dependencies.yaml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

---
name: Dependencies

on:
  workflow_dispatch:
  schedule:
    - cron: "0 */6 * * *"

permissions:
  contents: read

jobs:
  renovate:
    name: Renovate Sync
    runs-on: ubuntu-latest
    steps:
      - name: Authenticate with GitHub App Bot
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.PROJECT_APP_ID }}
          private-key: ${{ secrets.PROJECT_APP_KEY }}

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: ${{ github.head_ref }}
          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
          persist-credentials: false

      - name: Self-hosted Renovate
        uses: renovatebot/github-action@e09d604f8f803bb527bd8321ed5be06c460b8682 # v46.2.2
        with:
          token: ${{ steps.app-token.outputs.token }}
        env:
          ## Discovery
          RENOVATE_AUTODISCOVER: "true"
          RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
          ## Project sync
          RENOVATE_PLATFORM: "github"
          RENOVATE_PLATFORM_COMMIT: "enabled"
          GITHUB_COM_TOKEN: ${{ steps.app-token.outputs.token }}
          # Remove unused fields from PR description
          RENOVATE_PR_BODY_TEMPLATE: "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}"
          RENOVATE_DEPENDENCY_DASHBOARD_HEADER: ""
          RENOVATE_DEPENDENCY_DASHBOARD_O_S_V_VULNERABILITY_SUMMARY: "all"