From d1d8eabe40b080629f6079cf5270c55efc9914ec Mon Sep 17 00:00:00 2001
From: Jose Henrique <jose.henrique.ivan@gmail.com>
Date: Sat, 5 Sep 2026 13:05:41 -0300
Subject: [PATCH 1/3] ci: add manual Renovate trigger

---
 .gitattributes                         |  4 +++
 .gitea/workflows/trigger-renovate.yaml | 42 ++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100644 .gitattributes
 create mode 100644 .gitea/workflows/trigger-renovate.yaml

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..ba0f824
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,4 @@
+.gitattributes text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.md text eol=lf
diff --git a/.gitea/workflows/trigger-renovate.yaml b/.gitea/workflows/trigger-renovate.yaml
new file mode 100644
index 0000000..339d9e6
--- /dev/null
+++ b/.gitea/workflows/trigger-renovate.yaml
@@ -0,0 +1,42 @@
+name: Trigger Renovate
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  trigger-renovate:
+    name: Trigger Renovate
+    runs-on: runner-slim-amd64
+    env:
+      KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+    steps:
+      - name: Create a one-off Renovate job
+        shell: bash
+        run: |
+          set -eu
+
+          if [ -z "${KUBE_CONFIG}" ]; then
+            echo "KUBE_CONFIG is not set or is empty."
+            exit 1
+          fi
+
+          WORK_DIR="${RUNNER_TEMP:-/tmp}/renovate-${GITHUB_RUN_ID:-$$}"
+          mkdir -p "${WORK_DIR}"
+          trap 'rm -rf "${WORK_DIR}"' EXIT
+
+          apk add --no-cache curl
+          KUBECTL_VERSION="$(curl -fsSL https://dl.k8s.io/release/stable.txt)"
+          curl -fsSLo "${WORK_DIR}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+          chmod 0755 "${WORK_DIR}/kubectl"
+
+          KUBECONFIG="${WORK_DIR}/kubeconfig"
+          umask 077
+          printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > "${KUBECONFIG}"
+
+          RUN_ID="$(printf '%s' "${GITHUB_RUN_ID:-$(date -u +%Y%m%d%H%M%S)}" | tr -cd 'a-z0-9')"
+          JOB_NAME="renovate-manual-${RUN_ID}"
+
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" version --client
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get cronjob renovate
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs create job "${JOB_NAME}" --from=cronjob/renovate
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get job "${JOB_NAME}" -o wide
-- 
2.54.0


From 72d93f7e921024f293c1a007ed3719f7d6dfb565 Mon Sep 17 00:00:00 2001
From: Jose Henrique <jose.henrique.ivan@gmail.com>
Date: Sat, 5 Sep 2026 13:06:17 -0300
Subject: [PATCH 2/3] docs: add Haven project context

---
 project-context.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 project-context.md

diff --git a/project-context.md b/project-context.md
new file mode 100644
index 0000000..695b0de
--- /dev/null
+++ b/project-context.md
@@ -0,0 +1,25 @@
+# Haven project context
+
+## Purpose
+
+`haven` is the public GitOps specification repository for the Haven Kubernetes cluster. Argo CD continuously reconciles the manifests on `main` into the cluster.
+
+## Repository organization
+
+- `apps/<namespace>/*.yaml` — one application or infrastructure specification per file. The directory name selects its target namespace through the root ApplicationSet.
+- `apps/root/applicationset.yaml` — discovers `apps/*/*.yaml` and creates Argo CD Applications that automatically prune and self-heal.
+- `bootstrap/` — cluster bootstrap manifests such as namespaces, Argo CD configuration, and address pools.
+- `secrets/` — Kubernetes secret specifications referenced by applications.
+- `.gitea/workflows/trigger-renovate.yaml` — manually triggered Gitea Actions workflow that creates an immediate one-off Job from the live `cronjobs/renovate` CronJob.
+
+## Build and deploy
+
+- Commit manifest changes to `main`; the root ApplicationSet reconciles them automatically.
+- The `Trigger Renovate` Gitea workflow is manual-only (`workflow_dispatch`). It downloads `kubectl`, writes `${{ secrets.KUBE_CONFIG }}` to an ephemeral kubeconfig, verifies the live CronJob, then creates a uniquely named Job in the `cronjobs` namespace from `cronjob/renovate`.
+- The kubeconfig is supplied at execution time as the repository or organization `KUBE_CONFIG` secret. No credentials are stored in this repository.
+
+## Conventions
+
+- Keep Kubernetes manifest and workflow YAML LF-terminated; `.gitattributes` enforces this for `.yaml` and `.yml` files.
+- Do not commit plaintext credentials. Kubernetes resources should continue to reference the existing secret mechanisms.
+- A manual Renovate dispatch starts an additional run; the weekly CronJob schedule remains unchanged.
-- 
2.54.0


From 24d1c87987f224fd639ec12adbac03355a44836d Mon Sep 17 00:00:00 2001
From: Renovate Bot <bot@renovateapp.com>
Date: Sat, 5 Sep 2026 16:07:23 +0000
Subject: [PATCH 3/3] Update dependency ansible-lint to v26.8.0

---
 ansible/requirements-dev.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/requirements-dev.txt b/ansible/requirements-dev.txt
index bf2b762..1df50d4 100644
--- a/ansible/requirements-dev.txt
+++ b/ansible/requirements-dev.txt
@@ -1,2 +1,2 @@
 -r requirements-python.txt
-ansible-lint==26.6.0
+ansible-lint==26.8.0
-- 
2.54.0