Merge pull request 'ci(tag): déclenche Renovate sur tf-depl-kubernetes dès que l'image de release est poussée (opencode-openchamber)' (#62) from ci/renovate-dispatch-on-release into main

Reviewed-on: #62

.gitea/workflows/tag.yaml

@@ -38,3 +38,22 @@ jobs:
           pull: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  trigger-renovate:
+    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
+    # Renovate instance only scans hourly, so this dispatch opens the image bump
+    # PR within minutes of the release instead of up to an hour later.
+    needs: [build-push]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
+        # needs: build-push — Renovate reads Docker Hub, so a scan started before
+        # the push lands would only see the previous release.
+        # RENOVATE_TOKEN is the org-level secret of this organisation.
+        run: |
+          curl -sS -f -X POST \
+            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{{"ref":"main"}}' \
+            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
+          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"

Dockerfile

@@ -1,7 +1,8 @@
-# hadolint ignore=DL3007
-FROM jcabillot/opencode:latest
+# `vX.Y.Z-latest` = the vX.Y.Z release rebuilt nightly by perso/opencode's cron job
+# (fresh Debian/npm packages); the bare `latest` tag stays frozen at the last release.
+FROM jcabillot/opencode:v0.0.60-latest
 
-ARG OPENCHAMBER_WEB_VERSION=2.3.1
+ARG OPENCHAMBER_WEB_VERSION=2.3.3
 
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false \
   NPM_CONFIG_LOGLEVEL=warn \