior

Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>

.gitea/workflows/cicd.yaml

@@ -1173,7 +1173,7 @@ jobs:
             return 1
           }
 
-          DEPLOYABLE_BACKEND_REPO="${GITEA_REGISTRY}/darkhelm.org/deployable-backend-staging"
+          DEPLOYABLE_BACKEND_REPO="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-backend-staging"
           DEPLOYABLE_BACKEND_TAG_REF="${DEPLOYABLE_BACKEND_REPO}:${HEAD_SHA}"
           DEPLOYABLE_BACKEND_CACHE_REF="${DEPLOYABLE_BACKEND_REPO}:cache"
 
@@ -1182,11 +1182,11 @@ jobs:
           DOCKER_BUILDKIT=1 docker build -f Dockerfile.backend \
             --cache-from "${DEPLOYABLE_BACKEND_CACHE_REF}" \
             --build-arg BUILDKIT_INLINE_CACHE=1 \
-            -t deployable-backend:"${HEAD_SHA}" .
-          bash ./scripts/verify-deployable-image-purity.sh --image deployable-backend:"${HEAD_SHA}" --profile backend
+            -t plex-playlist-backend:"${HEAD_SHA}" .
+          bash ./scripts/verify-deployable-image-purity.sh --image plex-playlist-backend:"${HEAD_SHA}" --profile backend
 
-          docker tag "deployable-backend:${HEAD_SHA}" "${DEPLOYABLE_BACKEND_TAG_REF}"
-          docker tag "deployable-backend:${HEAD_SHA}" "${DEPLOYABLE_BACKEND_CACHE_REF}"
+          docker tag "plex-playlist-backend:${HEAD_SHA}" "${DEPLOYABLE_BACKEND_TAG_REF}"
+          docker tag "plex-playlist-backend:${HEAD_SHA}" "${DEPLOYABLE_BACKEND_CACHE_REF}"
 
           retry_registry_op push "${DEPLOYABLE_BACKEND_TAG_REF}" 5 4
           retry_registry_op push "${DEPLOYABLE_BACKEND_CACHE_REF}" 5 4
@@ -1281,7 +1281,7 @@ jobs:
             return 1
           }
 
-          DEPLOYABLE_FRONTEND_REPO="${GITEA_REGISTRY}/darkhelm.org/deployable-frontend-staging"
+          DEPLOYABLE_FRONTEND_REPO="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-frontend-staging"
           DEPLOYABLE_FRONTEND_TAG_REF="${DEPLOYABLE_FRONTEND_REPO}:${HEAD_SHA}"
           DEPLOYABLE_FRONTEND_CACHE_REF="${DEPLOYABLE_FRONTEND_REPO}:cache"
 
@@ -1291,11 +1291,11 @@ jobs:
             --target production \
             --cache-from "${DEPLOYABLE_FRONTEND_CACHE_REF}" \
             --build-arg BUILDKIT_INLINE_CACHE=1 \
-            -t deployable-frontend:"${HEAD_SHA}" .
-          bash ./scripts/verify-deployable-image-purity.sh --image deployable-frontend:"${HEAD_SHA}" --profile frontend
+            -t plex-playlist-frontend:"${HEAD_SHA}" .
+          bash ./scripts/verify-deployable-image-purity.sh --image plex-playlist-frontend:"${HEAD_SHA}" --profile frontend
 
-          docker tag "deployable-frontend:${HEAD_SHA}" "${DEPLOYABLE_FRONTEND_TAG_REF}"
-          docker tag "deployable-frontend:${HEAD_SHA}" "${DEPLOYABLE_FRONTEND_CACHE_REF}"
+          docker tag "plex-playlist-frontend:${HEAD_SHA}" "${DEPLOYABLE_FRONTEND_TAG_REF}"
+          docker tag "plex-playlist-frontend:${HEAD_SHA}" "${DEPLOYABLE_FRONTEND_CACHE_REF}"
 
           retry_registry_op push "${DEPLOYABLE_FRONTEND_TAG_REF}" 5 4
           retry_registry_op push "${DEPLOYABLE_FRONTEND_CACHE_REF}" 5 4
@@ -2617,12 +2617,12 @@ jobs:
 
