From b1a751082a99ffde46e44686e10e04516714b58a Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:06:53 +0200
Subject: [PATCH 01/34] Replace dependabot with renovate for GitHub Actions
 updates

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 .github/dependabot.yml | 10 ----------
 renovate.json          |  8 ++++++++
 2 files changed, 8 insertions(+), 10 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 renovate.json

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index be33b8975fc09..0000000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-version: 2
-
-updates:
-  - package-ecosystem: github-actions
-    labels: [modifies/dependencies]
-    directory: /
-    schedule:
-      interval: daily
-    cooldown:
-      default-days: 5
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000000000..3fb4e8ebafc01
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "enabledManagers": ["github-actions"],
+  "labels": ["modifies/dependencies"],
+  "schedule": ["before 6am"],
+  "minimumReleaseAge": "5 days"
+}

From a0b98c68c7ba4443e8f29f167b8f78002ec0811f Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:29:40 +0200
Subject: [PATCH 02/34] Add cron-renovate workflow with GitHub App token auth

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 25 +++++++++++++++++++++++++
 renovate.json                       |  1 -
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/cron-renovate.yml

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
new file mode 100644
index 0000000000000..62f0091012775
--- /dev/null
+++ b/.github/workflows/cron-renovate.yml
@@ -0,0 +1,25 @@
+name: cron-renovate
+
+on:
+  schedule:
+    - cron: "0 1 * * *" # every day at 01:00 UTC
+  workflow_dispatch:
+
+jobs:
+  cron-renovate:
+    runs-on: ubuntu-latest
+    if: github.repository == 'go-gitea/gitea'
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: get_token
+        with:
+          app-id: ${{ secrets.RENOVATE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: gitea
+      - uses: actions/checkout@v6
+      - uses: renovatebot/github-action@v46
+        with:
+          token: ${{ steps.get_token.outputs.token }}
+        env:
+          RENOVATE_PLATFORM_COMMIT: "true"
diff --git a/renovate.json b/renovate.json
index 3fb4e8ebafc01..c6f4f70b1c5cc 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,6 +3,5 @@
   "extends": ["config:recommended"],
   "enabledManagers": ["github-actions"],
   "labels": ["modifies/dependencies"],
-  "schedule": ["before 6am"],
   "minimumReleaseAge": "5 days"
 }

From c72863fc79dc731c3c11b7a06f8cb7370f16b5f6 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:35:56 +0200
Subject: [PATCH 03/34] Apply suggestion from @silverwind

Signed-off-by: silverwind <me@silverwind.io>
---
 .github/workflows/cron-renovate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 62f0091012775..f2f80eb7a2182 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -22,4 +22,4 @@ jobs:
         with:
           token: ${{ steps.get_token.outputs.token }}
         env:
-          RENOVATE_PLATFORM_COMMIT: "true"
+          RENOVATE_PLATFORM_COMMIT: "true" # commit directly to branch to avoid API rate limits and for commit signing.

From 38d626a4cd7f38f49ac98c6de960649a226936b2 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:41:34 +0200
Subject: [PATCH 04/34] Add explicit branchPrefix to renovate config

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 renovate.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index c6f4f70b1c5cc..beadbc389b4bc 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,5 +3,6 @@
   "extends": ["config:recommended"],
   "enabledManagers": ["github-actions"],
   "labels": ["modifies/dependencies"],
-  "minimumReleaseAge": "5 days"
+  "minimumReleaseAge": "5 days",
+  "branchPrefix": "renovate/"
 }

From 31e1c221ff1a65e3e35b068b4464c50bce6b8434 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:50:08 +0200
Subject: [PATCH 05/34] Add permissions to cron-renovate workflow

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index f2f80eb7a2182..871366fdf322e 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -9,6 +9,8 @@ jobs:
   cron-renovate:
     runs-on: ubuntu-latest
     if: github.repository == 'go-gitea/gitea'
+    permissions:
+      contents: read
     steps:
       - uses: actions/create-github-app-token@v1
         id: get_token

From 21af37e957c24266f12b33c5dddebd1ca2cc5e93 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:52:03 +0200
Subject: [PATCH 06/34] Add comment explaining fork guard condition

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 871366fdf322e..571d0ba368d02 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   cron-renovate:
     runs-on: ubuntu-latest
-    if: github.repository == 'go-gitea/gitea'
+    if: github.repository == 'go-gitea/gitea' # prevent running on forks
     permissions:
       contents: read
     steps:

From 66e1b46d8df1d64c53a3643121ca68b1f2166210 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:54:22 +0200
Subject: [PATCH 07/34] Add comment explaining repository scope

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 571d0ba368d02..25e3cc72baada 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -18,7 +18,7 @@ jobs:
           app-id: ${{ secrets.RENOVATE_APP_ID }}
           private-key: ${{ secrets.RENOVATE_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: gitea
+          repositories: gitea # scope token to this repo only
       - uses: actions/checkout@v6
       - uses: renovatebot/github-action@v46
         with:

From be28ab88ac15a7e13701ac3851fc9e28e13a7681 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:56:37 +0200
Subject: [PATCH 08/34] Rename renovate.json to renovate.json5

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 renovate.json => renovate.json5 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename renovate.json => renovate.json5 (87%)

diff --git a/renovate.json b/renovate.json5
similarity index 87%
rename from renovate.json
rename to renovate.json5
index beadbc389b4bc..f0c4696bd2e0f 100644
--- a/renovate.json
+++ b/renovate.json5
@@ -4,5 +4,5 @@
   "enabledManagers": ["github-actions"],
   "labels": ["modifies/dependencies"],
   "minimumReleaseAge": "5 days",
-  "branchPrefix": "renovate/"
+  "branchPrefix": "renovate/",
 }

From b35ee4252481a9f84615b8715832842ba28a2d82 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Tue, 31 Mar 2026 12:57:56 +0200
Subject: [PATCH 09/34] Add explicit configurationFile to renovate workflow

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 25e3cc72baada..a53062cd7dc3f 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -22,6 +22,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: renovatebot/github-action@v46
         with:
+          configurationFile: renovate.json5
           token: ${{ steps.get_token.outputs.token }}
         env:
           RENOVATE_PLATFORM_COMMIT: "true" # commit directly to branch to avoid API rate limits and for commit signing.

