feat(ralphex-fe): let Renovate bump Bun and Hugo; drop the manual push workflow (#134)

ralphex-fe has no mise, and its published tag is literally bun<BUN>-hugo<HUGO>,
so Bun and Hugo are image-level versions with nowhere else to be set. They were
the only pinned ARGs in the repo without a `# renovate:` annotation, and that
absence is the sole reason update-and-build-ralphex-fe.yml existed.

Annotated both and grouped them as "ralphex-fe toolchain" with automerge and the
same 3-day soak the non-claude agent tools get. Bun uses the npm datasource
because oven-sh/bun tags releases as "bun-v1.4.2", which the existing
github-releases extractVersion does not strip; the npm package publishes bare
semver that matches the ARG format directly.

update-and-build-ralphex-fe.yml is deleted rather than fixed. It took version
inputs, rewrote the Dockerfile, and pushed the commit straight to master as
github-actions[bot] -- the one direct-push path in the repo, and the reason a
branch ruleset needed a bypass actor that GitHub does not offer for Actions.
Renovate now covers what it did, and build-ralphex-fe.yml already has
workflow_dispatch for manual rebuilds, so nothing is lost except the
push-to-master.

README sections that documented driving that workflow are replaced with how to
force a rebuild and how to change a pinned version (edit the ARG, open a PR).

Note the first Renovate PR will be a real jump: Bun 1.3.9 -> 1.4.2 and Hugo
0.156.0 -> 0.166.0.

Verified: actionlint clean; hadolint clean on ralphex-fe/Dockerfile;
renovate-config-validator "Config validated successfully"; and the
customManager matchString exercised against both Dockerfiles in Python --
it now extracts bun/npm/1.3.9 and gohugoio/hugo/github-releases/0.156.0
alongside the four existing tools.

Author: gatezh

.github/renovate.json5

@@ -61,5 +61,17 @@
       matchPackageNames: ['@anthropic-ai/claude-code'],
       minimumReleaseAge: null,
     },
+    {
+      // ralphex-fe bakes its toolchain into the image — it has no mise, and
+      // its published tag is literally bun<BUN>-hugo<HUGO>. So these are
+      // image-level versions, not per-project ones, and there is no other
+      // place to set them. Bun uses the npm datasource because oven-sh/bun
+      // tags releases as "bun-v1.4.2", which the github-releases extractVersion
+      // above does not strip.
+      matchPackageNames: ['bun', 'gohugoio/hugo'],
+      groupName: 'ralphex-fe toolchain',
+      automerge: true,
+      minimumReleaseAge: '3 days',
+    },
   ],
 }

.github/workflows/update-and-build-ralphex-fe.yml

@@ -183,43 +183,22 @@ issue tracks what is pending. Everything else — including base images and Bun/
 > Setting `mode` in `renovate.json5` cannot substitute for the Silent-mode toggle, because `dryRun`
 > takes precedence over `mode` and is admin-level.
 
-### Via GitHub UI
+### Manual rebuilds
 
-Some images have automated update workflows that allow you to update dependency versions without manually editing Dockerfiles:
-
-1. Go to **Actions** tab → Select the update workflow (e.g., "Update and Build ralphex-fe")
-2. Click **Run workflow**
-3. Enter new versions (e.g., Bun 1.4.0, Hugo 0.156.0)
-4. Click **Run workflow** button
-
-The workflow will:
-- Update the Dockerfile with new versions
-- Commit the changes to the repository
-- Build and push the updated image
-
-### Via GitHub CLI
-
-If you have the [GitHub CLI](https://cli.github.com/) installed, you can trigger updates from your terminal:
+Every image has a `workflow_dispatch` trigger, so a rebuild can be forced without a code change:
 
 ```bash
-# Update ralphex-fe image versions
-gh workflow run update-and-build-ralphex-fe.yml \
-  -f bun_version=1.4.0 \
-  -f hugo_version=0.156.0
+# Rebuild one image from current master
+gh workflow run build-ralphex-fe.yml
 
-# Update without building (just commit to repo)
-gh workflow run update-and-build-ralphex-fe.yml \
-  -f bun_version=1.4.0 \
-  -f hugo_version=0.156.0 \
-  -f update_only=true
-
-# Check workflow status
-gh run list --workflow=update-and-build-ralphex-fe.yml
-
-# Watch the latest run in real-time
+# Check status / watch
+gh run list --workflow=build-ralphex-fe.yml
 gh run watch
 ```
 
+To change a pinned version, edit the `ARG` in that image's Dockerfile and open a PR — the merge
+triggers the build. There is no longer a workflow that rewrites Dockerfiles and pushes to `master`.
+
 **Install GitHub CLI:**
 ```bash
 # macOS

README.md

@@ -1,6 +1,8 @@
+# renovate: datasource=npm depName=bun
 ARG BUN_VERSION=1.3.9
 ARG DOCKER_VERSION=29.3.0
 ARG GO_VERSION=1.24.4
+# renovate: datasource=github-releases depName=gohugoio/hugo
 ARG HUGO_VERSION=0.156.0
 
 # ═════════════════════════════════════════════════════════════════════════════

ralphex-fe/Dockerfile

@@ -21,9 +21,9 @@ This is a standalone image, not a devcontainer.
 | Ralphex | 1.6.0 (pinned) |
 | Git, ripgrep, jq, curl, wget | system |
 
-The pinned versions live as `ARG`s in the Dockerfile and are kept current by Renovate — see
-[Automatic Rebuilds](#automatic-rebuilds). Bun and Hugo are bumped manually via the
-`update-and-build-ralphex-fe.yml` workflow.
+All pinned versions live as `ARG`s in the Dockerfile and are kept current by Renovate — see
+[Automatic Rebuilds](#automatic-rebuilds). This image has no `mise`, so its Bun and Hugo are
+image-level versions rather than per-project ones; Renovate tracks them like everything else.
 
 ## Usage