use renovate docker image

Author: joecorall

.github/workflows/renovate.yml

@@ -5,12 +5,12 @@ on:
     branches:
       - main
   workflow_dispatch:
-  # every morning
   schedule:
-    - cron: '15 6 * * *'
+    - cron: '15 10 * * *'
 
 env:
   LOG_LEVEL: debug
+  RENOVATE_PLATFORM: github
   RENOVATE_REPOSITORIES: islandora-devops/isle-buildkit
   RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["bash ci/update-sha.sh \"{{{depName}}}\" \"{{{currentVersion}}}\" \"{{{newVersion}}}\" \"{{{newDigest}}}\""]'
 jobs:
@@ -21,21 +21,28 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
       - name: run renovate
         env:
           BASE_BRANCH: ${{ github.event_name == 'schedule' && 'main' || github.ref_name }}
         run: |
           # fetch GitHub App token for this repo
           echo "${{ secrets.GH_APP_PRIV_KEY }}" | base64 -d > private-key.pem
           export RENOVATE_TOKEN=$(./ci/fetch-app-token.sh ${{ secrets.GH_APP_ID }} ${{ secrets.GH_APP_INSTALLATION_ID }} private-key.pem)
+          echo "::add-mask::$RENOVATE_TOKEN"
 
           # run renovate with our token
           # using branch set in workflow dispatch to allow testing PRs
           # see https://docs.renovatebot.com/configuration-options/#basebranches
           export RENOVATE_BASE_BRANCHES=$(jq -c -n --arg branch "$BASE_BRANCH" '[$branch]')
           echo "Running renovate against ${RENOVATE_BASE_BRANCHES}"
-          npx renovate --platform=github
+          docker run \
+            --env LOG_LEVEL \
+            --env RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS \
+            --env RENOVATE_BASE_BRANCHES \
+            --env RENOVATE_PLATFORM \
+            --env RENOVATE_REPOSITORIES \
+            --env RENOVATE_TOKEN \
+            --rm \
+            -v $(pwd):/usr/src/app \
+            renovate/renovate
+