name: renovate-ci

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  validate-renovate:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Validate Renovate Compose draft
        shell: bash
        run: |
          set -euo pipefail
          trap 'rm -f renovate/.env' EXIT
          printf '%s\n' \
            'RENOVATE_ENDPOINT=https://gitea.example/api/v1' \
            'RENOVATE_TOKEN=test-token' \
            'RENOVATE_REPOSITORIES=forust/homelab' \
            > renovate/.env
          docker compose -f renovate/renovate-compose.yaml config --quiet

      - name: Validate Kubernetes manifests
        shell: bash
        run: |
          set -euo pipefail
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            ghcr.io/yannh/kubeconform:latest \
            -strict \
            -ignore-missing-schemas \
            -summary \
            renovate/k8s/namespace.yaml \
            renovate/k8s/configmap.yaml \
            renovate/k8s/cronjob.yaml

      - name: Validate Renovate repository config
        shell: bash
        run: |
          set -euo pipefail
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            renovate/renovate:44.83.2 \
            renovate-config-validator renovate.json