Still testing and fiddling, but I’m using the forgejo-runner. Renovate is just another repository, with a workflow to get it started:

on:
  schedule:
    - cron: '5 2 * * *'
    - cron: '5 14 * * *'

jobs:
  build:
    runs-on: docker
    container:
      image: renovate/renovate:37.140-full
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Run renovate
        env:
          PAT: ${{ secrets.PAT }}
          GITHUB_COM_TOKEN: ${{ secrets.GITHUB }}
        run: |
          echo "Running renovate"
          cd ${GITHUB_WORKSPACE}
          renovate --token ${PAT}          

The renovate image has been pulled by hand and the forgejo-runner will happily start the image. Both PAT and GITHUB secrets are configured as ‘action secrets’ within the renovate repository.

Besides the workflow, the repository contains renovate.json and config.js, so renovate has the correct configuration.