name: Renovate

on:
  # Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
  # renovate.json5 deliberately has no internal schedule (avoids double-gating).
  schedule:
    - cron: '0 5 * * 1'
  # Manual run for an on-demand sweep from the Actions tab.
  workflow_dispatch:

# Never let two Renovate runs touch the repo at once.
concurrency:
  group: renovate
  cancel-in-progress: false

jobs:
  renovate:
    runs-on: docker
    steps:
      - name: Run Renovate
        # This action publishes only full semver tags (no moving major tag —
        # @v46 / @v40 etc. 404). Pin a real release; Renovate keeps it bumped.
        uses: renovatebot/github-action@v46.1.15
        env:
          # Self-hosted Gitea, not github.com.
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: https://gitea.jeanlucmakiola.de/api/v1
          # Bot-account token (Gitea secret). Needs repo read/write + PR scope.
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          # Scope to this repo only — no org-wide autodiscovery.
          RENOVATE_AUTODISCOVER: 'false'
          RENOVATE_REPOSITORIES: '["makiolaj/calendula"]'
          # Commits/PRs authored as the bot, not a real maintainer.
          RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
          LOG_LEVEL: info