From 3bebfa1255edc5dcad67a0f015f5eb95466a1851 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 21:17:47 +0200
Subject: [PATCH 10/34] Cover go and npm, switch to PAT auth, weekly schedule

- Enable gomod and npm managers with per-ecosystem grouping.
- Run `make tidy` after Go updates and `make svg` after npm updates,
  scoped via packageRules and gated by an allowlist in the workflow.
- Drop the GitHub App token flow; use a single RENOVATE_TOKEN PAT to
  match the gitea.com auth pattern.
- Run weekly (Mondays) instead of daily.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 13 ++++-------
 renovate.json5                      | 35 +++++++++++++++++++++++++++--
 2 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index a53062cd7dc3f..ab19c308b6341 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -2,7 +2,7 @@ name: cron-renovate
 
 on:
   schedule:
-    - cron: "0 1 * * *" # every day at 01:00 UTC
+    - cron: "0 1 * * 1" # every Monday at 01:00 UTC
   workflow_dispatch:
 
 jobs:
@@ -12,17 +12,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/create-github-app-token@v1
-        id: get_token
-        with:
-          app-id: ${{ secrets.RENOVATE_APP_ID }}
-          private-key: ${{ secrets.RENOVATE_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: gitea # scope token to this repo only
       - uses: actions/checkout@v6
       - uses: renovatebot/github-action@v46
         with:
           configurationFile: renovate.json5
-          token: ${{ steps.get_token.outputs.token }}
+          token: ${{ secrets.RENOVATE_TOKEN }}
         env:
           RENOVATE_PLATFORM_COMMIT: "true" # commit directly to branch to avoid API rate limits and for commit signing.
+          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
diff --git a/renovate.json5 b/renovate.json5
index f0c4696bd2e0f..9945eaa4af09c 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,8 +1,39 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "enabledManagers": ["github-actions"],
+  "enabledManagers": ["github-actions", "gomod", "npm"],
   "labels": ["modifies/dependencies"],
-  "minimumReleaseAge": "5 days",
   "branchPrefix": "renovate/",
+  "minimumReleaseAge": "5 days",
+  "semanticCommits": "enabled",
+  "dependencyDashboard": true,
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+  },
+  "postUpdateOptions": ["gomodTidy"],
+  "packageRules": [
+    {
+      "groupName": "workflow dependencies",
+      "matchManagers": ["github-actions"],
+    },
+    {
+      "groupName": "Go dependencies",
+      "matchManagers": ["gomod"],
+      "postUpgradeTasks": {
+        "commands": ["make tidy"],
+        "fileFilters": ["go.mod", "go.sum", "assets/go-licenses.json"],
+        "executionMode": "branch",
+      },
+    },
+    {
+      "groupName": "npm dependencies",
+      "matchManagers": ["npm"],
+      "postUpgradeTasks": {
+        "commands": ["make svg"],
+        "fileFilters": ["public/assets/img/svg/**"],
+        "executionMode": "branch",
+      },
+    },
+  ],
 }

From fc66bd3890473d4165bca93f0c1ae72f0e2f1177 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 21:24:59 +0200
Subject: [PATCH 11/34] Use existing label, lowercase group names

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 renovate.json5 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/renovate.json5 b/renovate.json5
index 9945eaa4af09c..8a2cbc0db5188 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
   "enabledManagers": ["github-actions", "gomod", "npm"],
-  "labels": ["modifies/dependencies"],
+  "labels": ["dependencies"],
   "branchPrefix": "renovate/",
   "minimumReleaseAge": "5 days",
   "semanticCommits": "enabled",
@@ -14,11 +14,11 @@
   "postUpdateOptions": ["gomodTidy"],
   "packageRules": [
     {
-      "groupName": "workflow dependencies",
+      "groupName": "action dependencies",
       "matchManagers": ["github-actions"],
     },
     {
-      "groupName": "Go dependencies",
+      "groupName": "go dependencies",
       "matchManagers": ["gomod"],
       "postUpgradeTasks": {
         "commands": ["make tidy"],

From b636262edab0ef02b52eb1480d990fb031e2321f Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 21:51:47 +0200
Subject: [PATCH 12/34] Run daily, gate routine PRs to Mondays via renovate
 schedule

Vulnerability PRs bypass renovate's schedule config, so daily cron + weekly
schedule keeps the same routine cadence while letting CVE alerts ship
within a day instead of waiting up to a week.

Also disable the dependency dashboard issue.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 2 +-
 renovate.json5                      | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index ab19c308b6341..46345c9099b1c 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -2,7 +2,7 @@ name: cron-renovate
 
 on:
   schedule:
-    - cron: "0 1 * * 1" # every Monday at 01:00 UTC
+    - cron: "0 1 * * *" # daily at 01:00 UTC
   workflow_dispatch:
 
 jobs:
diff --git a/renovate.json5 b/renovate.json5
index 8a2cbc0db5188..909a7dcfcfad9 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -4,9 +4,10 @@
   "enabledManagers": ["github-actions", "gomod", "npm"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
+  "schedule": ["* * * * 1"], // routine PRs Mondays only; vulnerabilityAlerts bypasses this
   "minimumReleaseAge": "5 days",
   "semanticCommits": "enabled",
-  "dependencyDashboard": true,
+  "dependencyDashboard": false,
   "osvVulnerabilityAlerts": true,
   "vulnerabilityAlerts": {
     "enabled": true,

From a9d4df6ac86b3608cf3085d19fba557cfdb23e55 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 21:54:03 +0200
Subject: [PATCH 13/34] Pin renovatebot/github-action to v46.1.10

The action publishes only patch tags, no floating major.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 46345c9099b1c..b58e1277904f6 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
-      - uses: renovatebot/github-action@v46
+      - uses: renovatebot/github-action@v46.1.10
         with:
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}

From 55b84cafbefa21409d042ff25e16f0058b0b3bb9 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 22:00:37 +0200
Subject: [PATCH 14/34] Drop platformCommit, SHA-pin renovatebot/github-action

platformCommit is documented as a no-op when authenticating with a PAT
(only takes effect for GitHub App auth), so the env var was misleading.

