.github/.github/workflows/check-renovate.yml

name: Check Renovate Config

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  pre-job:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: read

      - name: Check what should run
        id: check
        uses: immich-app/devtools/actions/pre-job@75493d49052d536863fc96100086782c5279b145 # pre-job-action-v2.1.1
        with:
          github-token: ${{ steps.token.outputs.token }}
          filters: |
            renovate:
              - 'renovate-config.json'
          force-filters: |
            - '.github/workflows/check-renovate.yml'

  check:
    name: Check Renovate Config
    needs: pre-job
    if: ${{ fromJSON(needs.pre-job.outputs.should_run).renovate == true }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: read

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
        with:
          github_token: ${{ steps.token.outputs.token }}

      - name: Check Renovate config
        run: mise run renovate:check

  success-check:
    name: Check Renovate Config Success
    needs: [check]
    runs-on: ubuntu-latest
    permissions: {}
    if: always()
    steps:
      - uses: immich-app/devtools/actions/success-check@81113db03f6d743efee81e0058c0b43f6cd6f36d # success-check-action-v0.0.6
        with:
          needs: ${{ toJSON(needs) }}