renovate.yml

name: Renovate
on:
  issues:
    # Dependency Dashboard
    types: [edited]
  pull_request_target:
    types:
      # rebaseLabel
      - labeled
      # stopUpdatingLabel
      - unlabeled
      # PrControls
      - edited
      # ignore update
      - closed
      # Edited/Blocked
      - synchronize
    branches: ["main"]
  push:
    branches:
      - "main"
      # https://docs.renovatebot.com/config-validation/#validation-of-renovate-config-change-prs
      - "renovate/reconfigure"
  schedule:
    # Run every 30 minutes:
    - cron: "0,30 * * * *"
  # This lets you dispatch a renovate job with different cache options if you want to reset or disable the cache manually.
  workflow_dispatch:
    inputs:
      repoCache:
        description: "Reset or disable the cache?"
        type: choice
        default: enabled
        options:
          - enabled
          - disabled
          - reset

permissions: {}

# Adding these as env variables makes it easy to re-use them in different steps and in bash.
env:
  # This is the dir renovate provides
  cache_dir: /tmp/renovate/cache
  # This can be manually changed to bust the cache if neccessary.
  cache_key: renovate-cache
  # tool versions
  # renovate: datasource=docker depName=renovate packageName=ghcr.io/renovatebot/renovate
  RENOVATE_VERSION: 37.377.4

jobs:
  env:
    runs-on: ubuntu-latest
    outputs:
      renovate_actor: "mazi-renovate[bot]"
      dashboard_title: "Dependency Dashboard"
      rebaseLabel: "rebase"
      stopUpdatingLabel: "stop-updating"
    steps:
      - run: ""

  renovate:
    name: Renovate
    needs: [env]
    if: >-
      ${{
        github.actor != needs.env.outputs.renovate_actor
        && (
            (github.event.issue.title == needs.env.outputs.dashboard_title && github.event.issue.user.login == needs.env.outputs.renovate_actor)
            || (
                github.event.pull_request.user.login == needs.env.outputs.renovate_actor
                && (
                    (github.event.action == 'labeled' && github.event.label.name == needs.env.outputs.rebaseLabel)
                    || (github.event.action == 'unlabeled' && github.event.label.name == needs.env.outputs.stopUpdatingLabel)
                    || contains(fromJSON('["edited", "closed", "synchronize"]'), github.event.action)
                )
            )
            || contains(fromJSON('["push", "schedule", "workflow_dispatch"]'), github.event_name)
        )
      }}
    concurrency:
      group: ${{ github.workflow }}
    runs-on: ubuntu-latest
    permissions:
      actions: write
    steps:
      - uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        id: restore-cache
        if: github.event.inputs.repoCache != 'disabled'
        with:
          key: ${{ env.cache_key }}
          path: ${{ env.cache_dir }}

      - run: sudo chown -R runneradmin:root /tmp/renovate/
        continue-on-error: true

      - name: Generate a token
        id: generate_token
        uses: actions/create-github-app-token@a0de6af83968303c8c955486bf9739a57d23c7f1 # v1.10.0
        with:
          app-id: ${{ vars.MAZI_RENOVATE_APP_ID }}
          private-key: ${{ secrets.MAZI_RENOVATE_PRIVATE_KEY }}

      - uses: renovatebot/github-action@063e0c946b9c1af35ef3450efc44114925d6e8e6 # v40.1.11
        with:
          token: ${{ steps.generate_token.outputs.token }}
          renovate-version: ${{ env.RENOVATE_VERSION }}
          env-regex: "^(?:RENOVATE_\\w+|FORCE_COLOR|LOG_LEVEL)$"
        env:
          # This enables the cache -- if this is set, it's not necessary to add it to renovate.json.
          RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}
          RENOVATE_AUTODISCOVER: true
          RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
          RENOVATE_DEPENDENCY_DASHBOARD_FOOTER: "- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository"
          RENOVATE_PLATFORM_COMMIT: true
          FORCE_COLOR: 3 # chalk.supportsColor
          LOG_LEVEL: debug

      - run: tree -L 5 -h --du -F "${cache_dir}"

      - name: delete old cache
        if: github.event.inputs.repoCache != 'disabled' && github.ref_name == github.event.repository.default_branch
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: gh cache delete ${{ steps.restore-cache.outputs.cache-primary-key }}
        continue-on-error: true

      - uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        if: github.event.inputs.repoCache != 'disabled' && github.ref_name == github.event.repository.default_branch
        with:
          key: ${{ steps.restore-cache.outputs.cache-primary-key }}
          path: ${{ env.cache_dir }}