renovate.yml

name: Renovate
on:
  schedule:
  - cron: '13 */8 * * *'
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Dry run'
        required: false
        default: 'false'

concurrency:
  group: renovate

jobs:

  renovate:
    runs-on: ubuntu-24.04
    permissions: write-all
    steps:

    - name: Self-hosted Renovate
      env:
        LOG_LEVEL: debug
        RENOVATE_TOKEN: ${{ secrets.BOT_RENOVATE }}
      run: |
        docker run --interactive --rm \
            --env LOG_LEVEL \
            --env RENOVATE_TOKEN \
            renovate/renovate:latest \
                --dry-run=${{ inputs.dry-run }} \
                "${GITHUB_REPOSITORY}"

  check-log:
    runs-on: ubuntu-24.04
    needs:
    - renovate
    if: always()
    env:
        GITHUB_TOKEN: ${{ secrets.BOT_RENOVATE }}
    steps:

    - name: Fetch log
      run: |
        echo "### Processing run id ${{ github.run_id }}"
        JOB_ID="$(
            curl --url https://api.github.com/repos/uniget-org/tools/actions/runs/${{ github.run_id }}/jobs \
                --silent \
                --location \
                --fail \
                --header "Authorization: Bearer ${{ secrets.BOT_RENOVATE }}" \
            | jq '.jobs[] | select(.name == "renovate") | .id'
        )"

        echo "### Fetching log for job id ${JOB_ID}"
        curl --url https://api.github.com/repos/uniget-org/tools/actions/jobs/${JOB_ID}/logs \
            --silent \
            --location \
            --fail \
            --header "Authorization: Bearer ${{ secrets.BOT_RENOVATE }}" \
        >job.log

    - name: Store logs
      uses: actions/upload-artifact@v4
      with:
        name: logs.zip
        path: "job.log"
    
    - name: Check log
      run: |
        if grep secondary job.log; then
            exit 1
        fi