           if [ -z "${STAGING_BACKEND_DIGEST_REF}" ]; then
             echo "Staging backend digest output missing; deriving from staging tag ${HEAD_SHA}"
-            STAGING_BACKEND_DIGEST_REF="$(resolve_staging_digest_from_tag "${GITEA_REGISTRY}/darkhelm.org/deployable-backend-staging" "${HEAD_SHA}")"
+            STAGING_BACKEND_DIGEST_REF="$(resolve_staging_digest_from_tag "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-backend-staging" "${HEAD_SHA}")"
           fi
 
           if [ -z "${STAGING_FRONTEND_DIGEST_REF}" ]; then
             echo "Staging frontend digest output missing; deriving from staging tag ${HEAD_SHA}"
-            STAGING_FRONTEND_DIGEST_REF="$(resolve_staging_digest_from_tag "${GITEA_REGISTRY}/darkhelm.org/deployable-frontend-staging" "${HEAD_SHA}")"
+            STAGING_FRONTEND_DIGEST_REF="$(resolve_staging_digest_from_tag "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-frontend-staging" "${HEAD_SHA}")"
           fi
 
           if [ -z "${STAGING_BACKEND_DIGEST_REF}" ] || [ -z "${STAGING_FRONTEND_DIGEST_REF}" ]; then
@@ -2683,8 +2683,8 @@ jobs:
 
           PREVIOUS_RELEASE_VERSION="$(printf '%s\n' "${RELEASE_TAG_LIST}" | awk -v current="${RELEASE_VERSION}" 'NF {if ($0 == current) {print prev; found=1; exit} prev=$0} END {if (!found) print prev}')"
 
-          RELEASE_BACKEND_REPO="${GITEA_REGISTRY}/darkhelm.org/deployable-backend"
-          RELEASE_FRONTEND_REPO="${GITEA_REGISTRY}/darkhelm.org/deployable-frontend"
+          RELEASE_BACKEND_REPO="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-backend"
+          RELEASE_FRONTEND_REPO="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-frontend"
 
           BACKEND_RELEASE_VERSION_REF="${RELEASE_BACKEND_REPO}:${RELEASE_VERSION}"
           BACKEND_RELEASE_TAGGED_REF="${RELEASE_BACKEND_REPO}:${RELEASE_TAGGED_VERSION}"

.gitea/workflows/renovate.yml

@@ -180,7 +180,7 @@ jobs:
           RENOVATE_NODE_ARGS: --max-old-space-size=768
           RENOVATE_OSV_VULNERABILITY_ALERTS: "false"
           RENOVATE_FETCH_CHANGELOGS: "off"
-          LOG_LEVEL: info
+          LOG_LEVEL: debug
         run: |
           set -euo pipefail
 
@@ -401,9 +401,11 @@ jobs:
           # Manual workflow dispatch should execute immediately, regardless of repository schedule windows.
           if [ "${GITHUB_EVENT_NAME:-}" = "workflow_dispatch" ]; then
             export RENOVATE_IGNORE_SCHEDULE="true"
-            echo "✓ Manual run detected: ignoring Renovate schedule constraints"
+            export RENOVATE_SCHEDULE="at any time"
+            echo "✓ Manual run detected: forcing Renovate outside schedule windows"
           else
             unset RENOVATE_IGNORE_SCHEDULE
+            unset RENOVATE_SCHEDULE
           fi
 
           # Multi-batch runs must not prune branches created by earlier batches.
@@ -412,22 +414,16 @@ jobs:
           run_renovate_with_endpoint() {
             endpoint="$1"
             enabled_managers="$2"
-            batch_label="$3"
-            batch_node_args="${RENOVATE_NODE_ARGS}"
-            batch_pr_limit="${RENOVATE_PR_CONCURRENT_LIMIT}"
-            batch_branch_limit="${RENOVATE_BRANCH_CONCURRENT_LIMIT}"
 
-            if [ "${batch_label}" = "npm" ]; then
-              batch_node_args="--max-old-space-size=1536"
-              batch_pr_limit="1"
-              batch_branch_limit="1"
-            fi
+            single_pass_node_args="${RENOVATE_NODE_ARGS}"
+            single_pass_pr_limit="${RENOVATE_PR_CONCURRENT_LIMIT}"
+            single_pass_branch_limit="${RENOVATE_BRANCH_CONCURRENT_LIMIT}"
 
             export RENOVATE_ENDPOINT="${endpoint}"
-            echo "Running Renovate batch '${batch_label}' with endpoint: ${RENOVATE_ENDPOINT}"
-            echo "Enabled managers for '${batch_label}': ${enabled_managers}"
-            echo "Node args for '${batch_label}': ${batch_node_args}"
-            echo "PR/branch limits for '${batch_label}': ${batch_pr_limit}/${batch_branch_limit}"
+            echo "Running Renovate single pass with endpoint: ${RENOVATE_ENDPOINT}"
+            echo "Enabled managers: ${enabled_managers}"
+            echo "Node args: ${single_pass_node_args}"
+            echo "PR/branch limits: ${single_pass_pr_limit}/${single_pass_branch_limit}"
 
