feat(ralphex-fe): let Renovate bump Bun and Hugo; drop the manual push-to-master workflow

.github/renovate.json5

@@ -61,5 +61,17 @@
       matchPackageNames: ['@anthropic-ai/claude-code'],
       minimumReleaseAge: null,
     },
+    {
+      // ralphex-fe bakes its toolchain into the image — it has no mise, and
+      // its published tag is literally bun<BUN>-hugo<HUGO>. So these are
+      // image-level versions, not per-project ones, and there is no other
+      // place to set them. Bun uses the npm datasource because oven-sh/bun
+      // tags releases as "bun-v1.4.2", which the github-releases extractVersion
+      // above does not strip.
+      matchPackageNames: ['bun', 'gohugoio/hugo'],
+      groupName: 'ralphex-fe toolchain',
+      automerge: true,
+      minimumReleaseAge: '3 days',
+    },
   ],
 }

README.md

@@ -183,43 +183,22 @@ issue tracks what is pending. Everything else — including base images and Bun/
 > Setting `mode` in `renovate.json5` cannot substitute for the Silent-mode toggle, because `dryRun`
 > takes precedence over `mode` and is admin-level.
 
-### Via GitHub UI
+### Manual rebuilds
 
-Some images have automated update workflows that allow you to update dependency versions without manually editing Dockerfiles:
-
-1. Go to **Actions** tab → Select the update workflow (e.g., "Update and Build ralphex-fe")
-2. Click **Run workflow**
-3. Enter new versions (e.g., Bun 1.4.0, Hugo 0.156.0)
-4. Click **Run workflow** button
-
-The workflow will:
-- Update the Dockerfile with new versions
-- Commit the changes to the repository
-- Build and push the updated image
-
-### Via GitHub CLI
-
-If you have the [GitHub CLI](https://cli.github.com/) installed, you can trigger updates from your terminal:
+Every image has a `workflow_dispatch` trigger, so a rebuild can be forced without a code change:
 
 ```bash
-# Update ralphex-fe image versions
-gh workflow run update-and-build-ralphex-fe.yml \
-  -f bun_version=1.4.0 \
-  -f hugo_version=0.156.0
+# Rebuild one image from current master
+gh workflow run build-ralphex-fe.yml
 
-# Update without building (just commit to repo)
-gh workflow run update-and-build-ralphex-fe.yml \
-  -f bun_version=1.4.0 \
-  -f hugo_version=0.156.0 \
-  -f update_only=true
-
-# Check workflow status
-gh run list --workflow=update-and-build-ralphex-fe.yml
-
-# Watch the latest run in real-time
+# Check status / watch
+gh run list --workflow=build-ralphex-fe.yml
 gh run watch
 ```
 
+To change a pinned version, edit the `ARG` in that image's Dockerfile and open a PR — the merge
+triggers the build. There is no longer a workflow that rewrites Dockerfiles and pushes to `master`.
+
 **Install GitHub CLI:**
 ```bash
 # macOS

ralphex-fe/Dockerfile

@@ -1,6 +1,8 @@
+# renovate: datasource=npm depName=bun
 ARG BUN_VERSION=1.3.9
 ARG DOCKER_VERSION=29.3.0
 ARG GO_VERSION=1.24.4
+# renovate: datasource=github-releases depName=gohugoio/hugo
 ARG HUGO_VERSION=0.156.0
 
 # ═════════════════════════════════════════════════════════════════════════════

ralphex-fe/README.md

@@ -21,9 +21,9 @@ This is a standalone image, not a devcontainer.
 | Ralphex | 1.6.0 (pinned) |
 | Git, ripgrep, jq, curl, wget | system |
 
-The pinned versions live as `ARG`s in the Dockerfile and are kept current by Renovate — see
-[Automatic Rebuilds](#automatic-rebuilds). Bun and Hugo are bumped manually via the
-`update-and-build-ralphex-fe.yml` workflow.
+All pinned versions live as `ARG`s in the Dockerfile and are kept current by Renovate — see
+[Automatic Rebuilds](#automatic-rebuilds). This image has no `mise`, so its Bun and Hugo are
+image-level versions rather than per-project ones; Renovate tracks them like everything else.
 
 ## Usage