name: Renovate

on:
  schedule:
    # Daily at 15:47 UTC: 16:47 in Oslo in winter, 17:47 in summer. Each repository's
    # renovate.json decides when PRs open; a run refreshes its dependency dashboard and
    # opens the PRs approved there.
    - cron: "47 15 * * *"
  workflow_dispatch:
    inputs:
      repository:
        description: "One repository, such as edb/galtinn; empty for all of edb"
        required: false
        default: ""

# Runs on the same repository wait for each other instead of racing on its branches.
concurrency:
  group: renovate-${{ inputs.repository || 'all' }}
  cancel-in-progress: false

jobs:
  renovate:
    runs-on: ubuntu-latest
    container: ghcr.io/renovatebot/renovate:44
    steps:
      - name: Run Renovate
        env:
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: https://git.neuf.no/api/v1
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no>
          # ed25519 key; its public half is on the renovate account. Gitea shows a commit as
          # verified only if the author email is a verified email on that account.
          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
          # Every edb repository the renovate account can write to, or the one a manual run
          # names. Ticking a box Renovate wrote dispatches such a run (edb-infra, roles/gitea.md).
          RENOVATE_AUTODISCOVER: "true"
          RENOVATE_AUTODISCOVER_FILTER: ${{ inputs.repository || 'edb/*' }}
          # A rebase box on onboarding PRs too, so they can be fast-forwarded. Experimental.
          RENOVATE_ONBOARDING_REBASE_CHECKBOX: "true"
          # Raises the GitHub API rate limit for release notes and github-tags lookups
          GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
          LOG_LEVEL: info
        run: renovate