feat(ralphex-fe): let Renovate bump Bun and Hugo; drop the manual push-to-master workflow

[gatezh]

ralphex-fe has no mise — it curls Hugo and Bun directly in its Dockerfile, and its published tag is literally bun<BUN>-hugo<HUGO>. So unlike claude-code, these are image-level versions with no per-project layer to set them from.

They were also the only pinned ARGs in the repo without a # renovate: annotation, and that absence is the sole reason update-and-build-ralphex-fe.yml existed.

What changed

Annotated both ARGs and grouped them as ralphex-fe toolchain — automerge on, with the same 3-day soak the non-claude agent tools get.

Bun uses the npm datasource, not github-releases: oven-sh/bun tags releases as bun-v1.4.2, which the existing extractVersion: '^v?(...)' does not strip. The npm bun package publishes bare semver (1.4.2) matching the ARG format directly. Hugo tags as v0.166.0, which the existing rule handles.

Deleted update-and-build-ralphex-fe.yml rather than repairing it. It took version inputs, rewrote the Dockerfile, and pushed the commit straight to master as github-actions[bot].

That was the repo's only direct-push-to-master path, and the reason the planned branch ruleset needed a bypass actor for GitHub Actions — which GitHub does not offer: the bypass picker lists repo roles and installed GitHub Apps, and Actions is built in rather than installed. Rather than work around that with a PAT or a bot identity, this removes the push.

Nothing is lost: Renovate now covers the version bumps, and build-ralphex-fe.yml already has workflow_dispatch for manual rebuilds.

READMEs updated where they documented driving the deleted workflow — replaced with how to force a rebuild and how to change a pinned version (edit the ARG, open a PR).

Heads-up

The first Renovate PR from this will be a real jump, not a no-op:

	Current	Latest
Bun	1.3.9	1.4.2
Hugo	0.156.0	0.166.0

It will auto-merge on green and republish the image. Worth watching that one rather than letting it sail through.

Verification

• actionlint — clean.
• hadolint on ralphex-fe/Dockerfile with the repo's .hadolint.yaml — clean.
• renovate-config-validator (official image, validated as repo config) — "Config validated successfully".
• The customManager matchString exercised against both Dockerfiles, since config validation does not test the regex against real files:

--- ralphex-fe/Dockerfile ---
  bun                        npm              current=1.3.9
  gohugoio/hugo              github-releases  current=0.156.0
  rtk-ai/rtk                 github-releases  current=0.48.0
  umputun/ralphex            github-releases  current=1.7.0
  @anthropic-ai/claude-code  npm              current=2.1.266

Both new entries extract with the right datasource and current value, and the four existing tools still match.

Note

docs/plans/ and docs/superpowers/ still mention the deleted workflow. Those are historical planning artifacts describing what was true when they were written, so they are deliberately left alone.