.gitea/workflows/renovate.yml

@@ -63,10 +63,14 @@ jobs:
         run: |
           echo "=== Configuring Renovate for Gitea ==="
 
+          CONFIG_DIR="${RUNNER_TEMP:-/tmp}/renovate-config"
+          CONFIG_FILE="${CONFIG_DIR}/renovate-config.js"
+          mkdir -p "${CONFIG_DIR}"
+
           # Renovate reads RENOVATE_TOKEN, RENOVATE_PLATFORM, RENOVATE_ENDPOINT,
           # and RENOVATE_GIT_AUTHOR directly from the environment at runtime.
           # Keeping the config file minimal avoids repeated migration warnings.
-          cat > renovate-config.js << 'EOF'
+          cat > "${CONFIG_FILE}" << 'EOF'
           module.exports = {
             platform: 'gitea',
             endpoint: 'https://dogar.darkhelm.org/api/v1',
@@ -80,6 +84,7 @@ jobs:
           };
           EOF
 
+          echo "RENOVATE_CONFIG_FILE_HOST=${CONFIG_FILE}" >> "$GITHUB_ENV"
           echo "✓ Renovate configuration created"
 
       - name: Run Renovate
@@ -89,7 +94,7 @@ jobs:
           ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
           PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           RENOVATE_DRY_RUN: ${{ inputs.dry_run }}
-          RENOVATE_CONFIG_FILE: renovate-config.js
+          RENOVATE_CONFIG_FILE: /renovate-config/renovate-config.js
           RENOVATE_PLATFORM: gitea
           RENOVATE_ENDPOINT: https://dogar.darkhelm.org
           RENOVATE_ALLOW_INSECURE_TLS: "true"
@@ -184,16 +189,20 @@ jobs:
             unset RENOVATE_DRY_RUN
           fi
 
+          if [ ! -f "${RENOVATE_CONFIG_FILE_HOST:-}" ]; then
+            echo "❌ Renovate config file missing on host: ${RENOVATE_CONFIG_FILE_HOST:-unset}"
+            exit 1
+          fi
+
           docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
+            -v "$(dirname "${RENOVATE_CONFIG_FILE_HOST}"):/renovate-config:ro" \
             -e LOG_LEVEL \
             -e NODE_TLS_REJECT_UNAUTHORIZED \
             -e RENOVATE_TOKEN \
             -e RENOVATE_PLATFORM \
             -e RENOVATE_ENDPOINT \
             -e RENOVATE_DRY_RUN \
-            -e RENOVATE_CONFIG_FILE=/work/renovate-config.js \
+            -e RENOVATE_CONFIG_FILE \
             "${RENOVATE_IMAGE}" \
             --platform "${RENOVATE_PLATFORM}" \
             --endpoint "${RENOVATE_ENDPOINT}" \