Merge pull request 'fix(ci): corps JSON valide dans le dispatch Renovate (accolades doublées → 422)' (#38) from fix/renovate-dispatch-json into main

Reviewed-on: #38

.gitea/workflows/tag.yaml

@@ -41,3 +41,33 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           pull: true
+
+  release:
+    # Publishes the Gitea release for this tag (body = commits since the previous
+    # tag). Renovate copies that body into the bump PR in
+    # perso_private/tf-depl-kubernetes under "Release Notes"; without a release
+    # that section stays empty (bare "Compare Source" link).
+    needs: [build-push]
+    uses: perso/gitea-pipelines/.gitea/workflows/gitea-release.yaml@main
+    with:
+      image: jcabillot/opencode-dispatch
+    secrets: inherit
+
+  trigger-renovate:
+    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
+    # Renovate instance only scans hourly, so this dispatch opens the image bump
+    # PR within minutes of the release instead of up to an hour later.
+    needs: [build-push, release]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
+        # needs: build-push — Renovate reads Docker Hub, so a scan started before
+        # the push lands would only see the previous release.
+        # RENOVATE_TOKEN is the org-level secret of this organisation.
+        run: |
+          curl -sS -f -X POST \
+            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{"ref":"main"}' \
+            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
+          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"