dependencies.yaml

name: Dependencies

on:
  workflow_dispatch:
  schedule:
    - cron: "0 */6 * * *"

jobs:
  renovate:
    name: Renovate Sync
    runs-on: ubuntu-latest
    steps:
      - name: Authenticate with GitHub App Bot
        id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          app-id: ${{ secrets.PROJECT_APP_ID }}
          private-key: ${{ secrets.PROJECT_APP_KEY }}

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: ${{ github.head_ref }}
          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
          persist-credentials: false

      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 #v2.0.0

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24.x"

      - name: Setup Python (uv)
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
        with:
          version: "0.11.15"
          enable-cache: true

      - name: Run Renovate
        run: task deps:renovate:sync
        env:
          ## Discovery
          RENOVATE_AUTODISCOVER: "true"
          RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
          ## Project sync
          RENOVATE_PLATFORM: "github"
          RENOVATE_PLATFORM_COMMIT: "enabled"
          RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_COM_TOKEN: ${{ steps.app-token.outputs.token }}
          # Remove unused fields from PR description
          RENOVATE_PR_BODY_TEMPLATE: "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}"
          RENOVATE_DEPENDENCY_DASHBOARD_HEADER: ""
          RENOVATE_DEPENDENCY_DASHBOARD_O_S_V_VULNERABILITY_SUMMARY: "all"