update.yml

name: update

on:
  workflow_dispatch:
  push:
    paths:
      - renovate.js
      - .github/workflows/update.yml
  schedule:
    - cron: "0 6 * * 1"
jobs:
  renovate:
    runs-on: ubuntu-18.04
    steps:
      - uses: actions/checkout@v3.3.0
        with:
          fetch-depth: 2
      # this is tibdex/github-app-token v1.3, pinned to the commit SHA for security
      # - uses: tibdex/github-app-token@36464acb844fc53b9b8b2401da68844f6b05ebb0
      #   id: generate-token
      #   with:
      #     app_id: ${{ secrets.AUTH_FOR_GITHUB_APP_ID }}
      #     private_key: ${{ secrets.AUTH_FOR_GITHUB_PRIVATE_KEY }}
      - uses: ./.github/actions/appauth
        id: generate-token
        with:
          app_id: ${{ secrets.AUTH_FOR_GITHUB_APP_ID }}
          private_key: ${{ secrets.AUTH_FOR_GITHUB_PRIVATE_KEY }}
      - name: renovate
        uses: docker://renovate/renovate:24.119.22@sha256:2948ec244387f4220c1b66ae2e94699895ca27f4a6c3ebd8682937ae172a83f7

        env:
          RENOVATE_REPOSITORIES: kindlyops/examples
          # # https://github.com/renovatebot/renovate/blob/a2b267137005458eca16a39482da458e2ee4e819/lib/util/http/auth.ts#L20
          RENOVATE_TOKEN: x-access-token:${{ steps.generate-token.outputs.token }}
          RENOVATE_USERNAME: kindlymachine[bot]
          RENOVATE_ONBOARDING: false
          RENOVATE_CONFIG_FILE: renovate.js
          RENOVATE_LOGLEVEL: debug
          RENOVATE_TRUSTLEVEL: high