             # shellcheck disable=SC2086
             docker run --rm ${DOCKER_ADD_HOST_ARG} \
@@ -448,12 +444,13 @@ jobs:
               -e RENOVATE_GIT_AUTHOR \
               -e RENOVATE_ONBOARDING \
               -e RENOVATE_REQUIRE_CONFIG \
-              -e RENOVATE_PR_CONCURRENT_LIMIT="${batch_pr_limit}" \
-              -e RENOVATE_BRANCH_CONCURRENT_LIMIT="${batch_branch_limit}" \
-              -e RENOVATE_NODE_ARGS="${batch_node_args}" \
+              -e RENOVATE_PR_CONCURRENT_LIMIT="${single_pass_pr_limit}" \
+              -e RENOVATE_BRANCH_CONCURRENT_LIMIT="${single_pass_branch_limit}" \
+              -e RENOVATE_NODE_ARGS="${single_pass_node_args}" \
               -e RENOVATE_OSV_VULNERABILITY_ALERTS \
               -e RENOVATE_FETCH_CHANGELOGS \
               -e RENOVATE_IGNORE_SCHEDULE \
+              -e RENOVATE_SCHEDULE \
               -e RENOVATE_PRUNE_STALE_BRANCHES \
               -e RENOVATE_ENABLED_MANAGERS="${enabled_managers}" \
               --entrypoint /bin/sh \
@@ -469,30 +466,27 @@ jobs:
                     renovate --platform "${RENOVATE_PLATFORM}" --endpoint "${RENOVATE_ENDPOINT}" --git-url "${RENOVATE_GIT_URL}" --git-author "${RENOVATE_GIT_AUTHOR}" --onboarding="${RENOVATE_ONBOARDING}" --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" --osv-vulnerability-alerts="${RENOVATE_OSV_VULNERABILITY_ALERTS}" --enabled-managers "${RENOVATE_ENABLED_MANAGERS}" DarkHelm.org/plex-playlist'
           }
 
-          run_batch_with_fallback() {
+          run_single_pass_with_fallback() {
             enabled_managers="$1"
-            batch_label="$2"
 
-            if run_renovate_with_endpoint "${BASE_ENDPOINT}" "${enabled_managers}" "${batch_label}" 2>&1 | tee -a /tmp/renovate.log; then
+            if run_renovate_with_endpoint "${BASE_ENDPOINT}" "${enabled_managers}" 2>&1 | tee -a /tmp/renovate.log; then
               return 0
             fi
 
             primary_status=$?
             if [ "${primary_status}" -eq 137 ] || tail -n 400 /tmp/renovate.log | grep -qE '(^|[[:space:]])Killed($|[[:space:]])|exitcode '\''137'\''' ; then
-              echo "❌ Renovate batch '${batch_label}' terminated by OOM/kill signal on primary endpoint; skipping endpoint retry"
+              echo "❌ Renovate single pass terminated by OOM/kill signal on primary endpoint; skipping endpoint retry"
               return "${primary_status}"
             fi
 
-            echo "⚠ Renovate batch '${batch_label}' failed with primary endpoint. Retrying with API endpoint form..."
-            run_renovate_with_endpoint "${API_ENDPOINT}" "${enabled_managers}" "${batch_label}" 2>&1 | tee -a /tmp/renovate.log
+            echo "⚠ Renovate single pass failed with primary endpoint. Retrying with API endpoint form..."
+            run_renovate_with_endpoint "${API_ENDPOINT}" "${enabled_managers}" 2>&1 | tee -a /tmp/renovate.log
           }
 
