renovate.yaml

---
# yoinked from onedr0p and modified
# info in comments is accurate as of 2023-11-25
name: "Renovate"

on:
  workflow_call:
  workflow_dispatch:
    inputs:
      dryRun:
        description: Dry-Run
        default: "false"
        required: false
      logLevel:
        description: Log-Level
        default: debug
        required: false
  schedule:
    - cron: "*/2 * * * *" # every 30 minutes
  push:
    branches: ["main"]
    paths:
      - renovate.json5
      - .renovaterc.json5
      - .renovate/**
      - .github/renovate**
      - .github/workflows/renovate.yaml

env:
  LOG_LEVEL: debug
  RENOVATE_DRY_RUN: false
  RENOVATE_PLATFORM: "github"
  RENOVATE_PLATFORM_COMMIT: "true"
  # for those forking: set your own secrets in your GitHub repo settings before running
  RENOVATE_AUTODISCOVER: true
  RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}" # this is to prevent forks from running Renovate against upstream repo
  RENOVATE_USERNAME: "${{ secrets.BOT_USERNAME }}[bot]"
  RENOVATE_GIT_AUTHOR: "${{ secrets.BOT_USERNAME }} <${{ secrets.BOT_API_ID }}+${{ secrets.BOT_USERNAME }}[bot]@users.noreply.github.com>" # get $BOT_API_ID from `curl -s 'https://api.github.com/users/$(BOT_USERNAME)%5Bbot%5D' | yq .id`

jobs:
  renovate:
    name: Renovate
    runs-on: ubuntu-latest
    steps:
      - name: "Generate Short Lived OAuth App Token (ghs_*)"
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
        id: oauth-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}" # $BOT_APP_ID is found in GitHub App main settings page
          private-key: "${{ secrets.BOT_JWT_PRIVATE_KEY }}" # $BOT_JWT_PRIVATE_KEY is generated in GitHub App main settings page, uses the X.509 private key format

      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          token: "${{ steps.oauth-token.outputs.token }}"

      - name: Override default config from dispatch variables
        shell: bash
        run: |
          echo "RENOVATE_DRY_RUN=${{ github.event.inputs.dryRun || env.RENOVATE_DRY_RUN }}" >> "${GITHUB_ENV}"
          echo "LOG_LEVEL=${{ github.event.inputs.logLevel || env.LOG_LEVEL }}" >> "${GITHUB_ENV}"

      - name: Renovate
        uses: renovatebot/github-action@80eaf969abf68ad62aa94d9ab392421b31621634 # v40.3.4
        with:
          token: "${{ steps.oauth-token.outputs.token }}"