From f5362b04d42c89507cf12ce80db7a14cec2f7895 Mon Sep 17 00:00:00 2001
From: Austin Bennett <austin@thebennett.net>
Date: Wed, 22 Jul 2026 21:03:06 -0500
Subject: [PATCH] Pin platform 0.1.0 release and wire up automatic propagation

- parent/BOM now point at the immutable 0.1.0 release instead of a SNAPSHOT
- declare the Gitea Maven registry so Renovate can discover new platform versions
- renovate.json: group platform bumps into one automerged PR
- CI: drop --no-cache (releases are immutable, so caching is safe again) and add
  workflow_dispatch so rebuild-all-apps.sh can force an urgent rebuild
---
 .gitea/workflows/build.yml |  9 ++++++---
 pom.xml                    | 18 +++++++++++++++---
 renovate.json              | 15 +++++++++++++++
 3 files changed, 36 insertions(+), 6 deletions(-)
 create mode 100644 renovate.json

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index bb86f09..f07e3ad 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -2,6 +2,9 @@ name: build-and-publish
 on:
   push:
     branches: [main]
+  # Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
+  # instead of waiting for a Renovate bump PR).
+  workflow_dispatch:
 
 jobs:
   build:
@@ -12,15 +15,15 @@ jobs:
       - name: Log in to the Gitea container registry
         run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
-      # --no-cache: the platform is a 0.1.0-SNAPSHOT dependency, so a stale cached maven layer could bake
-      # in an old (e.g. unpatched) version. Always resolve fresh for a correct, scanned image.
+      # The platform is now referenced by an immutable RELEASE version, so a cached maven layer can't
+      # silently hold an old build — layer caching is safe again (and much faster).
       - name: Build image
         env:
           DOCKER_BUILDKIT: "1"
           MAVEN_USER: ${{ secrets.REGISTRY_USER }}
           MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          docker build --no-cache \
+          docker build \
             --secret id=maven_user,env=MAVEN_USER \
             --secret id=maven_token,env=MAVEN_TOKEN \
             --build-arg GIT_SHA=${{ github.sha }} \
diff --git a/pom.xml b/pom.xml
index 3543fe8..053b414 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,13 +7,13 @@
     <parent>
         <groupId>net.thebennett.platform</groupId>
         <artifactId>platform-parent</artifactId>
-        <version>0.1.0-SNAPSHOT</version>
+        <version>0.1.0</version>
         <relativePath/>
     </parent>
 
     <groupId>net.reformedwitness</groupId>
     <artifactId>confessions-of-grace</artifactId>
-    <version>0.1.0-SNAPSHOT</version>
+    <version>0.1.0</version>
     <name>Confessions of Grace</name>
     <description>Reformed devotional site — posts, authors, comments, subscriptions — on the Bennett platform.</description>
 
@@ -26,7 +26,7 @@
             <dependency>
                 <groupId>net.thebennett.platform</groupId>
                 <artifactId>platform-bom</artifactId>
-                <version>0.1.0-SNAPSHOT</version>
+                <version>0.1.0</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -40,6 +40,18 @@
         </dependencies>
     </dependencyManagement>
 
+    <!-- Platform releases live in the Gitea Maven registry (anonymous read). Declared here so Renovate
+         can discover new platform versions and open a bump PR. Maven still needs this repo in
+         settings.xml for PARENT resolution (see .gitea/ci-settings.xml). -->
+    <repositories>
+        <repository>
+            <id>gitea</id>
+            <url>https://git.thebennett.net/api/packages/austin/maven</url>
+            <releases><enabled>true</enabled></releases>
+            <snapshots><enabled>false</enabled></snapshots>
+        </repository>
+    </repositories>
+
     <dependencies>
         <dependency>
             <groupId>net.thebennett.platform</groupId>
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..73fce27
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "packageRules": [
+    {
+      "description": "Bennett platform releases: our own code, already tested and Trivy-scanned before publish. Group the parent + BOM + starters into one PR and merge it automatically so security fixes reach this app without manual work. Merging main triggers the build, which re-runs tests and re-scans; if either fails no image is pushed, so a bad bump can't reach production.",
+      "matchPackageNames": ["net.thebennett.platform:**"],
+      "groupName": "bennett platform",
+      "automerge": true
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "labels": ["security"]
+  }
+}