Pinning the action by tag let supply-chain risk hide behind a mutable
ref; a moved tag could exfiltrate the PAT this workflow hands it.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index b58e1277904f6..0b3d0a047f852 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -13,11 +13,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
-      - uses: renovatebot/github-action@v46.1.10
+      - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
         with:
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
-          RENOVATE_PLATFORM_COMMIT: "true" # commit directly to branch to avoid API rate limits and for commit signing.
           RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
           RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'

From 0ba05c9b0093b3a76bdfe4b13b29c01b7b0aa70c Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 22:38:34 +0200
Subject: [PATCH 15/34] Apply suggestion from @silverwind

Signed-off-by: silverwind <me@silverwind.io>
---
 renovate.json5 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/renovate.json5 b/renovate.json5
index 909a7dcfcfad9..551cd5b0b3b24 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -4,7 +4,7 @@
   "enabledManagers": ["github-actions", "gomod", "npm"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
-  "schedule": ["* * * * 1"], // routine PRs Mondays only; vulnerabilityAlerts bypasses this
+  "schedule": ["* * * * 1"], // depenency update PRs weekly, vulnerabilityAlerts bypasses this
   "minimumReleaseAge": "5 days",
   "semanticCommits": "enabled",
   "dependencyDashboard": false,

From 657d532a0c0f69b31b26487a1f5621c52a1bd69f Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 22:39:59 +0200
Subject: [PATCH 16/34] Apply suggestion from @silverwind

Signed-off-by: silverwind <me@silverwind.io>
---
 renovate.json5 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/renovate.json5 b/renovate.json5
index 551cd5b0b3b24..b688072c5dc3a 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -12,7 +12,6 @@
   "vulnerabilityAlerts": {
     "enabled": true,
   },
-  "postUpdateOptions": ["gomodTidy"],
   "packageRules": [
     {
       "groupName": "action dependencies",

From 6f4ab260bb1b51f37285b881e3419b6256c98c60 Mon Sep 17 00:00:00 2001
From: TheFox0x7 <thefox0x7@gmail.com>
Date: Sat, 25 Apr 2026 22:46:57 +0200
Subject: [PATCH 17/34] add go-gitea/gitea as renovate target

Signed-off-by: TheFox0x7 <thefox0x7@gmail.com>
---
 renovate.json5 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/renovate.json5 b/renovate.json5
index b688072c5dc3a..ec2c3e5e9b2fd 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,6 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
+  "repositories" : ["go-gitea/gitea"],
   "enabledManagers": ["github-actions", "gomod", "npm"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",

From d7bd42e66a9f20ef32e222387bb1087f4094d1f3 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 25 Apr 2026 23:57:08 +0200
Subject: [PATCH 18/34] Fix comment typo, add workflow concurrency and timeout

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 4 ++++
 renovate.json5                      | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 0b3d0a047f852..d12350136622c 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -5,10 +5,14 @@ on:
     - cron: "0 1 * * *" # daily at 01:00 UTC
   workflow_dispatch:
 
+concurrency:
+  group: cron-renovate
+
 jobs:
   cron-renovate:
     runs-on: ubuntu-latest
     if: github.repository == 'go-gitea/gitea' # prevent running on forks
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
diff --git a/renovate.json5 b/renovate.json5
index ec2c3e5e9b2fd..71b8cc38879d8 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -5,7 +5,7 @@
   "enabledManagers": ["github-actions", "gomod", "npm"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
-  "schedule": ["* * * * 1"], // depenency update PRs weekly, vulnerabilityAlerts bypasses this
+  "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
   "minimumReleaseAge": "5 days",
   "semanticCommits": "enabled",
   "dependencyDashboard": false,

From be25801534caffa5ba670403a0c168fa6efcd6db Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:01:03 +0200
Subject: [PATCH 19/34] Pin all GitHub Actions to commit SHAs

Same approach as #36971: pin every uses: ref to the full commit SHA with
the version tag in a trailing comment. Adds the helpers:pinGitHubActionDigests
preset so Renovate keeps future bumps in this format and converts any new
tag-pinned actions automatically.

DeterminateSystems/update-flake-lock previously tracked main; pinning to v28
matches what the action's release tagging promises and lets Renovate manage
upgrades the same way as the others.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-flake-updater.yml  |  6 +--
 .github/workflows/cron-licenses.yml       |  6 +--
 .github/workflows/cron-renovate.yml       |  2 +-
 .github/workflows/cron-translations.yml   |  6 +--
 .github/workflows/files-changed.yml       |  4 +-
 .github/workflows/pull-compliance.yml     | 64 +++++++++++------------
 .github/workflows/pull-db-tests.yml       | 20 +++----
 .github/workflows/pull-docker-dryrun.yml  | 10 ++--
 .github/workflows/pull-e2e-tests.yml      |  8 +--
 .github/workflows/pull-labeler.yml        |  2 +-
 .github/workflows/release-nightly.yml     | 30 +++++------
 .github/workflows/release-tag-rc.yml      | 32 ++++++------
 .github/workflows/release-tag-version.yml | 32 ++++++------
 renovate.json5                            |  2 +-
 14 files changed, 112 insertions(+), 112 deletions(-)

