renovate.yaml

# This is _NOT_ a reusable workflow, but rather the renovate run for this repo itself.
name: Self-hosted Renovate

on:
  schedule:
    - cron: "22 */4 * * *"
  # Run this job on PRs to, in dry run mode, as a sort of self-check.
  pull_request:


permissions:
  contents: none
  packages: none

jobs:
  renovate:
    permissions:
      # Needed for logging into vault.
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Self-hosted renovate
        uses: ./actions/renovate
        with:
          dry-run: "${{ github.event_name == 'pull_request' }}"
          use-current-branch: "${{ github.event_name == 'pull_request' }}"