# Renovate, self-hosted (issue #225).
#
# On github.com Renovate arrived as the `jlab-renovate` GitHub App and this
# repo only ever carried renovate.json5. Gitea has no app model and no hosted
# Renovate, so after the move the bot has to be *run* by this repo: a scheduled
# job with its own token. That is the only change to how dependencies are
# updated - renovate.json5 stays the single source of what gets updated, and
# everything in it works unchanged on the Gitea platform.
#
# What the maintainer has to create once on the instance (the token this
# workflow cannot create for itself):
#
#   RENOVATE_TOKEN   Gitea access token of the bot account, scopes
#                    read:user, write:issue, write:repository. Renovate opens
#                    the PRs and the dependency dashboard issue with it, so
#                    the PRs will be authored by whoever owns the token.
#   GITHUB_COM_TOKEN Read-only github.com PAT (public_repo / no scopes at all
#                    is enough). NOT optional here: every `github-releases` and
#                    `github-tags` lookup in renovate.json5 - and the whole
#                    built-in github-actions manager, which resolves
#                    actions/checkout and friends on github.com - hits
#                    github.com's unauthenticated rate limit within one run
#                    otherwise. On the App this came for free; here it does not.
#                    README already names this for the `no-result` symptom.
#
# There is deliberately no `allowedCommands` to set up by hand any more: the
# postUpgradeTasks hook renovate.json5 needs (ci/renovate-bump-chart.sh, which
# recomputes `version:` after an appVersion change) is allow-listed by the
# RENOVATE_ALLOWED_COMMANDS env below, because this workflow *is* the instance
# config now. Without it Renovate skips the task silently and every chart PR
# stays red on the version-bump check - see README, "The version-bump hook".
name: Renovate

on:
  schedule:
    # 03:40 UTC, once a day. Renovate's own `timezone` in renovate.json5
    # (Europe/Berlin) governs the PR schedules; this cron is plain UTC.
    - cron: "40 3 * * *"
  workflow_dispatch:
    inputs:
      dryRun:
        description: "Dry run: 'full' looks up and renders everything but writes nothing"
        type: choice
        default: "full"
        options: ["full", "lookup", "extract", "disabled"]
      logLevel:
        description: "Renovate log level"
        type: choice
        default: "info"
        options: ["info", "debug"]

jobs:
  renovate:
    name: Renovate
    # The guard that keeps this workflow inert on github.com. The file reaches
    # GitHub as well (that is where the migration PR is merged), and a
    # scheduled run there would authenticate a *Gitea* token against a Gitea
    # endpoint from a runner that has neither - failing nightly for a reason
    # nobody is watching for. GITHUB_SERVER_URL is the one context value that
    # differs between the two platforms without naming our instance: Gitea
    # sets it to its own base URL. Delete this line once github.com is a
    # push mirror without Actions.
    if: github.server_url != 'https://github.com'
    # No Docker socket needed: the Gitea runner starts every job in a container
    # itself, and `container:` is the runner's job to create, not the job's.
    # Measured on the probe PR of #225 - the same distinction that puts
    # install-test on ubuntu-docker leaves this job on ubuntu-latest.
    runs-on: ubuntu-latest
    # The official image rather than `npx renovate`: it ships the git, node and
    # package-manager versions Renovate expects, and pulling ~200 MB from npm
    # on every scheduled run is the alternative. Renovate's built-in
    # github-actions manager keeps this tag current (proved by dry run, see the
    # migration PR) - it reads `container:` images, not only `uses:`.
    container: ghcr.io/renovatebot/renovate:44.87.1
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v7

      - name: "Run Renovate"
        env:
          # Platform. The endpoint is derived from the run itself so the
          # instance address stays out of this repository, the same rule the
          # publish workflow follows for the registry URL.
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}

          # Exactly this repository. Autodiscovery would enrol every repo the
          # token can see, and the token is an account token, not an app
          # installation scoped to one repo.
          RENOVATE_AUTODISCOVER: "false"
          RENOVATE_REPOSITORIES: ${{ github.repository }}

          # Who the commits are by. The e-mail must not be a real address of a
          # person - Gitea attributes a commit to the account whose verified
          # address matches, and these commits are the bot's.
          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.invalid>"

          # The instance-level half of renovate.json5's postUpgradeTasks. A
          # command not listed here is skipped WITHOUT an error message.
          RENOVATE_ALLOWED_COMMANDS: '["^ci/renovate-bump-chart\\.sh"]'

          # Manual runs default to a dry run; the schedule is the only thing
          # that writes on its own.
          RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dryRun || 'null' }}
          LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && inputs.logLevel || 'info' }}
        run: renovate