Fix Renovate lookup failures for dhi.io/caddy and tmp #351

New issue

Closed

opened 2026-06-06 23:21:03 +00:00 by steve · 0 comments

steve commented

2026-06-06 23:21:03 +00:00

Owner

The Forgejo Renovate workflow warns and fails dependency lookups for dhi.io/caddy and npm tmp.

Problem

.forgejo/workflows/renovate.yml logs:

WARN: Package lookup failures (repository=lapis-notes/lapis)
"warnings": [
  "Failed to look up docker package dhi.io/caddy: no-result",
  "Failed to look up npm package tmp: no-result"
]

dhi.io/caddy:2 is the hardened Caddy runtime in docker/web/Dockerfile. Renovate treats dhi.io as a Docker Hub user unless registryAliases and Docker Hub credentials are configured.
tmp is pinned via a pnpm override (tmp@<0.2.6: '>=0.2.6'). Renovate should not attempt registry lookups for this security pin.

Goal

Renovate runs cleanly without package lookup failures for these dependencies.

Scope

renovate.json
.forgejo/workflows/renovate.yml

Non-goals

Changing the Caddy base image or tmp override policy.
Broader Renovate schedule or PR policy changes.

Acceptance Criteria

renovate.json maps dhi.io as an independent Docker registry.
Renovate workflow supplies Docker Hub credentials for dhi.io lookups (same creds as publish-web.yml).
Renovate skips registry lookups for npm tmp (override pin).
Renovate config validates locally.

Implementation Notes

Add registryAliases: { "dhi.io": "dhi.io" } to renovate.json.
Pass RENOVATE_HOST_RULES with matchHost: dhi.io, hostType: docker, and DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets.
Disable Renovate for package tmp via packageRules.

Suggested Files or Specs To Inspect

renovate.json
.forgejo/workflows/renovate.yml
.forgejo/workflows/publish-web.yml
docker/web/Dockerfile
package.json (pnpm.overrides)

Validation Commands

npx --yes renovate-config-validator renovate.json
pnpm check:all

Follow-up Tasks

Implementation Summary

Added dhi.io registryAliases and Docker Hub hostRules to Renovate workflow; disabled npm tmp override lookups in renovate.json. Validated with renovate-config-validator and pnpm check:all.

The Forgejo Renovate workflow warns and fails dependency lookups for `dhi.io/caddy` and npm `tmp`. ## Problem `.forgejo/workflows/renovate.yml` logs: ``` WARN: Package lookup failures (repository=lapis-notes/lapis) "warnings": [ "Failed to look up docker package dhi.io/caddy: no-result", "Failed to look up npm package tmp: no-result" ] ``` - `dhi.io/caddy:2` is the hardened Caddy runtime in `docker/web/Dockerfile`. Renovate treats `dhi.io` as a Docker Hub user unless `registryAliases` and Docker Hub credentials are configured. - `tmp` is pinned via a pnpm override (`tmp@<0.2.6: '>=0.2.6'`). Renovate should not attempt registry lookups for this security pin. ## Goal Renovate runs cleanly without package lookup failures for these dependencies. ## Scope - `renovate.json` - `.forgejo/workflows/renovate.yml` ## Non-goals - Changing the Caddy base image or tmp override policy. - Broader Renovate schedule or PR policy changes. ## Acceptance Criteria - [ ] `renovate.json` maps `dhi.io` as an independent Docker registry. - [ ] Renovate workflow supplies Docker Hub credentials for `dhi.io` lookups (same creds as `publish-web.yml`). - [ ] Renovate skips registry lookups for npm `tmp` (override pin). - [ ] Renovate config validates locally. ## Implementation Notes - Add `registryAliases: { "dhi.io": "dhi.io" }` to `renovate.json`. - Pass `RENOVATE_HOST_RULES` with `matchHost: dhi.io`, `hostType: docker`, and `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN` secrets. - Disable Renovate for package `tmp` via `packageRules`. ## Suggested Files or Specs To Inspect - `renovate.json` - `.forgejo/workflows/renovate.yml` - `.forgejo/workflows/publish-web.yml` - `docker/web/Dockerfile` - `package.json` (`pnpm.overrides`) ## Validation Commands ```bash npx --yes renovate-config-validator renovate.json pnpm check:all ``` ## Related Issues ## Follow-up Tasks ## Implementation Summary Added dhi.io registryAliases and Docker Hub hostRules to Renovate workflow; disabled npm tmp override lookups in renovate.json. Validated with renovate-config-validator and pnpm check:all.

steve added the

subsystem:ci

subsystem:dependencies

subsystem:renovate

open

labels

2026-06-06 23:21:03 +00:00

steve referenced this issue from a commit

2026-06-06 23:22:53 +00:00

Fix Renovate lookup failures for dhi.io/caddy and tmp.

steve

2026-06-06 23:22:53 +00:00