renovate.yaml

# Self-hosted Renovate runner. Runs on a schedule and on demand.
# Self-hosted is required because postUpgradeTasks (which writes CHANGELOG.md
# inline with the dep bump) is disabled on the Mend Renovate SaaS app.
#
# Required secrets:
#   RENOVATE_TOKEN  PAT or GitHub App token with repo write + workflows.
#                   Pushes by the default GITHUB_TOKEN don't re-trigger Actions,
#                   so a PAT/App token is needed to make CI re-run on
#                   Renovate's branch updates.

name: Renovate

on:
    schedule:
        - cron: "0 11 * * 1-5" # weekdays 11:00 UTC = 13:00 Copenhagen (CEST) / 12:00 (CET)
    workflow_dispatch:
        inputs:
            logLevel:
                description: Renovate log level
                type: choice
                default: info
                options: [debug, info, warn, error]
            dryRun:
                description: Dry-run (no PRs)
                type: choice
                default: "null"
                options: ["null", "full"]

permissions:
    contents: read

concurrency:
    group: renovate
    cancel-in-progress: false

jobs:
    renovate:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6

            # PHP/Composer are needed so Renovate can resolve composer.lock
            # updates inside its container.
            - uses: shivammathur/setup-php@v2
              with:
                  php-version: "8.3"
                  tools: composer:v2
                  coverage: none

            - name: Run Renovate
              uses: renovatebot/github-action@v43
              with:
                  configurationFile: renovate.json
                  token: ${{ secrets.RENOVATE_TOKEN }}
                  renovate-version: latest
              env:
                  LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
                  RENOVATE_DRY_RUN: ${{ inputs.dryRun || 'null' }}
                  RENOVATE_REPOSITORIES: ${{ github.repository }}
                  # Allow the changelog script to run from postUpgradeTasks.
                  RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^bash \\.github/scripts/renovate-changelog\\.sh"]'
                  RENOVATE_ALLOW_POST_UPGRADE_COMMAND_TEMPLATING: "true"