renovate.yml

name: Update dependencies
on:
  workflow_dispatch:
    inputs:
      repoCache:
        description: "Reset or disable the cache?"
        type: choice
        default: enabled
        options:
          - enabled
          - disabled
          - reset
      logLevel:
        description: "Override default log level"
        type: choice
        default: info
        options:
          - "debug"
          - "info"
          - "warn"
          - "error"
      overrideSchedule:
        description: "Override all schedules"
        type: boolean
        default: false
      dryRun:
        description: "Dry run mode"
        type: choice
        default: disabled
        options:
          - disabled
          - extract
          - lookup
          - full
  schedule:
    # Run every 30 minutes
    - cron: "0/30 * * * *"

env:
  cache_archive: renovate_cache.tar.gz
  cache_dir: /tmp/renovate/cache/renovate/repository
  cache_key: renovate-cache
  dry_run: ${{ github.event.inputs.dryRun || 'disabled' }}

concurrency:
  cancel-in-progress: false
  group: renovate

permissions:
  contents: write
  id-token: write

jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - name: Authenticate Vault
        id: secrets
        uses: hashicorp/vault-action@a1b77a09293a4366e48a5067a86692ac6e94fdc0 # v3.1.0
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: jwt
          role: dev
          secrets: |
            automation/data/pipelines/hash/dev github_worker_app_id | GITHUB_WORKER_APP_ID ;
            automation/data/pipelines/hash/dev github_worker_app_private_key | GITHUB_WORKER_APP_PRIVATE_KEY ;

      - name: Get token
        id: app-token
        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
        with:
          app-id: ${{ steps.secrets.outputs.GITHUB_WORKER_APP_ID }}
          private-key: ${{ steps.secrets.outputs.GITHUB_WORKER_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Install Rust toolchain
        uses: ./.github/actions/install-rust-toolchain

      - name: Install Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
        with:
          node-version: 22

      - name: Enable corepack
        uses: ./.github/actions/enable-corepack

      - uses: dawidd6/action-download-artifact@80620a5d27ce0ae443b965134db88467fc607b43 # v7
        if: github.event.inputs.repoCache != 'disabled'
        continue-on-error: true
        with:
          name: ${{ env.cache_key }}
          path: cache-download

      - name: Extract renovate cache
        if: github.event.inputs.repoCache != 'disabled'
        run: |
          if [ ! -d cache-download ] ; then
            echo "No cache found."
            exit 0
          fi

          mkdir -p $cache_dir
          tar -xzf cache-download/$cache_archive -C $cache_dir

      - name: Install renovate
        run: npm install -g renovate

      - name: Run renovate
        env:
          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
          RENOVATE_FORCE: ${{ github.event.inputs.overrideSchedule == 'true' && '{"schedule":null}' || '' }}
          RENOVATE_DRY_RUN: ${{ env.dry_run == 'disabled' && 'null' || inputs.dryRun }}
          RENOVATE_PLATFORM_COMMIT: enabled
          RENOVATE_REPOSITORIES: ${{ github.repository }}
          # TODO: Consider using S3 by setting `RENOVATE_REPOSITORY_CACHE_TYPE`
          # see: https://linear.app/hash/issue/H-3315/use-s3-to-store-renovate-cache
          RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}
        run: renovate --token ${{ steps.app-token.outputs.token }}

      - name: Compress renovate cache
        run: tar -czvf $cache_archive -C $cache_dir .

      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
        if: env.dry_run == 'disabled' && github.event.inputs.repoCache != 'disabled'
        with:
          name: ${{ env.cache_key }}
          path: ${{ env.cache_archive }}
          retention-days: 1