diff --git a/.github/workflows/cron-flake-updater.yml b/.github/workflows/cron-flake-updater.yml
index c9a1f22a2ae13..e396358698fb0 100644
--- a/.github/workflows/cron-flake-updater.yml
+++ b/.github/workflows/cron-flake-updater.yml
@@ -13,9 +13,9 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: DeterminateSystems/determinate-nix-action@v3
-      - uses: DeterminateSystems/update-flake-lock@main
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: DeterminateSystems/determinate-nix-action@92ffb5400c3776307a27a1727d7e2ac3dcd9f844 # v3
+      - uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28
         with:
           pr-title: "Update Nix flake"
           pr-labels: |
diff --git a/.github/workflows/cron-licenses.yml b/.github/workflows/cron-licenses.yml
index ee1c3e0c75098..a32497c9e451f 100644
--- a/.github/workflows/cron-licenses.yml
+++ b/.github/workflows/cron-licenses.yml
@@ -12,15 +12,15 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
       - run: make generate-gitignore
         timeout-minutes: 40
       - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@3b2c8661652360dbf1afe1b319a49dbb739c39f1 # v1.2.0
         with:
           author_email: "teabot@gitea.io"
           author_name: GiteaBot
diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index d12350136622c..284e00e467130 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
         with:
           configurationFile: renovate.json5
diff --git a/.github/workflows/cron-translations.yml b/.github/workflows/cron-translations.yml
index 56a30fb5ba679..4ac2cde5454ad 100644
--- a/.github/workflows/cron-translations.yml
+++ b/.github/workflows/cron-translations.yml
@@ -12,8 +12,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: crowdin/github-action@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
         with:
           upload_sources: true
           upload_translations: false
@@ -29,7 +29,7 @@ jobs:
       - name: update locales
         run: ./build/update-locales.sh
       - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@3b2c8661652360dbf1afe1b319a49dbb739c39f1 # v1.2.0
         with:
           author_email: "teabot@gitea.io"
           author_name: GiteaBot
diff --git a/.github/workflows/files-changed.yml b/.github/workflows/files-changed.yml
index b1d6fbe9d8e87..ca8ff2e5c2201 100644
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -42,8 +42,8 @@ jobs:
       json: ${{ steps.changes.outputs.json }}
       e2e: ${{ steps.changes.outputs.e2e }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
         id: changes
         with:
           filters: |
diff --git a/.github/workflows/pull-compliance.yml b/.github/workflows/pull-compliance.yml
index dd453d00bebf7..8019c6f5f47c5 100644
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -20,8 +20,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -37,11 +37,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - run: uv python install 3.14
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -57,8 +57,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - run: uv python install 3.14
       - run: make deps-py
       - run: make lint-yaml
@@ -70,9 +70,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -87,9 +87,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -104,8 +104,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -118,8 +118,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -137,8 +137,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -154,8 +154,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -169,9 +169,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -189,8 +189,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -223,9 +223,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -240,8 +240,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/pull-db-tests.yml b/.github/workflows/pull-db-tests.yml
index d168c2ecc5fab..50577429a57a9 100644
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -42,8 +42,8 @@ jobs:
         ports:
           - "9000:9000"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -71,8 +71,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -130,8 +130,8 @@ jobs:
         ports:
           - 10000:10000
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -185,8 +185,8 @@ jobs:
           - "587:587"
           - "993:993"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -226,8 +226,8 @@ jobs:
         ports:
           - 10000:10000
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/pull-docker-dryrun.yml b/.github/workflows/pull-docker-dryrun.yml
index 201825ccbaaa2..ab4a69238360a 100644
--- a/.github/workflows/pull-docker-dryrun.yml
+++ b/.github/workflows/pull-docker-dryrun.yml
@@ -20,18 +20,18 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       - name: Build regular container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
           push: false
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
       - name: Build rootless container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           push: false
diff --git a/.github/workflows/pull-e2e-tests.yml b/.github/workflows/pull-e2e-tests.yml
index fde36383b93f9..db5fdf112ef46 100644
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -20,13 +20,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
diff --git a/.github/workflows/pull-labeler.yml b/.github/workflows/pull-labeler.yml
index d05483e56ca3e..d6f26dde19496 100644
--- a/.github/workflows/pull-labeler.yml
+++ b/.github/workflows/pull-labeler.yml
@@ -15,6 +15,6 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6
         with:
           sync-labels: true
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index eaebccd7fbe04..a125cb00998e9 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -14,16 +14,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -35,7 +35,7 @@ jobs:
           TAGS: bindata sqlite sqlite_unlock_notify
       - name: import gpg key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -52,7 +52,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -67,18 +67,18 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       - name: Get cleaned branch name
         id: clean_name
         run: |
           REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         id: meta
         with:
           images: |-
@@ -88,7 +88,7 @@ jobs:
             type=raw,value=${{ steps.clean_name.outputs.branch }}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         id: meta_rootless
         with:
           images: |-
@@ -102,18 +102,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -123,7 +123,7 @@ jobs:
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
           cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
       - name: build rootless docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml
index 248fa532eeb89..3ca37a3de2857 100644
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -15,16 +15,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -36,7 +36,7 @@ jobs:
           TAGS: bindata sqlite sqlite_unlock_notify
       - name: import gpg key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -53,7 +53,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -62,7 +62,7 @@ jobs:
         run: |
           aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
       - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
         with:
           gh-cli-version: 2.39.1
       - name: create github release
@@ -77,13 +77,13 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/metadata-action@v6
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         id: meta
         with:
           images: |-
@@ -96,7 +96,7 @@ jobs:
             type=semver,pattern={{version}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         id: meta_rootless
         with:
           images: |-
@@ -112,18 +112,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -131,7 +131,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml
index 1e84ae1739f87..7fbd906e6da1f 100644
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -18,16 +18,16 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -39,7 +39,7 @@ jobs:
           TAGS: bindata sqlite sqlite_unlock_notify
       - name: import gpg key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -56,7 +56,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -65,7 +65,7 @@ jobs:
         run: |
           aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
       - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
         with:
           gh-cli-version: 2.39.1
       - name: create github release
@@ -80,13 +80,13 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/metadata-action@v6
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         id: meta
         with:
           images: |-
@@ -103,7 +103,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         id: meta_rootless
         with:
           images: |-
@@ -124,18 +124,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -143,7 +143,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/renovate.json5 b/renovate.json5
index 71b8cc38879d8..9a6b870b8456b 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "repositories" : ["go-gitea/gitea"],
   "enabledManagers": ["github-actions", "gomod", "npm"],
   "labels": ["dependencies"],

From c20ff69794d1b2cbd36a97f55432e0cf660141bb Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:17:12 +0200
Subject: [PATCH 20/34] Move npm pins into renovate.json5, drop
 updates.config.ts

updates@17.16.0 reads pins and cooldown directly from a renovate config,
so the standalone updates.config.ts is no longer needed. Renovate and the
updates CLI now share one source of truth for pinned packages.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 package.json      |  2 +-
 pnpm-lock.yaml    | 10 +++++-----
 renovate.json5    | 12 ++++++++++++
 updates.config.ts |  9 ---------
 4 files changed, 18 insertions(+), 15 deletions(-)
 delete mode 100644 updates.config.ts

diff --git a/package.json b/package.json
index 9a458e4b49df1..1a023aff0d026 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,7 @@
     "svgo": "4.0.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.59.0",
-    "updates": "17.15.5",
+    "updates": "17.16.0",
     "vitest": "4.1.4",
     "vue-tsc": "3.2.7"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index bd51102345ff1..595167e8400c6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -366,8 +366,8 @@ importers:
         specifier: 8.59.0
         version: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
       updates:
-        specifier: 17.15.5
-        version: 17.15.5
+        specifier: 17.16.0
+        version: 17.16.0
       vitest:
         specifier: 4.1.4
         version: 4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
@@ -3902,8 +3902,8 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  updates@17.15.5:
-    resolution: {integrity: sha512-Ce004Zzj63jL/Vml1YFGOoFSpzpxRVQlAVAo65HShwg0v1UpOzmYYAiYAi1Z7ILH65QtfqHQCphSHeqR5SgPAg==}
+  updates@17.16.0:
+    resolution: {integrity: sha512-LRKOxxlt9lMQL4+R3gELwruJ8PWQvFYw5KHOq2H7LpxiL8Wk/FPqy5ff8Bc/4BzOdOXd2uIq/hgYDE8bv6nAPA==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -8019,7 +8019,7 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  updates@17.15.5: {}
+  updates@17.16.0: {}
 
   uri-js@4.4.1:
     dependencies:
diff --git a/renovate.json5 b/renovate.json5
index 9a6b870b8456b..b0a0bc8353ece 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -18,6 +18,18 @@
       "groupName": "action dependencies",
       "matchManagers": ["github-actions"],
     },
+    {
+      "matchPackageNames": ["@mcaptcha/vanilla-glue"],
+      "allowedVersions": "^0.1", // breaking changes in rc versions need to be handled
+    },
+    {
+      "matchPackageNames": ["cropperjs"],
+      "allowedVersions": "^1", // need to migrate to v2 but v2 is not compatible with v1
+    },
+    {
+      "matchPackageNames": ["tailwindcss"],
+      "allowedVersions": "^3", // need to migrate
+    },
     {
       "groupName": "go dependencies",
       "matchManagers": ["gomod"],
diff --git a/updates.config.ts b/updates.config.ts
deleted file mode 100644
index 787e6dc7c6fa4..0000000000000
--- a/updates.config.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import type {Config} from 'updates';
-
-export default {
-  pin: {
-    '@mcaptcha/vanilla-glue': '^0.1', // breaking changes in rc versions need to be handled
-    'cropperjs': '^1', // need to migrate to v2 but v2 is not compatible with v1
-    'tailwindcss': '^3', // need to migrate
-  },
-} satisfies Config;

