name: Renovate

on:
  schedule:
    - cron: '0 2 * * 6'  # Saturday 2:00 UTC — aligns with "every weekend" in renovate-config.json
  workflow_dispatch:

jobs:
  renovate:
    runs-on: runners-privilegedescalation
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: privilegedescalation

      - name: Run Renovate
        uses: renovatebot/github-action@v41.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          configurationFile: renovate-config.json
        env:
          LOG_LEVEL: debug
          RENOVATE_AUTODISCOVER: "true"