Move renovate build to separate workflow (#2712)

The workflow needs to run only on PRs opened by renovate and not on
other kinds of events.

.github/.cache/buster-for-generate

@@ -0,0 +1 @@
+prepill derangeable afflicting imamship inamorata fibrillae Abelite villar Odelet inamorata predisce

.github/workflows/ci.yml

@@ -33,8 +33,6 @@ jobs:
       min_k8s_version: ${{ steps.vars.outputs.min_k8s_version }}
       k8s_latest: ${{ steps.vars.outputs.k8s_latest }}
       helm_changes: ${{ steps.filter.outputs.charts }}
-    permissions:
-      contents: write
     steps:
       - name: Checkout Repository
         uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
@@ -57,24 +55,6 @@ jobs:
           filters: |
             charts:
             - charts/nginx-gateway-fabric/**/*
-            generate:
-            - go.mod
-            - go.sum
-            - Makefile
-
-      # go mod tidy can be removed once https://github.com/renovatebot/renovate/issues/12999 is implemented
-      - name: Update files for renovate
-        run: |
-          make generate-all
-          cd tests && go mod tidy && go mod verify
-        if: ${{ github.actor == 'renovate[bot]' && steps.filter.outputs.generate == 'true' }}
-
-      - name: Commit changes
-        id: commit
-        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
-        with:
-          commit_message: "Update files for renovate"
-        if: ${{ github.actor == 'renovate[bot]' && steps.filter.outputs.generate == 'true' }}
 
       - name: Output Variables
         id: vars

.github/workflows/renovate-build.yml

@@ -0,0 +1,75 @@
+name: Run build for renovate PRs
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+concurrency:
+  group: ${{ github.ref_name }}-renovate
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Check for changes
+    runs-on: ubuntu-24.04
+    outputs:
+      generate: ${{ steps.filter.outputs.generate }}
+    permissions:
+      pull-requests: read
+    if: ${{ github.actor == 'renovate[bot]' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+
+      - name: Check for changes
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            generate:
+            - go.mod
+            - go.sum
+            - Makefile
+  build:
+    name: Build for renovate PRs
+    runs-on: ubuntu-24.04
+    needs: check
+    permissions:
+      contents: write
+    if: ${{ needs.check.outputs.generate == 'true' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.NGINX_PAT }}
+
+      - name: Setup Golang Environment
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        with:
+          go-version: stable
+          cache-dependency-path: |
+            go.sum
+            .github/.cache/buster-for-generate
+
+      # go mod tidy can be removed once https://github.com/renovatebot/renovate/issues/12999 is implemented
+      - name: Update files for renovate
+        run: |
+          make generate-all
+          cd tests && go mod tidy && go mod verify
+
+      - name: Commit changes
+        id: commit
+        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
+        with:
+          commit_message: "Update files for renovate"
+          commit_user_name: "renovate[bot]"
+          commit_user_email: "<29139614+renovate[bot]@users.noreply.github.com>"
+          commit_author: "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>"