From 3c0fb08eb55688fd433bda47203fb2131680b8df Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:20:09 +0200
Subject: [PATCH 21/34] update updates

---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 1a023aff0d026..0fec349bc2420 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,7 @@
     "svgo": "4.0.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.59.0",
-    "updates": "17.16.0",
+    "updates": "17.16.1",
     "vitest": "4.1.4",
     "vue-tsc": "3.2.7"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 595167e8400c6..d9c8cc1915812 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -366,8 +366,8 @@ importers:
         specifier: 8.59.0
         version: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
       updates:
-        specifier: 17.16.0
-        version: 17.16.0
+        specifier: 17.16.1
+        version: 17.16.1
       vitest:
         specifier: 4.1.4
         version: 4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
@@ -3902,8 +3902,8 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  updates@17.16.0:
-    resolution: {integrity: sha512-LRKOxxlt9lMQL4+R3gELwruJ8PWQvFYw5KHOq2H7LpxiL8Wk/FPqy5ff8Bc/4BzOdOXd2uIq/hgYDE8bv6nAPA==}
+  updates@17.16.1:
+    resolution: {integrity: sha512-foxs5hxNlqZEKQ+rHCjdG3RUn33wYE06vl06Q9Cwy8AxhUGcgumeOdeKszKugApcqsANq9m3E+YTg1k/2pdBeQ==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -8019,7 +8019,7 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  updates@17.16.0: {}
+  updates@17.16.1: {}
 
   uri-js@4.4.1:
     dependencies:

From 4ad4305a67abcdec27c96a91ec27b1bce1ca0a32 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:29:38 +0200
Subject: [PATCH 22/34] Bump updates to 17.16.2

Renovate's minimumReleaseAge is no longer auto-inherited as cooldown by
the updates CLI; the cooldown gate fits batch automation, not
interactive use, so the default is correct here.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 0fec349bc2420..82e9e8f69f2c5 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,7 @@
     "svgo": "4.0.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.59.0",
-    "updates": "17.16.1",
+    "updates": "17.16.2",
     "vitest": "4.1.4",
     "vue-tsc": "3.2.7"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d9c8cc1915812..647fdb6a34277 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -366,8 +366,8 @@ importers:
         specifier: 8.59.0
         version: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
       updates:
-        specifier: 17.16.1
-        version: 17.16.1
+        specifier: 17.16.2
+        version: 17.16.2
       vitest:
         specifier: 4.1.4
         version: 4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
@@ -3902,8 +3902,8 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  updates@17.16.1:
-    resolution: {integrity: sha512-foxs5hxNlqZEKQ+rHCjdG3RUn33wYE06vl06Q9Cwy8AxhUGcgumeOdeKszKugApcqsANq9m3E+YTg1k/2pdBeQ==}
+  updates@17.16.2:
+    resolution: {integrity: sha512-Rotkow4QuoW+kbvGGkrpxn8Hmkb+rNxbE7n7W0oldqyXjPftoCj9Vrcla8v90BOBGJ7ugN7agwGG5VZefy+3GA==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -8019,7 +8019,7 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  updates@17.16.1: {}
+  updates@17.16.2: {}
 
   uri-js@4.4.1:
     dependencies:

From 5a461b8f18a90f8ff9b174a4df227f39651c9d48 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:38:11 +0200
Subject: [PATCH 23/34] Pin gomod replace directives in renovate config

Five entries in go.mod's replace block hold deps to specific versions for
known compatibility reasons (Azurite API support, urfave/cli regression,
yaml block-scalar change, mssqldb-Azure SDK pairing). Without matching
allowedVersions rules, renovate would surface those as updates each
Monday and PRs would either fight the replace pin or burn review time.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 renovate.json5 | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/renovate.json5 b/renovate.json5
index b0a0bc8353ece..a80b43a3b12e5 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -30,6 +30,26 @@
       "matchPackageNames": ["tailwindcss"],
       "allowedVersions": "^3", // need to migrate
     },
+    {
+      "matchPackageNames": ["github.com/urfave/cli/v3"],
+      "allowedVersions": "<3.6.2", // v3.6.2 breaks -c flag parsing in help commands
+    },
+    {
+      "matchPackageNames": ["github.com/Azure/azure-sdk-for-go/sdk/azcore"],
+      "allowedVersions": "<1.21.0", // v1.21.0+ uses API version unsupported by Azurite in CI
+    },
+    {
+      "matchPackageNames": ["github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"],
+      "allowedVersions": "<1.6.4", // v1.6.4+ uses API version unsupported by Azurite in CI
+    },
+    {
+      "matchPackageNames": ["github.com/microsoft/go-mssqldb"],
+      "allowedVersions": "<=1.9.7", // downgraded with Azure SDK
+    },
+    {
+      "matchPackageNames": ["go.yaml.in/yaml/v4"],
+      "allowedVersions": "<4.0.0-rc.4", // rc.4 changes block scalar serialization, wait for stable release
+    },
     {
       "groupName": "go dependencies",
       "matchManagers": ["gomod"],

From 501df7dea39cffaeacc83b89f029cafe13a66317 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:43:55 +0200
Subject: [PATCH 24/34] Bump updates to 17.16.3

