feat(renovate): add manual run pipeline and sync configs

renovate-run workflow_dispatch runs pinned renovate via docker on self-hosted runner. Sync helm-values manager into config.js/configmap, bump compose and validator pins to 44.97.2.

renovate/README.md

@@ -24,12 +24,25 @@ The `renovate/k8s/active` marker makes the normal deployment workflow include
 the namespace, ConfigMap, and CronJob. The Secret is intentionally excluded
 from Git and must be applied separately after every new cluster.
 
-Run it immediately instead of waiting for the six-hour schedule:
+Run it immediately instead of waiting for the six-hour schedule.
+
+Two options, both use the same `renovate/config.js`:
 
 ```sh
 kubectl create job --from=cronjob/renovate renovate-manual-$(date +%s) -n renovate
 ```
 
+or the `renovate-run` Actions workflow (Actions tab → `renovate-run` →
+Run workflow). It runs `renovate/renovate:44.97.2` on the self-hosted
+runner via Docker. Required Actions secrets (repo or org settings):
+
+- `RENOVATE_TOKEN` — renovate-bot PAT (repository + issue read/write).
+- `RENOVATE_GITHUB_COM_TOKEN` — optional, for changelogs and GitHub rate limits.
+
+Inputs: `repositories` (default `forust/homelab`), `log_level`
+(`info`/`debug`). Only one run at a time (concurrency group
+`renovate-run`), same as the CronJob `Forbid` policy.
+
 Inspect runs with:
 
 ```sh

renovate/config.js

@@ -1,7 +1,10 @@
 module.exports = {
   platform: 'gitea',
   endpoint: process.env.RENOVATE_ENDPOINT,
-  enabledManagers: ['docker-compose', 'kubernetes'],
+  enabledManagers: ['docker-compose', 'kubernetes', 'helm-values'],
+  'helm-values': {
+    managerFilePatterns: ['/k8s/.+values\\.ya?ml$/'],
+  },
   kubernetes: {
     managerFilePatterns: ['/k8s/.+\\.ya?ml$/'],
   },

renovate/k8s/configmap.yaml

@@ -8,7 +8,10 @@ data:
     module.exports = {
       platform: 'gitea',
       endpoint: process.env.RENOVATE_ENDPOINT,
-      enabledManagers: ['docker-compose', 'kubernetes'],
+      enabledManagers: ['docker-compose', 'kubernetes', 'helm-values'],
+      'helm-values': {
+        managerFilePatterns: ['/k8s/.+values\\.ya?ml$/'],
+      },
       kubernetes: {
         managerFilePatterns: ['/k8s/.+\\.ya?ml$/'],
       },
@@ -22,7 +25,10 @@ data:
       dependencyDashboard: true,
       prCreation: 'immediate',
       labels: ['dependencies', 'automated'],
-      extends: ['config:recommended', ':dependencyDashboard'],
+      extends: [
+        'config:recommended',
+        ':dependencyDashboard',
+      ],
       packageRules: [
         {
           description: 'Do not update private homelab images',

renovate/renovate-compose.yaml

@@ -1,6 +1,6 @@
 services:
   renovate:
-    image: renovate/renovate:44.83.2
+    image: renovate/renovate:44.97.2
     container_name: renovate
     restart: "no"
     env_file: