name: renovate

# One Renovate run for every repo listed below. A repo without a
# renovate.json first gets a "Configure Renovate" PR (extending
# local>asxpi/renovate); nothing else happens there until it is merged.
#
# Secrets: RENOVATE_TOKEN (renovate-bot, which needs Write access to each
# repo) and GH_COM_TOKEN (read-only github.com token, for release notes).

on:
  schedule:
    - cron: "17 5 * * *"
  workflow_dispatch:

jobs:
  renovate:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/renovatebot/renovate:44.236.2
    steps:
      - name: Run Renovate
        env:
          RENOVATE_PLATFORM: forgejo
          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
          RENOVATE_REPOSITORIES: >-
            ["asxpi/iac", "asxpi/asxpio", "asxpi/datacenterbingo",
             "asxpi/storage", "asxpi/blog", "czsk/czsk",
             "porcuvermis/vhpbot", "asxpi/nixos"]
          RENOVATE_ONBOARDING: "true"
          RENOVATE_ONBOARDING_CONFIG: '{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["local>asxpi/renovate"]}'
          RENOVATE_REQUIRE_CONFIG: required
          LOG_LEVEL: info
        run: renovate