Includes the gomod pinnedRange fix so renovate's allowedVersions rules on
the five replace-directive pins (Azure SDK, mssqldb, urfave/cli, yaml/v4)
are honored by the updates CLI as well.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 82e9e8f69f2c5..04f27fec82d1c 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,7 @@
     "svgo": "4.0.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.59.0",
-    "updates": "17.16.2",
+    "updates": "17.16.3",
     "vitest": "4.1.4",
     "vue-tsc": "3.2.7"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 647fdb6a34277..cca57d3b1958a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -366,8 +366,8 @@ importers:
         specifier: 8.59.0
         version: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
       updates:
-        specifier: 17.16.2
-        version: 17.16.2
+        specifier: 17.16.3
+        version: 17.16.3
       vitest:
         specifier: 4.1.4
         version: 4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
@@ -3902,8 +3902,8 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  updates@17.16.2:
-    resolution: {integrity: sha512-Rotkow4QuoW+kbvGGkrpxn8Hmkb+rNxbE7n7W0oldqyXjPftoCj9Vrcla8v90BOBGJ7ugN7agwGG5VZefy+3GA==}
+  updates@17.16.3:
+    resolution: {integrity: sha512-j+bkgObnDVB9hYTSg1tflwGtkFg23ZrgXiqRmRw3Reu/sh2P29M9oecxavO9uBMO2bbKpgC1OBrAnIpNZtL01w==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -8019,7 +8019,7 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  updates@17.16.2: {}
+  updates@17.16.3: {}
 
   uri-js@4.4.1:
     dependencies:

From e6378736525a581c60d67705cbc01b504ed0c74c Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 00:49:24 +0200
Subject: [PATCH 25/34] Cover pyproject.toml dependencies via pep621
 (uv-compatible)

Renovate's pep621 manager handles PEP 621 [project] and [dependency-groups]
plus uv-specific sections, and regenerates uv.lock automatically when
deps change. Groups updates as "python dependencies" so djlint/yamllint
land in one weekly PR.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 renovate.json5 | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/renovate.json5 b/renovate.json5
index a80b43a3b12e5..64e4f98f62c52 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "repositories" : ["go-gitea/gitea"],
-  "enabledManagers": ["github-actions", "gomod", "npm"],
+  "enabledManagers": ["github-actions", "gomod", "npm", "pep621"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
   "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
@@ -68,5 +68,9 @@
         "executionMode": "branch",
       },
     },
+    {
+      "groupName": "python dependencies",
+      "matchManagers": ["pep621"],
+    },
   ],
 }

From ac034e1d7dd665c536fb4ab08047595289231407 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 02:38:50 +0200
Subject: [PATCH 26/34] Cover Nix flake via renovate, drop cron-flake-updater
 workflow

Renovate's nix manager treats each flake input as a tracked dependency
and bumps the resolved commit on schedule. With a single nixpkgs input
on a moving nixos-unstable ref, that produces the same PRs the dedicated
DeterminateSystems/update-flake-lock workflow was making, so the
standalone cron job is redundant.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-flake-updater.yml | 22 ----------------------
 renovate.json5                           |  6 +++++-
 2 files changed, 5 insertions(+), 23 deletions(-)
 delete mode 100644 .github/workflows/cron-flake-updater.yml

diff --git a/.github/workflows/cron-flake-updater.yml b/.github/workflows/cron-flake-updater.yml
deleted file mode 100644
index e396358698fb0..0000000000000
--- a/.github/workflows/cron-flake-updater.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: cron-flake-updater
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
-
-jobs:
-  nix-flake-update:
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: DeterminateSystems/determinate-nix-action@92ffb5400c3776307a27a1727d7e2ac3dcd9f844 # v3
-      - uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28
-        with:
-          pr-title: "Update Nix flake"
-          pr-labels: |
-            dependencies
diff --git a/renovate.json5 b/renovate.json5
index 64e4f98f62c52..3b082a94326b7 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "repositories" : ["go-gitea/gitea"],
-  "enabledManagers": ["github-actions", "gomod", "npm", "pep621"],
+  "enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
   "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
@@ -72,5 +72,9 @@
       "groupName": "python dependencies",
       "matchManagers": ["pep621"],
     },
+    {
+      "groupName": "nix dependencies",
+      "matchManagers": ["nix"],
+    },
   ],
 }

From 1b985c8ee7f0cf36d87acf7642d3615cba3a8d6b Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 02:43:16 +0200
Subject: [PATCH 27/34] Lower release-age cooldown to 3 days

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 renovate.json5 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/renovate.json5 b/renovate.json5
index 3b082a94326b7..abb1ac45bf833 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -6,7 +6,7 @@
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
   "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
-  "minimumReleaseAge": "5 days",
+  "minimumReleaseAge": "3 days",
   "semanticCommits": "enabled",
   "dependencyDashboard": false,
   "osvVulnerabilityAlerts": true,

From 5d02fe81bf982cb6a2a6f77e9360b0131c9713bc Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 02:47:41 +0200
Subject: [PATCH 28/34] Use patch-level version comments for SHA-pinned actions

OpenSSF best practice: the comment after the SHA should identify the
exact release the SHA corresponds to, not just the major. Renovate
preserves comment specificity, so future bumps will continue at
patch precision. The update-flake-lock action that previously had
no patch tag is gone, so every action now has one.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-licenses.yml       |  4 +-
 .github/workflows/cron-renovate.yml       |  2 +-
 .github/workflows/cron-translations.yml   |  4 +-
 .github/workflows/files-changed.yml       |  4 +-
 .github/workflows/pull-compliance.yml     | 60 +++++++++++------------
 .github/workflows/pull-db-tests.yml       | 20 ++++----
 .github/workflows/pull-docker-dryrun.yml  | 10 ++--
 .github/workflows/pull-e2e-tests.yml      |  8 +--
 .github/workflows/pull-labeler.yml        |  2 +-
 .github/workflows/release-nightly.yml     | 30 ++++++------
 .github/workflows/release-tag-rc.yml      | 30 ++++++------
 .github/workflows/release-tag-version.yml | 30 ++++++------
 12 files changed, 102 insertions(+), 102 deletions(-)

