continuwuity/.forgejo/workflows/renovate.yml

name: Maintenance / Renovate

enable-email-notifications: true

on:
  schedule:
    # Run at 5am UTC daily to avoid late-night dev
    - cron: '0 5 * * *'

  workflow_dispatch:
    inputs:
      dryRun:
        description: 'Dry run mode'
        required: false
        default: ''
        type: choice
        options:
          - ''
          - 'extract'
          - 'lookup'
          - 'full'
      logLevel:
        description: 'Log level'
        required: false
        default: 'info'
        type: choice
        options:
          - 'debug'
          - 'info'
          - 'warning'
          - 'critical'

  push:
    branches:
      - main
    paths:
      # Re-run when config changes
      - '.forgejo/workflows/renovate.yml'
      - 'renovate.json'

jobs:
  renovate:
    name: Renovate
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/renovatebot/renovate:41.146.4@sha256:bb70194b7405faf10a6f279b60caa10403a440ba37d158c5a4ef0ae7b67a0f92
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          show-progress: false

      - name: print node heap
        run: /usr/local/renovate/node -e 'console.log(`node heap limit = ${require("v8").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'

      - name: Restore renovate repo cache
        uses: actions/cache/restore@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
          key: renovate-repo-cache-${{ github.run_id }}
          restore-keys: |
            renovate-repo-cache-

      - name: Restore renovate package cache
        uses: actions/cache/restore@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
          key: renovate-package-cache-${{ github.run_id }}
          restore-keys: |
            renovate-package-cache-

      - name: Restore renovate OSV cache
        uses: actions/cache/restore@v4
        with:
          path: |
            /tmp/osv
          key: renovate-osv-cache-${{ github.run_id }}
          restore-keys: |
            renovate-osv-cache-

      - name: Self-hosted Renovate
        run: renovate
        env:
          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
          RENOVATE_DRY_RUN: ${{ inputs.dryRun || 'false' }}

          RENOVATE_PLATFORM: forgejo
          RENOVATE_ENDPOINT: ${{ github.server_url }}
          RENOVATE_AUTODISCOVER: 'false'
          RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'

          RENOVATE_GIT_TIMEOUT: 60000

          RENOVATE_REQUIRE_CONFIG: 'required'
          RENOVATE_ONBOARDING: 'false'
          RENOVATE_INHERIT_CONFIG: 'true'

          RENOVATE_GITHUB_TOKEN_WARN: 'false'
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          GITHUB_COM_TOKEN: ${{ secrets.GH_PUBLIC_RO || secrets.GH_TOKEN }}

          RENOVATE_REPOSITORY_CACHE: 'enabled'
          RENOVATE_X_SQLITE_PACKAGE_CACHE: 'true'
          OSV_OFFLINE_ROOT_DIR: /tmp/osv

      - name: Save renovate repo cache
        if: always()
        uses:
          actions/cache/save@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
          key: renovate-repo-cache-${{ github.run_id }}

      - name: Save renovate package cache
        if: always()
        uses: actions/cache/save@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
          key: renovate-package-cache-${{ github.run_id }}

      - name: Save renovate OSV cache
        if: always()
        uses: actions/cache/save@v4
        with:
          path: |
            /tmp/osv
          key: renovate-osv-cache-${{ github.run_id }}