Switch dependency updates from Dependabot to Renovate - #492
Draft
chalin wants to merge 4 commits into
Draft
Conversation
Commits the renovate.json5 that supersedes Renovate's onboarding proposal (google#485), aligned with the docsy repo's config: 7-day minimumReleaseAge, npm + github-actions managers only, hugo-extended and theme-managed assets excluded (same carve-outs dependabot.yml held). Repo-level security alerts are unaffected: grouped security PRs never depended on dependabot.yml. Config validated with renovate-config-validator --strict (44.35.2).
- disable lockFileMaintenance (via config:best-practices): a weekly full lock re-resolve pulls in-range latests UNGATED by minimumReleaseAge - hugo-extended comment: enabled:false silences Renovate security bumps too; name the actual net (repo-level Dependabot security updates + fail-closed installs), not 'alerts' - age-exemptions comment: drop the claims about PR-time review that internalChecksFilter:strict invalidates
- vulnerabilityAlerts off: Dependabot security updates own vuln PRs; Renovate's are immediate, unscheduled, age-exempt duplicates - configMigration off: migration PRs may rewrite JSON5 to JSON and drop the comments this file keeps its policy in - schedule widens to all Monday: a narrow window can miss the hosted scheduler's daily visit on a not-yet-activated repo, never bootstrapping - lockFileMaintenance comment: correct rationale (lock churn + the ETARGET age-gate fallback; v44 gates the normal path with --before) - bootstrap/FA rule comment: names the Dependabot-security-PR behavior the retired unscoped ignore used to suppress - age-exemptions comment: pending-on-dashboard, not PR-time review
Colon/semicolon constructs replace the spaced-dash asides; drop the stale claim that security updates bypass the age gate (Renovate raises no security PRs here since vulnerabilityAlerts went off).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate.json5instead ofconfig:recommended, aligned with the docsy repo's config: 7-dayminimumReleaseAge, Monday-only schedule,npm+github-actionsmanagers only (gomod and docker pins stay manual, per CONTRIBUTING.md).vulnerabilityAlertsis off (immediate, age-exempt duplicates otherwise). Also off, with reasons in-file:lockFileMaintenanceandconfigMigration(both pulled in byconfig:best-practices).renovate.jsonwould shadow this file in config-search order), then merge; a committed config onboards the repo regardless of the closed onboarding PR.renovate-config-validator --strict(44.35.2) passes; site tests andcheck:linkspass. Post-merge: verify the Dependency Dashboard, and that an admin confirms repo-level Dependabot security updates are enabled (API check needs admin read).