diff --git a/.github/workflows/cron-licenses.yml b/.github/workflows/cron-licenses.yml
index a32497c9e451f..edb6f2e157632 100644
--- a/.github/workflows/cron-licenses.yml
+++ b/.github/workflows/cron-licenses.yml
@@ -12,8 +12,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 284e00e467130..9c5664ee24c72 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
         with:
           configurationFile: renovate.json5
diff --git a/.github/workflows/cron-translations.yml b/.github/workflows/cron-translations.yml
index 4ac2cde5454ad..17f29d4e0c553 100644
--- a/.github/workflows/cron-translations.yml
+++ b/.github/workflows/cron-translations.yml
@@ -12,8 +12,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
         with:
           upload_sources: true
           upload_translations: false
diff --git a/.github/workflows/files-changed.yml b/.github/workflows/files-changed.yml
index ca8ff2e5c2201..5fd43e6cef16f 100644
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -42,8 +42,8 @@ jobs:
       json: ${{ steps.changes.outputs.json }}
       e2e: ${{ steps.changes.outputs.e2e }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           filters: |
diff --git a/.github/workflows/pull-compliance.yml b/.github/workflows/pull-compliance.yml
index 8019c6f5f47c5..4f830c216dc2c 100644
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -20,8 +20,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -37,11 +37,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - run: uv python install 3.14
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -57,7 +57,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - run: uv python install 3.14
       - run: make deps-py
@@ -70,9 +70,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -87,9 +87,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -104,8 +104,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -118,8 +118,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -137,8 +137,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -154,8 +154,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -169,9 +169,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -189,8 +189,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -223,9 +223,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -240,8 +240,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/pull-db-tests.yml b/.github/workflows/pull-db-tests.yml
index 50577429a57a9..82fa227f9ba47 100644
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -42,8 +42,8 @@ jobs:
         ports:
           - "9000:9000"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -71,8 +71,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -130,8 +130,8 @@ jobs:
         ports:
           - 10000:10000
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -185,8 +185,8 @@ jobs:
           - "587:587"
           - "993:993"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -226,8 +226,8 @@ jobs:
         ports:
           - 10000:10000
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/pull-docker-dryrun.yml b/.github/workflows/pull-docker-dryrun.yml
index ab4a69238360a..e0c0fff815d88 100644
--- a/.github/workflows/pull-docker-dryrun.yml
+++ b/.github/workflows/pull-docker-dryrun.yml
@@ -20,18 +20,18 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - name: Build regular container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
           push: false
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
       - name: Build rootless container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           push: false
diff --git a/.github/workflows/pull-e2e-tests.yml b/.github/workflows/pull-e2e-tests.yml
index db5fdf112ef46..0e0817a692ca5 100644
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -20,13 +20,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
diff --git a/.github/workflows/pull-labeler.yml b/.github/workflows/pull-labeler.yml
index d6f26dde19496..f9e2e5e07b73d 100644
--- a/.github/workflows/pull-labeler.yml
+++ b/.github/workflows/pull-labeler.yml
@@ -15,6 +15,6 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
           sync-labels: true
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index a125cb00998e9..a5fa452ef369e 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -14,16 +14,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -35,7 +35,7 @@ jobs:
           TAGS: bindata sqlite sqlite_unlock_notify
       - name: import gpg key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -52,7 +52,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -67,18 +67,18 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - name: Get cleaned branch name
         id: clean_name
         run: |
           REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: meta
         with:
           images: |-
@@ -88,7 +88,7 @@ jobs:
             type=raw,value=${{ steps.clean_name.outputs.branch }}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: meta_rootless
         with:
           images: |-
@@ -102,18 +102,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -123,7 +123,7 @@ jobs:
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
           cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
       - name: build rootless docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml
index 3ca37a3de2857..2e0f2dd5c0bcc 100644
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -15,16 +15,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -36,7 +36,7 @@ jobs:
           TAGS: bindata sqlite sqlite_unlock_notify
       - name: import gpg key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -53,7 +53,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -77,13 +77,13 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: meta
         with:
           images: |-
@@ -96,7 +96,7 @@ jobs:
             type=semver,pattern={{version}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: meta_rootless
         with:
           images: |-
@@ -112,18 +112,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -131,7 +131,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml
index 7fbd906e6da1f..2e7a9f5f54cab 100644
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -18,16 +18,16 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
@@ -39,7 +39,7 @@ jobs:
           TAGS: bindata sqlite sqlite_unlock_notify
       - name: import gpg key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -56,7 +56,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -80,13 +80,13 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: meta
         with:
           images: |-
@@ -103,7 +103,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         id: meta_rootless
         with:
           images: |-
@@ -124,18 +124,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -143,7 +143,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64

From aa8976f22fe8968ddeced430f791abab83dc4d31 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 03:06:52 +0200
Subject: [PATCH 29/34] Pin Renovate runtime image to 43.141.5

Per renovatebot/github-action's README: pin via the renovate-version
input and let Renovate keep it bumped. The customManagers:githubActionsVersions
preset parses the # renovate: magic comment alongside RENOVATE_VERSION
and tracks ghcr.io/renovatebot/renovate as a docker dep.

Without this the action defaults to ghcr.io/renovatebot/renovate:43,
a mutable major tag.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 .github/workflows/cron-renovate.yml | 4 ++++
 renovate.json5                      | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 9c5664ee24c72..ddde4e103dc25 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -8,6 +8,9 @@ on:
 concurrency:
   group: cron-renovate
 
+env:
+  RENOVATE_VERSION: 43.141.5 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
+
 jobs:
   cron-renovate:
     runs-on: ubuntu-latest
@@ -19,6 +22,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
         with:
+          renovate-version: ${{ env.RENOVATE_VERSION }}
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
diff --git a/renovate.json5 b/renovate.json5
index abb1ac45bf833..4fa450419a31e 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigests", "customManagers:githubActionsVersions"],
   "repositories" : ["go-gitea/gitea"],
   "enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix"],
   "labels": ["dependencies"],

From a741b0dc807554d01c770b8f63f96369342a9743 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 03:10:12 +0200
Subject: [PATCH 30/34] Track Makefile go-tool packages via renovate

Adds a regex customManager that matches lines of the form
"<NAME>_PACKAGE ?= <import-path>@<version> # renovate: datasource=go depName=<module>"
and treats each as a Go datasource dep, grouped into the existing
"go dependencies" PR via matchDatasources.

XGO_PACKAGE stays unannotated since it pins to @latest with no version
to bump.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 Makefile       | 16 ++++++++--------
 renovate.json5 | 11 ++++++++++-
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/Makefile b/Makefile
index e621cc362fce4..28c7368f0f1eb 100644
--- a/Makefile
+++ b/Makefile
@@ -12,15 +12,15 @@ COMMA := ,
 
 XGO_VERSION := go-1.25.x
 
-AIR_PACKAGE ?= github.com/air-verse/air@v1
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15
-MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1
+AIR_PACKAGE ?= github.com/air-verse/air@v1 # renovate: datasource=go depName=github.com/air-verse/air
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3 # renovate: datasource=go depName=github.com/editorconfig-checker/editorconfig-checker/v3
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4 # renovate: datasource=go depName=github.com/golangci/golangci-lint/v2
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go depName=github.com/ulikunitz/xz
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go depName=github.com/golangci/misspell
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1 # renovate: datasource=go depName=github.com/go-swagger/go-swagger
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1 # renovate: datasource=go depName=golang.org/x/vuln
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11 # renovate: datasource=go depName=github.com/rhysd/actionlint
 
