name: Renovate

on:
  schedule:
    - cron: '0 5 * * *' # daily 05:00 EST
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
        with:
          fetch-depth: 1
      - name: Choose Renovate Token
        run: |
          if [ -n "${{ secrets.CHARON_TOKEN }}" ]; then
            echo "Using CHARON_TOKEN" >&2
            echo "RENOVATE_TOKEN=${{ secrets.CHARON_TOKEN }}" >> $GITHUB_ENV
          else
            echo "Using CPMP_TOKEN fallback" >&2
            echo "RENOVATE_TOKEN=${{ secrets.CPMP_TOKEN }}" >> $GITHUB_ENV
          fi

      - name: Run Renovate
        uses: renovatebot/github-action@5712c6a41dea6cdf32c72d92a763bd417e6606aa # v44.0.5
        with:
          configurationFile: .github/renovate.json
          token: ${{ env.RENOVATE_TOKEN }}
        env:
          LOG_LEVEL: info