name: Renovate

on:
  # Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
  # renovate.json5 deliberately has no internal schedule (avoids double-gating).
  schedule:
    - cron: '0 5 * * 1'
  # Manual run for an on-demand sweep from the Actions tab.
  workflow_dispatch:

# Never let two Renovate runs touch the repo at once.
concurrency:
  group: renovate
  cancel-in-progress: false

jobs:
  renovate:
    runs-on: docker
    # Run the Renovate image *as* the job container and invoke the `renovate`
    # binary directly. The renovatebot/github-action wrapper is a thin Node
    # action that shells out to `docker run …` — it needs a Docker CLI + socket
    # inside the job, which the Gitea runner's plain node container has not, so
    # it died on "Unable to locate executable file: docker". Running the image
    # directly drops the docker-in-docker requirement entirely.
    # Full tag pinned; Renovate's github-actions manager keeps it bumped.
    container:
      image: ghcr.io/renovatebot/renovate:43.232.0
    steps:
      - name: Run Renovate
        run: renovate
        env:
          # Renovate targets Codeberg (canonical) while still RUNNING on the
          # Gitea runner. Moving the job to Codeberg would put a repo-write
          # token on the contributor-facing runner, which is exactly what the
          # .forgejo/ vs .gitea/ split exists to prevent — so the token stays
          # where the other secrets live and only the API calls cross over.
          #
          # Platform is `forgejo`, not `gitea`: Codeberg runs Forgejo, and the
          # pinned image ships a distinct forgejo platform module.
          RENOVATE_PLATFORM: forgejo
          RENOVATE_ENDPOINT: https://codeberg.org/api/v1
          # Codeberg bot-account token (Gitea secret). Needs repo read/write +
          # PR scope on jlmakiola/calendula.
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          # Scope to this repo only — no org-wide autodiscovery.
          RENOVATE_AUTODISCOVER: 'false'
          RENOVATE_REPOSITORIES: '["jlmakiola/calendula"]'
          # Commits/PRs authored as the bot, not a real maintainer. This address
          # must be a verified email on the Codeberg bot account, otherwise the
          # commits show up unattributed there.
          RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
          # Read-only github.com PAT (no scopes needed). Unaffected by the forge
          # move — nearly every dependency is *released* on GitHub, and without
          # this,
          # changelog/release-note lookups hit the 60/h anonymous rate limit
          # and PRs arrive with an empty "Release Notes" section.
          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
          LOG_LEVEL: info