           : > /tmp/renovate.log
 
-          # Run low-memory batches sequentially to keep peak usage below constrained runner limits.
-          run_batch_with_fallback "docker-compose,dockerfile" "containers"
-          run_batch_with_fallback "github-actions,pep621" "python-and-actions"
-          run_batch_with_fallback "npm" "npm"
+          # Run Renovate once across all enabled managers.
+          run_single_pass_with_fallback "docker-compose,dockerfile,github-actions,npm,pep621"
 
           echo "✓ Renovate execution completed"
 

backend/pyproject.toml

@@ -37,7 +37,7 @@ classifiers = [
 dependencies = [
   "fastapi==0.139.0",
   "sqlalchemy==2.0.51",
-  "psycopg[binary]==3.2.12",
+  "psycopg[binary]==3.3.4",
   "uvicorn==0.51.0"
 ]
 description = "Backend service for Plex playlist management"

compose.ci.e2e.yml

@@ -13,7 +13,7 @@ services:
       retries: 12
 
   backend:
-    image: ${DEPLOYABLE_BACKEND_IMAGE:-deployable-backend:local}
+    image: ${DEPLOYABLE_BACKEND_IMAGE:-plex-playlist-backend:local}
     environment:
       DATABASE_URL: ${DB_URL:-postgresql://plex_user:plex_password@database:5432/plex_playlist}
       ENVIRONMENT: production
@@ -22,7 +22,7 @@ services:
         condition: service_healthy
 
   frontend:
-    image: ${DEPLOYABLE_FRONTEND_IMAGE:-deployable-frontend:local}
+    image: ${DEPLOYABLE_FRONTEND_IMAGE:-plex-playlist-frontend:local}
     depends_on:
       backend:
         condition: service_started

compose.ci.integration.yml

@@ -13,7 +13,7 @@ services:
       retries: 12
 
   backend:
-    image: ${DEPLOYABLE_BACKEND_IMAGE:-deployable-backend:local}
+    image: ${DEPLOYABLE_BACKEND_IMAGE:-plex-playlist-backend:local}
     environment:
       DATABASE_URL: ${DB_URL:-postgresql://plex_user:plex_password@database:5432/plex_playlist}
       ENVIRONMENT: production

docs/CICD_SUCCESS_SUMMARY.md

@@ -72,12 +72,12 @@
 ### **Current Release Lifecycle (2026-07)**
 
 - Runtime deployable images are published first to staging repositories:
-  - `deployable-backend-staging`
-  - `deployable-frontend-staging`
+  - `plex-playlist-backend-staging`
+  - `plex-playlist-frontend-staging`
 - Runtime validation (`Runtime Black-Box Integration Tests` and `End-to-End Tests`) must pass before release tagging.
 - `Promote Release Images` retags validated staging artifacts to release repositories, but only on automated `push` runs to `main`:
-  - `deployable-backend`
-  - `deployable-frontend`
+  - `plex-playlist-backend`
+  - `plex-playlist-frontend`
 - Published release tags:
   - `latest`
   - `v<major>.<minor>.0`

docs/DEPLOYABLE_RUNTIME_CONTRACT.md

@@ -14,10 +14,10 @@ automation work under epic #66.
 Lifecycle note:
 
 - CI first builds deployable runtime artifacts in staging repositories
-  (`deployable-backend-staging`, `deployable-frontend-staging`).
+  (`plex-playlist-backend-staging`, `plex-playlist-frontend-staging`).
 - After integration and E2E validation pass, CI promotes those immutable
-  artifacts to release repositories (`deployable-backend`,
-  `deployable-frontend`) via tag promotion.
+  artifacts to release repositories (`plex-playlist-backend`,
+  `plex-playlist-frontend`) via tag promotion.
 
 Included:
 

docs/DEVELOPMENT.md

@@ -411,11 +411,11 @@ The pipeline is intentionally staged so expensive image jobs run only after sour
 2. Source + audit lanes:
    `Source Checks` and `Dependency Audits (Informational)` run after producer completion. Audit failures are intentionally non-blocking so both frontend and backend audits always report.
 3. Runtime image lanes:
-   `Build Release Images` publishes `deployable-backend-staging` and `deployable-frontend-staging`; `Build Tester Images` publishes integration/e2e tester images; then `Production Images Complete` gates downstream runtime tests.
+   `Build Release Images` publishes `plex-playlist-backend-staging` and `plex-playlist-frontend-staging`; `Build Tester Images` publishes integration/e2e tester images; then `Production Images Complete` gates downstream runtime tests.
 4. Runtime validation lanes:
    `Runtime Black-Box Integration Tests` and `End-to-End Tests` validate staged runtime artifacts.
 5. Promotion lane:
-   `Promote Release Images` runs only for automated `push` events on `main`. It retags validated staging artifacts to release repos (`deployable-backend`, `deployable-frontend`) with `latest`, `v<major>.<minor>.0`, `v<major>.<minor>.<patch>`, and `v<major>.<minor>.<patch>-<7-char-short-sha>` tags. If the `main` commit is untagged, CI creates the next patch tag automatically; if no prior semver tag exists, the bootstrap baseline is `v0.0.0`.
+   `Promote Release Images` runs only for automated `push` events on `main`. It retags validated staging artifacts to release repos (`plex-playlist-backend`, `plex-playlist-frontend`) with `latest`, `v<major>.<minor>.0`, `v<major>.<minor>.<patch>`, and `v<major>.<minor>.<patch>-<7-char-short-sha>` tags. If the `main` commit is untagged, CI creates the next patch tag automatically; if no prior semver tag exists, the bootstrap baseline is `v0.0.0`.
 6. Postmortem lanes:
    targeted postmortem jobs run when key lanes fail to capture diagnostics even when primary jobs fail early.
 
