.gitea/workflows/renovate.yml

@@ -79,7 +79,7 @@ jobs:
           RENOVATE_REQUIRE_CONFIG: required
           RENOVATE_PR_CONCURRENT_LIMIT: "3"
           RENOVATE_BRANCH_CONCURRENT_LIMIT: "5"
-          LOG_LEVEL: info
+          LOG_LEVEL: debug
         run: |
           echo "=== Running Renovate Bot ==="
           TARGET_REPO="DarkHelm.org/plex-playlist"
@@ -116,6 +116,24 @@ jobs:
             export NODE_TLS_REJECT_UNAUTHORIZED=0
           fi
 
+          VERSION_STATUS=$(curl -sS -o /tmp/renovate-version-check.json -w "%{http_code}" \
+            ${CURL_INSECURE_FLAG} \
+            "${API_ENDPOINT}/version" || true)
+          PLATFORM_VERSION=""
+          if [ "${VERSION_STATUS}" = "200" ]; then
+            PLATFORM_VERSION=$(sed -n 's/.*"version":"\([^"]*\)".*/\1/p' /tmp/renovate-version-check.json | head -n 1)
+            if [ -n "${PLATFORM_VERSION}" ]; then
+              export RENOVATE_X_PLATFORM_VERSION="${PLATFORM_VERSION}"
+              echo "✓ Gitea version preflight passed: ${RENOVATE_X_PLATFORM_VERSION}"
+            else
+              echo "⚠ Gitea version preflight returned 200 but version could not be parsed"
+              cat /tmp/renovate-version-check.json || true
+            fi
+          else
+            echo "⚠ Gitea version preflight failed with status ${VERSION_STATUS}"
+            cat /tmp/renovate-version-check.json || true
+          fi
+
           select_token_with_repo_access() {
             for candidate_name in RENOVATE_TOKEN_SECRET ACTIONS_TRIGGER_TOKEN PACKAGE_ACCESS_TOKEN; do
               candidate_value="${!candidate_name:-}"
@@ -176,6 +194,17 @@ jobs:
 
           echo "✓ Renovate auth preflight passed with ${SELECTED_TOKEN_SOURCE}"
 
+          echo "=== Renovate container connectivity preflight ==="
+          # Prove whether the same image/container path Renovate uses can reach Gitea.
+          # If this fails, the problem is container network/TLS resolution, not Renovate config.
+          # shellcheck disable=SC2086
+          docker run --rm ${DOCKER_ADD_HOST_ARG} \
+            -e API_ENDPOINT="${API_ENDPOINT}" \
+            -e RENOVATE_TOKEN \
+            -e NODE_TLS_REJECT_UNAUTHORIZED \
+            "${RENOVATE_IMAGE}" \
+            node -e 'const endpoints = [["version", `${process.env.API_ENDPOINT}/version`, {}], ["user", `${process.env.API_ENDPOINT}/user`, { headers: { Authorization: `token ${process.env.RENOVATE_TOKEN}` } }]]; let failed = false; (async () => { for (const [name, url, options] of endpoints) { try { const response = await fetch(url, options); console.log(`container_${name}_status=${response.status}`); if (!response.ok) { failed = true; console.log(`container_${name}_body_start`); console.log((await response.text()).slice(0, 1000)); console.log(`container_${name}_body_end`); } } catch (error) { failed = true; console.log(`container_${name}_error=${error instanceof Error ? error.message : String(error)}`); } } if (failed) { process.exit(1); } })();'
+
           # Run Renovate with configuration
           if [ "${RENOVATE_DRY_RUN}" = "true" ]; then
             export RENOVATE_DRY_RUN="full"
@@ -195,6 +224,7 @@ jobs:
               -e NODE_TLS_REJECT_UNAUTHORIZED \
               -e RENOVATE_TOKEN \
               -e RENOVATE_HOST_RULES \
+              -e RENOVATE_X_PLATFORM_VERSION \
               -e RENOVATE_PLATFORM \
               -e RENOVATE_ENDPOINT \
               -e RENOVATE_DRY_RUN \