[Updates] Renovate (Tracker Service) #67

	---
	# SPDX-FileCopyrightText: (C) 2026 Intel Corporation
	# SPDX-License-Identifier: Apache-2.0

	name: "[Updates] Renovate (Tracker Service)"
	on:
	schedule:
	# daily
	- cron: "0 2 * * *"

	# allow to manually trigger this workflow
	workflow_dispatch:
	inputs:
	dry-run:
	description: "Run Renovate in dry-run mode (no PR)"
	required: false
	default: false
	type: boolean

	permissions: {}

	jobs:
	renovate:
	permissions:
	contents: read
	runs-on: ubuntu-latest

	steps:
	- name: "Checkout code"
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false

	- name: "Get token"
	id: get-github-app-token
	uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
	with:
	app-id: ${{ secrets.RENOVATE_APP_ID }}
	private-key: ${{ secrets.RENOVATE_APP_PEM }}

	- name: "Self-hosted Renovate"
	uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
	with:
	configurationFile: .github/renovate.json5
	token: "${{ steps.get-github-app-token.outputs.token }}"
	env:
	LOG_LEVEL: ${{ github.event_name == 'workflow_dispatch' && 'debug' \|\| 'info' }}
	# Dry run if the event is workflow_dispatch AND the dry-run input is true
	RENOVATE_DRY_RUN: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.dry-run == 'true') && 'full' \|\| null }}
	RENOVATE_PLATFORM: github
	RENOVATE_REPOSITORIES: ${{ github.repository }}

Provide feedback