renovate.yml

name: Renovate
on:
  schedule:
    # At minute 3 past hour 4
    - cron: '3 4 * * *'
  workflow_dispatch:
  pull_request:
    paths:
      - '.github/renovate*'
      - '.github/workflows/renovate*'
  push:
    branches:
      - 'main'
    paths:
      - '.github/renovate*'
      - '.github/workflows/renovate*'

jobs:
  renovate:
    runs-on: ubuntu-latest
    concurrency: renovate-${{ github.ref }}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.RENOVATE_APP_ID }}
          private_key: ${{ secrets.RENOVATE_PEM }}

      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate Renovate JSON
        run: jq empty .github/renovate.json

      - name: Generate Dry Run
        if: ${{ github.ref != 'refs/heads/main' }}
        run: jq '.dryRun = "true"' .github/renovate.json > .github/renovate-dry-run.json

      - name: Renovate - Dry Run
        uses: renovatebot/github-action@v40.2.7
        if: ${{ github.ref != 'refs/heads/main' }}
        with:
          configurationFile: .github/renovate-dry-run.json
          token: 'x-access-token:${{ steps.generate_token.outputs.token }}'

      - name: Renovate
        uses: renovatebot/github-action@v40.2.7
        if: ${{ github.ref == 'refs/heads/main' }}
        with:
          configurationFile: .github/renovate.json
          token: 'x-access-token:${{ steps.generate_token.outputs.token }}'