From 1c53d2ddcc2a59dde137c928d9ac216d818365c3 Mon Sep 17 00:00:00 2001
From: Nadia Santalla <nadia@santalla.io>
Date: Fri, 15 Nov 2024 16:29:29 +0100
Subject: [PATCH] add self-validate workflow

---
 .github/workflows/renovate-validate.yaml | 27 ++++++++++++++++++++++++
 .github/workflows/renovate.yaml          | 24 +++++++++++++++++++++
 .github/workflows/self-renovate.yaml     | 11 ----------
 3 files changed, 51 insertions(+), 11 deletions(-)
 create mode 100644 .github/workflows/renovate-validate.yaml
 create mode 100644 .github/workflows/renovate.yaml
 delete mode 100644 .github/workflows/self-renovate.yaml

diff --git a/.github/workflows/renovate-validate.yaml b/.github/workflows/renovate-validate.yaml
new file mode 100644
index 0000000..b7d29fa
--- /dev/null
+++ b/.github/workflows/renovate-validate.yaml
@@ -0,0 +1,27 @@
+# This is _NOT_ a reusable workflow, but rather the renovate run for this repo itself.
+name: Validate renovate config
+on:
+  pull_request:
+    paths:
+      # When renovate config changes:
+      - "renovate.*"
+      - ".renovate.*"
+      - ".github/renovate.*"
+      # Also when renovate version changes:
+      - ".github/workflows/*"
+      # For this repo specifically, also when actions themselves change.
+      - ".github/actions/*"
+
+jobs:
+  renovate:
+    permissions:
+      # Needed for logging into vault.
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Validate renovate config
+        uses: ./actions/renovate-validate
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000..b578c39
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,24 @@
+# This is _NOT_ a reusable workflow, but rather the renovate run for this repo itself.
+name: Self-hosted Renovate
+
+on:
+  schedule:
+    - cron: "22 */4 * * *"
+  # Run this job on PRs to, in dry run mode, as a sort of self-check.
+  pull_request:
+
+jobs:
+  renovate:
+    permissions:
+      # Needed for logging into vault.
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Self-hosted renovate
+        uses: ./actions/renovate-validate
+        with:
+          dry-run: "${{ github.event_name == 'pull_request' }}"
diff --git a/.github/workflows/self-renovate.yaml b/.github/workflows/self-renovate.yaml
deleted file mode 100644
index f6574d0..0000000
--- a/.github/workflows/self-renovate.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# This is _NOT_ a reusable workflow, but rather the renovate run for this repo itself.
-name: Self-hosted Renovate
-
-on:
-  schedule:
-    - cron: "22 */4 * * *"
-  workflow_dispatch:
-
-jobs:
-  renovate:
-    uses: grafana/sm-renovate/.github/workflows/renovate.yaml@main