@@ -433,6 +433,16 @@ Current workflow behavior includes:
 For details of base/complete image build strategy, see [CI/CD Multi-Stage Build Architecture](CICD_MULTI_STAGE_BUILD.md).
 For incident handling, see [CI/CD Troubleshooting](CICD_TROUBLESHOOTING_GUIDE.md).
 
+### Renovate Manual Run Behavior
+
+The Renovate workflow at `.gitea/workflows/renovate.yml` now treats manual dispatch as an explicit operator override:
+
+- when triggered via `workflow_dispatch`, it forces out-of-window execution by setting `RENOVATE_IGNORE_SCHEDULE=true`
+- it also sets `RENOVATE_SCHEDULE="at any time"` for the run
+- it executes one single pass across enabled managers instead of splitting work into multiple manager batches
+
+This keeps scheduled behavior unchanged while making manual runs deterministic and immediate.
+
 ### Operator Quick Reference
 
 Use workflow dispatch when you need deterministic reruns on a specific commit:

scripts/run-ci-e2e-compose.sh

@@ -7,8 +7,8 @@ PROJECT_NAME="${COMPOSE_PROJECT_NAME:-plex-e2e-local}"
 
 mkdir -p "${ROOT_DIR}/frontend/.playwright-artifacts"
 
-export DEPLOYABLE_BACKEND_IMAGE="${DEPLOYABLE_BACKEND_IMAGE:-deployable-backend:local}"
-export DEPLOYABLE_FRONTEND_IMAGE="${DEPLOYABLE_FRONTEND_IMAGE:-deployable-frontend:local}"
+export DEPLOYABLE_BACKEND_IMAGE="${DEPLOYABLE_BACKEND_IMAGE:-plex-playlist-backend:local}"
+export DEPLOYABLE_FRONTEND_IMAGE="${DEPLOYABLE_FRONTEND_IMAGE:-plex-playlist-frontend:local}"
 export DB_PASSWORD="${DB_PASSWORD:-plex_password}"
 export DB_URL="${DB_URL:-postgresql://plex_user:${DB_PASSWORD}@database:5432/plex_playlist}"
 export E2E_ARTIFACT_DIR="${E2E_ARTIFACT_DIR:-${ROOT_DIR}/frontend/.playwright-artifacts}"

scripts/run-ci-integration-compose.sh

@@ -5,7 +5,7 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 COMPOSE_FILE="${ROOT_DIR}/compose.ci.integration.yml"
 PROJECT_NAME="${COMPOSE_PROJECT_NAME:-plex-int-local}"
 
-export DEPLOYABLE_BACKEND_IMAGE="${DEPLOYABLE_BACKEND_IMAGE:-deployable-backend:local}"
+export DEPLOYABLE_BACKEND_IMAGE="${DEPLOYABLE_BACKEND_IMAGE:-plex-playlist-backend:local}"
 export DB_PASSWORD="${DB_PASSWORD:-plex_password}"
 export DB_URL="${DB_URL:-postgresql://plex_user:${DB_PASSWORD}@database:5432/plex_playlist}"
 
@@ -15,7 +15,7 @@ cleanup() {
 
 trap cleanup EXIT
 
-echo "Running runtime integration checks against deployable backend image via compose"
+echo "Running runtime integration checks against plex-playlist backend image via compose"
 echo "DEPLOYABLE_BACKEND_IMAGE=${DEPLOYABLE_BACKEND_IMAGE}"
 
 docker compose -p "${PROJECT_NAME}" -f "${COMPOSE_FILE}" up -d database backend