.gitea/workflows/renovate.yml

@@ -105,6 +105,7 @@ jobs:
           RENOVATE_TOKEN_SECRET: ${{ secrets.RENOVATE_TOKEN }}
           ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
           PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          RENOVATE_CONFIG_REF: ${{ github.ref_name }}
           RENOVATE_DRY_RUN: ${{ inputs.dry_run }}
           RENOVATE_PLATFORM: gitea
           RENOVATE_ENDPOINT_INTERNAL: http://kankali.darkhelm.lan:3001/api/v1
@@ -128,11 +129,7 @@ jobs:
           TARGET_REPO="DarkHelm.org/plex-playlist"
           TARGET_ORG="${TARGET_REPO%%/*}"
           RENOVATE_CONFIG_PATH="/tmp/renovate-config.json"
-
-          if ! git show HEAD:renovate.json > "${RENOVATE_CONFIG_PATH}"; then
-            echo "❌ Expected Renovate config not found in git HEAD: renovate.json"
-            exit 1
-          fi
+          RENOVATE_CONFIG_PAYLOAD="/tmp/renovate-config-payload.json"
 
           CURL_INSECURE_FLAG=""
           if [ "${RENOVATE_ALLOW_INSECURE_TLS:-false}" = "true" ]; then
@@ -219,6 +216,25 @@ jobs:
           echo "Renovate git base URL override: ${RENOVATE_GIT_URL}"
           echo "Preflight API endpoint: ${API_ENDPOINT}"
 
+          CONFIG_FETCH_TOKEN="${RENOVATE_TOKEN_SECRET:-${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}}"
+          if [ -z "${CONFIG_FETCH_TOKEN}" ]; then
+            echo "❌ No token available to fetch renovate.json from the repo contents API"
+            exit 1
+          fi
+
+          if ! curl -sS ${CURL_INSECURE_FLAG} \
+            -H "Authorization: token ${CONFIG_FETCH_TOKEN}" \
+            "${API_ENDPOINT}/repos/${TARGET_REPO}/contents/renovate.json?ref=${RENOVATE_CONFIG_REF}" \
+            -o "${RENOVATE_CONFIG_PAYLOAD}"; then
+            echo "❌ Expected Renovate config could not be fetched from the repo contents API at ref ${RENOVATE_CONFIG_REF}"
+            exit 1
+          fi
+
+            if ! python3 -c 'import base64, json, sys; output_path = sys.argv[1]; payload_path = sys.argv[2]; payload = json.load(open(payload_path, encoding="utf-8")); content = payload.get("content"); raise SystemExit(1) if not content else None; open(output_path, "wb").write(base64.b64decode(content.replace("\n", "")))' "${RENOVATE_CONFIG_PATH}" "${RENOVATE_CONFIG_PAYLOAD}"; then
+            echo "❌ Expected Renovate config could not be decoded from the repo contents API response at ref ${RENOVATE_CONFIG_REF}"
+            exit 1
+          fi
+
           PLATFORM_VERSION=""
           if [ "${VERSION_STATUS}" = "200" ]; then
             PLATFORM_VERSION=$(sed -n 's/.*"version":"\([^"]*\)".*/\1/p' /tmp/renovate-version-check.json | head -n 1)