 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
diff --git a/renovate.json5 b/renovate.json5
index 4fa450419a31e..e490dc0c0d226 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -13,6 +13,15 @@
   "vulnerabilityAlerts": {
     "enabled": true,
   },
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)Makefile$/"],
+      "matchStrings": [
+        "[A-Z_]+_PACKAGE\\s*\\?=\\s*\\S+@(?<currentValue>\\S+)\\s+# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)",
+      ],
+    },
+  ],
   "packageRules": [
     {
       "groupName": "action dependencies",
@@ -52,7 +61,7 @@
     },
     {
       "groupName": "go dependencies",
-      "matchManagers": ["gomod"],
+      "matchDatasources": ["go"], // covers gomod manager + Makefile go-tool customManager
       "postUpgradeTasks": {
         "commands": ["make tidy"],
         "fileFilters": ["go.mod", "go.sum", "assets/go-licenses.json"],

From 7815a9be884e5af6ff06ffd644b817d3f147ba5b Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 03:14:28 +0200
Subject: [PATCH 31/34] Same-line renovate annotations, derive Go module from
 path

The regex strips an optional /cmd/<binary> suffix from the package
import path, so the # renovate: comment only needs to assert the
datasource. depName falls out of the value automatically. Verified
against all 8 annotated Makefile lines.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 Makefile       | 16 ++++++++--------
 renovate.json5 |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/Makefile b/Makefile
index 28c7368f0f1eb..ae053a8368ef7 100644
--- a/Makefile
+++ b/Makefile
@@ -12,15 +12,15 @@ COMMA := ,
 
 XGO_VERSION := go-1.25.x
 
-AIR_PACKAGE ?= github.com/air-verse/air@v1 # renovate: datasource=go depName=github.com/air-verse/air
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3 # renovate: datasource=go depName=github.com/editorconfig-checker/editorconfig-checker/v3
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4 # renovate: datasource=go depName=github.com/golangci/golangci-lint/v2
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go depName=github.com/ulikunitz/xz
-MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go depName=github.com/golangci/misspell
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1 # renovate: datasource=go depName=github.com/go-swagger/go-swagger
+AIR_PACKAGE ?= github.com/air-verse/air@v1 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4 # renovate: datasource=go
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1 # renovate: datasource=go depName=golang.org/x/vuln
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11 # renovate: datasource=go depName=github.com/rhysd/actionlint
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1 # renovate: datasource=go
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11 # renovate: datasource=go
 
 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
diff --git a/renovate.json5 b/renovate.json5
index e490dc0c0d226..8d6ad54f75d3b 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -18,7 +18,7 @@
       "customType": "regex",
       "managerFilePatterns": ["/(^|/)Makefile$/"],
       "matchStrings": [
-        "[A-Z_]+_PACKAGE\\s*\\?=\\s*\\S+@(?<currentValue>\\S+)\\s+# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)",
+        "[A-Z_]+_PACKAGE\\s*\\?=\\s*(?<depName>[^@\\s]+?)(?:/cmd/[^@/\\s]+)?@(?<currentValue>\\S+)\\s+# renovate: datasource=(?<datasource>\\S+)",
       ],
     },
   ],

From 3e06cc5f29a8f09dbb4e2c1d61d60f8a7838ede3 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 26 Apr 2026 03:17:22 +0200
Subject: [PATCH 32/34] Restore release-age cooldown to 5 days

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
---
 renovate.json5 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/renovate.json5 b/renovate.json5
index 8d6ad54f75d3b..c27b569b06064 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -6,7 +6,7 @@
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
   "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
-  "minimumReleaseAge": "3 days",
+  "minimumReleaseAge": "5 days",
   "semanticCommits": "enabled",
   "dependencyDashboard": false,
   "osvVulnerabilityAlerts": true,

From 90d5eb1984d202f0d3b6e9fc5652ef1a31380857 Mon Sep 17 00:00:00 2001
From: TheFox0x7 <thefox0x7@gmail.com>
Date: Sun, 26 Apr 2026 13:52:01 +0200
Subject: [PATCH 33/34] fix warnings during run

Renovate has two config files: global and local. Prior to this change,
it read the config as global and local at the same time. This fixes the
issue removing the repo scoped config and giving the renovate global
only without requirement for in repository one.
This also enables migration of the config - which I assume will also
work on global configuration.

Without this, renovate will compain about the config having warnings
during runs and on dashboard.
---
 .github/workflows/cron-renovate.yml     | 2 +-
 renovate.json5 => renovate-config.json5 | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)
 rename renovate.json5 => renovate-config.json5 (98%)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index ddde4e103dc25..fddb928aa2a7a 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -23,7 +23,7 @@ jobs:
       - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
         with:
           renovate-version: ${{ env.RENOVATE_VERSION }}
-          configurationFile: renovate.json5
+          configurationFile: renovate-config.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
           RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
diff --git a/renovate.json5 b/renovate-config.json5
similarity index 98%
rename from renovate.json5
rename to renovate-config.json5
index c27b569b06064..ad23266db712c 100644
--- a/renovate.json5
+++ b/renovate-config.json5
@@ -2,6 +2,8 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests", "customManagers:githubActionsVersions"],
   "repositories" : ["go-gitea/gitea"],
+  requireConfig: "optional",
+  "configMigration": true,
   "enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",

From 84efb4df060615ed776c31b1309eb6d16c57ddb4 Mon Sep 17 00:00:00 2001
From: TheFox0x7 <thefox0x7@gmail.com>
Date: Sun, 26 Apr 2026 14:31:36 +0200
Subject: [PATCH 34/34] move global configuration to env vars

enable dashboard
---
 .github/workflows/cron-renovate.yml     | 3 ++-
 renovate-config.json5 => renovate.json5 | 3 ---
 2 files changed, 2 insertions(+), 4 deletions(-)
 rename renovate-config.json5 => renovate.json5 (96%)

diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index fddb928aa2a7a..edeefc26ad85f 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -23,8 +23,9 @@ jobs:
       - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
         with:
           renovate-version: ${{ env.RENOVATE_VERSION }}
-          configurationFile: renovate-config.json5
+          configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
           RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
           RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
+          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
diff --git a/renovate-config.json5 b/renovate.json5
similarity index 96%
rename from renovate-config.json5
rename to renovate.json5
index ad23266db712c..586733b317e9e 100644
--- a/renovate-config.json5
+++ b/renovate.json5
@@ -1,8 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests", "customManagers:githubActionsVersions"],
-  "repositories" : ["go-gitea/gitea"],
-  requireConfig: "optional",
   "configMigration": true,
   "enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix"],
   "labels": ["dependencies"],
@@ -10,7 +8,6 @@
   "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
   "minimumReleaseAge": "5 days",
   "semanticCommits": "enabled",
-  "dependencyDashboard": false,
   "osvVulnerabilityAlerts": true,
   "vulnerabilityAlerts": {
     "enabled": true,