From 0bd4d100880a264c90a26d0f6e07e97a7b265874 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Wed, 1 Jul 2026 02:40:49 +0000 Subject: [PATCH] chore: bump Forgejo to 11.0.15 + add Dependabot to keep deps current MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit of every version pin in the repo: Ergo (2.18.0), Go (1.26 → latest patch via setup-go), the Ubuntu pod base (24.04 LTS), and the GitHub Action majors are all already current. Only Forgejo was stale — bump 11.0.1 → 11.0.15 (latest patch of the 11.x LTS line; a 15.x major stays a deliberate, tested upgrade because of DB migrations). Add .github/dependabot.yml so github-actions, Go modules, and the Docker image tags (Mailu compose + pod Containerfile) get review-gated update PRs weekly. Shell-string pins (FORGEJO_VERSION/ERGO_VERSION in setup.sh) can't be watched by Dependabot; noted inline. Mailu runtime patch level is handled by the mailu-update workflow. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 42 ++++++++++++++++++++++++++++++++++++++++++ setup.sh | 2 +- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..c555689 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,42 @@ +# Keep agentbbs's pinned dependencies current automatically. Dependabot opens +# (review-gated) PRs when a newer version ships — nothing auto-merges, so a bad +# bump can't silently reach production. +# +# Coverage: +# - github-actions : the action pins in .github/workflows/* (checkout, setup-go…) +# - gomod : Go module dependencies (go.mod / go.sum) +# - docker : image tags in the Mailu compose stack and the pod Containerfile +# +# NOT covered (Dependabot can't watch shell-string pins): FORGEJO_VERSION and +# ERGO_VERSION in setup.sh — bump those by hand, or switch to Renovate (which can +# watch them via a custom regex manager). The Mailu *runtime* patch level is kept +# current separately by .github/workflows/mailu-update.yml. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: ["*"] + + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + groups: + go-modules: + patterns: ["*"] + + # Mailu compose stack — bumps ghcr.io/mailu/* image tags. + - package-ecosystem: docker + directory: /deploy/mailu + schedule: + interval: weekly + + # Pod base image (docker.io/library/ubuntu). + - package-ecosystem: docker + directory: /pods + schedule: + interval: weekly diff --git a/setup.sh b/setup.sh index 9c2eb55..5f4c04c 100755 --- a/setup.sh +++ b/setup.sh @@ -52,7 +52,7 @@ IRC_NETWORK="${IRC_NETWORK:-ProfullstackBBS}" # IRC network name shown to clien ERGO_DATA="${ERGO_DATA:-/var/lib/ergo}" # Ergo state dir (ircd.db, tls/) FORGEJO="${FORGEJO:-1}" # set 0 to skip the AgentGit Forgejo backend (git.${DOMAIN#*.}) GIT_DOMAIN="${GIT_DOMAIN:-git.${DOMAIN#*.}}" # AgentGit host (default: git., e.g. git.profullstack.com) -FORGEJO_VERSION="${FORGEJO_VERSION:-11.0.1}" # Forgejo release to install +FORGEJO_VERSION="${FORGEJO_VERSION:-11.0.15}" # Forgejo release to install (latest 11.0.x LTS patch) MAIL_STACK="${MAIL_STACK:-1}" # set 0 to skip the co-located Mailu mail stack (mail.${DOMAIN#*.}). NOT named MAIL: that is a reserved env var (the mail-spool path, e.g. /var/mail/root) which PAM sets under sudo, so a CI deploy inherited MAIL=/var/mail/root and silently dropped the mail Caddy route + §9e provisioning. MAIL_DOMAIN="${MAIL_DOMAIN:-mail.${DOMAIN#*.}}" # mail host (default: mail., e.g. mail.profullstack.com) FORGEJO_HTTP_ADDR="${FORGEJO_HTTP_ADDR:-127.0.0.1:3000}" # Forgejo loopback HTTP (Caddy fronts it)