name: Renovate Compose audit

on:
  schedule:
    - cron: "23 3 1,15 * *"
  workflow_dispatch:
    inputs:
      manual-trigger:
        description: 'Manually trigger the read-only Compose audit'
        default: ''

concurrency:
  group: renovate-compose-audit
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  renovate:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Restore Renovate cache
        id: renovate-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/renovate-cache
          key: renovate-docker-v1-${{ runner.os }}-v43-${{ hashFiles('.github/renovate-docker.json', '.github/renovate-global.js') }}-${{ github.run_id }}
          restore-keys: |
            renovate-docker-v1-${{ runner.os }}-v43-${{ hashFiles('.github/renovate-docker.json', '.github/renovate-global.js') }}-
            renovate-docker-v1-${{ runner.os }}-v43-
      - name: Prepare Renovate cache permissions
        run: |
          install -d -m 0777 /tmp/renovate-cache
          chmod -R a+rwX /tmp/renovate-cache
      - name: Check Docker Hub credentials
        env:
          RENOVATE_DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          RENOVATE_DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
        run: node .github/scripts/check_dockerhub_credentials.mjs
      - name: Run Renovate
        uses: renovatebot/github-action@22e0a16091fc706b04affe6ae53d5e3358ac4023 # v46.1.19
        with:
          configurationFile: .github/renovate-global.js
          docker-cmd-file: .github/scripts/renovate-entrypoint.sh
          docker-volumes: ${{ github.workspace }}/.github/renovate-docker.json:/github-action/renovate-docker.json:ro;/tmp:/tmp
          token: ${{ github.token }}
        env:
          RENOVATE_DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          RENOVATE_DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          RENOVATE_CACHE_DIR: /tmp/renovate-cache
          RENOVATE_CACHE_PRIVATE_PACKAGES: 'false'
          RENOVATE_DRY_RUN: lookup
          RENOVATE_REPOSITORIES: ${{ github.repository }}
          RENOVATE_REPOSITORY_CACHE: enabled
      - name: Report Renovate cache size
        id: cache-metrics
        if: always()
        run: |
          save_cache=false
          max_cache_bytes=536870912

          if [[ -d /tmp/renovate-cache ]]; then
            du -sh /tmp/renovate-cache
            cache_bytes=$(du -sb /tmp/renovate-cache | cut -f1)
            if (( cache_bytes <= max_cache_bytes )); then
              save_cache=true
            else
              echo "::warning::Renovate cache is ${cache_bytes} bytes; skip saving because it exceeds ${max_cache_bytes} bytes."
            fi
          else
            echo "Renovate cache directory was not created."
          fi

          echo "save=$save_cache" >> "$GITHUB_OUTPUT"
      - name: Save Renovate cache
        if: always() && steps.cache-metrics.outputs.save == 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/renovate-cache
          key: ${{ steps.renovate-cache.outputs.cache-primary-key }}