renovate.yml

name: Renovate
on:
  repository_dispatch:
    types: [renovate]
  schedule:
    # Run every 30 minutes:
    - cron: "0,30 * * * *"

permissions: {}

# Adding these as env variables makes it easy to re-use them in different steps and in bash.
env:
  # This is the dir renovate provides -- if we set our own directory via cacheDir, we can run into permissions issues.
  # It is also possible to cache a higher level of the directory, but it has minimal benefit. While renovate execution
  # time gets faster, it also takes longer to upload the cache as it grows bigger.
  # cache_dir: /tmp/renovate/cache/renovate/repository
  cache_dir: /tmp/renovate/cache
  # This can be manually changed to bust the cache if neccessary.
  cache_key: renovate-cache
  # tool versions
  # renovate: datasource=docker depName=renovate packageName=ghcr.io/renovatebot/renovate
  RENOVATE_VERSION: 37.415.0

jobs:
  renovate:
    name: Renovate
    concurrency:
      group: ${{ github.workflow }}
    runs-on: ubuntu-latest
    permissions:
      actions: write
    steps:
      - uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        id: restore-cache
        if: github.event.client_payload.repoCache != 'disabled'
        with:
          key: ${{ env.cache_key }}
          path: ${{ env.cache_dir }}

      - run: sudo chown -R runneradmin:root /tmp/renovate/
        continue-on-error: true

      - name: Generate a token
        id: generate_token
        uses: actions/create-github-app-token@c8f55efbd427e7465d6da1106e7979bc8aaee856 # v1.10.1
        with:
          app-id: ${{ vars.MAZI_RENOVATE_APP_ID }}
          private-key: ${{ secrets.MAZI_RENOVATE_PRIVATE_KEY }}

      - uses: renovatebot/github-action@21d88b0bf0183abcee15f990011cca090dfc47dd # v40.1.12
        with:
          token: ${{ steps.generate_token.outputs.token }}
          renovate-version: ${{ env.RENOVATE_VERSION }}
          env-regex: "^(?:RENOVATE_\\w+|FORCE_COLOR|LOG_LEVEL)$"
        env:
          # This enables the cache -- if this is set, it's not necessary to add it to renovate.json.
          RENOVATE_REPOSITORY_CACHE: ${{ github.event.client_payload.repoCache || 'enabled' }}
          RENOVATE_AUTODISCOVER: true # Renovate runs NOT only on this repository.
          RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository_owner }}/*"
          RENOVATE_DEPENDENCY_DASHBOARD_FOOTER: "- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository"
          RENOVATE_PLATFORM_COMMIT: true
          FORCE_COLOR: 3 # chalk.supportsColor
          LOG_LEVEL: debug

          # customize
          RENOVATE_PR_FOOTER: "This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate/tree/${{ env.RENOVATE_VERSION }}). - [View logs](${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }})"
          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^pnpm install --frozen-lockfile --ignore-scripts$", "^pnpm run build$"]'
          RENOVATE_ONBOARDING_CONFIG_FILE_NAME: .renovaterc.json

      - run: tree -L 5 -h --du -F "${cache_dir}"

      - name: delete old cache
        if: github.event.client_payload.repoCache != 'disabled' && github.ref_name == github.event.repository.default_branch
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: gh cache delete ${{ steps.restore-cache.outputs.cache-primary-key }}
        continue-on-error: true

      - uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        if: github.event.client_payload.repoCache != 'disabled' && github.ref_name == github.event.repository.default_branch
        with:
          key: ${{ steps.restore-cache.outputs.cache-primary-key }}
          path: ${{ env.cache_dir }}