name: Renovate
on:
  # The "*" (#42, asterisk) character has special semantics in YAML, so this
  # string has to be quoted.
  schedule:
    - cron: '0 * * * *'
  # Manual trigger is also possible
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  renovate:
    if: github.repository == 'argoproj/argo-helm'
    runs-on: ubuntu-latest
    steps:
      - name: Get token
        uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        id: get_token
        with:
          app-id: ${{ vars.RENOVATE_APP_ID }}
          private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Self-hosted Renovate
        uses: renovatebot/github-action@9ad1a8e771c002ece340d1ff028fae4503fe041b # v41.0.12
        with:
          configurationFile: .github/configs/renovate-config.js
          # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
          renovate-version: 39.153.2
          token: '${{ steps.get_token.outputs.token }}'
          mount-docker-socket: true
        env:
          LOG_LEVEL: 'debug'
          RENOVATE_REPOSITORIES: '${{ github.repository }}'