ci: consolidate dependency automation on Renovate - #631
Merged
Conversation
Nineteen dependency PRs were open, the oldest from February 2025. The cause
was not neglect; the automation was structurally incapable of merging any of
them, for three independent reasons.
1. `.github/mergify.yml` extends `unional/.github`, whose rules all end in
`merge: { method: rebase }`. This repo has `allow_rebase_merge: false`
(merge commits only). Mergify asks for a merge method the repo refuses,
and the PR just sits `CLEAN` forever.
2. Even had rebase been allowed, the Renovate rule there gates on
`label=safe-update`. Nothing applies that label: this repo's Renovate
config extended `github>unional/renovate-preset`, which is two lines
(`config:base` + `:preserveSemverRanges`) and sets no labels at all.
3. `.github/workflows/automerge-dependabot.yml` runs
`gh pr merge --auto --rebase`, which fails for reason 1 as well.
So: one updater, one merge mechanism, both native.
- `.github/renovate.json` now carries the full config instead of extending a
two-line preset. `platformAutomerge: true` uses GitHub's own auto-merge,
which feeds the merge queue rather than bypassing it. Minor/patch/pin/digest
and all devDependency updates automerge; majors of anything a consumer
resolves stay manual under a `major-` branch prefix.
- `minimumReleaseAge: "3 days"` mirrors the 24h npm soak in `.npmrc` at the
PR level, so Renovate does not even open a PR for a package that just
landed. `vulnerabilityAlerts` drops that to 1 day and automerges.
- `ignorePaths` adds `old/**`. Renovate was filing PRs against
`old/checker`, which is not a pnpm workspace member, is not installed, and
is now `private`. PR #560 (`@types/jest` v30) was one of those.
- `ts-5.4` and `ts-5.5` are disabled. They are npm aliases pinning those
exact TypeScript minors so `test:type` proves the emitted declarations
still compile on the oldest supported compilers. Bumping them to 5.9
deletes the matrix. PRs #530 and #531 had been asking to do exactly that
since February 2025.
- Deleted `.github/mergify.yml` and the Dependabot automerge workflow.
Also aligns the size-limit packages. `@size-limit/esbuild-why` had been
automerged to `^12.0.0` while `size-limit` and `@size-limit/preset-small-lib`
stayed on `^11.1.5` — a plugin a major ahead of the host it plugs into. All
three now on `^13.0.3`.
No changeset: nothing here reaches the published artifact.
`pnpm verify` green: 7/7 turbo tasks.
|
This was referenced Sep 1, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #631 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 53 53
Lines 279 279
Branches 51 51
=========================================
Hits 279 279 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Sep 1, 2026
unional
added a commit
that referenced
this pull request
Sep 1, 2026
Consolidates four Renovate PRs that could not merge themselves. The automation fault behind that is fixed in #631; these are just the updates that were sitting behind it. | dep | from | to | supersedes | | --- | --- | --- | --- | | `packageManager` pnpm | 11.1.3 | 11.25.0 | #616 | | `@commitlint/cli` + `@commitlint/config-conventional` | `^20.0.0` | `^21.0.0` | #620 | | `turbo` | 2.9.14 | 2.10.12 | #633 | | `actions/checkout` in `codeql-analysis.yml` | v6 | v7 | #634 | ## The one major worth reading about **commitlint 21.0.0.** Its entire breaking change is `chore!: minimum node version v22` — engines bumped to `>=22` across all 39 of its packages, dropping Node 18 and 20. Everything after that in the 20 -> 21.2.2 range is a feature or a fix (`--default-config` flag, pure-ESM preset resolution, a `--from`/`--to` guard). CI runs `lts/*` and `lts/-1`, both comfortably above 22, and commitlint is a dev-only tool that never reaches a consumer. The other three are a pnpm minor, a turbo minor, and an action major that is a checkout bump. ## Hooks verified, not assumed A commitlint bump is exactly the kind of change that can silently stop enforcing anything, so it was checked rather than trusted: ``` $ echo "bad message" | pnpm exec commitlint -> exit 1 (type-empty) $ echo "fix: a good message" | pnpm exec commitlint -> exit 0 $ git ls-files -s .husky/commit-msg -> 100755 ``` The executable bit matters — committed `100644` means git skips the hook entirely and commitlint never runs. It is correct here. ## Verification - `pnpm verify` green: **7/7 turbo tasks** on pnpm 11.25.0 and turbo 2.10.12. - `pnpm install --frozen-lockfile` clean against the committed lockfile. **No changeset** — none of this reaches the published artifact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
19 dependency PRs were open, the oldest from February 2025. This is not a backlog anyone neglected — the automation was structurally incapable of merging any of them, for three independent reasons, none of which produces a visible failure anywhere.
Why nothing merged
.github/mergify.yml(extendsunional/.github)merge: { method: rebase }. This repo hasallow_rebase_merge: false— merge commits only. Mergify asks for a method the repo refuses and the PR sitsCLEANforever.label=safe-update. Nothing applies that label:.github/renovate.jsonextendedgithub>unional/renovate-preset, which is two lines (config:base+:preserveSemverRanges) and sets no labels..github/workflows/automerge-dependabot.ymlgh pr merge --auto --rebase— fails for reason 1 too.Reasons 1 and 2 are independent: fixing either alone still merges nothing.
One updater, one merge mechanism
Renovate, with GitHub-native auto-merge.
platformAutomerge: truearms GitHub's own auto-merge, which feeds the merge queue instead of bypassing it the way a bot's ownmergeaction does..github/renovate.jsonnow carries the config directly rather than extending the two-line preset:major-branch prefix.minimumReleaseAge: "3 days"mirrors the 24h npm soak in.npmrcat the PR level, so Renovate does not open a PR for a package that just landed.vulnerabilityAlertsdrops that to 1 day and automerges.ignorePathsaddsold/**. Renovate had been filing PRs againstold/checker, which is not a pnpm workspace member, is not installed, and is nowprivate. chore(deps): update dependency @types/jest to v30 #560 (@types/jestv30) was one of those.ts-5.4/ts-5.5disabled. They are npm aliases pinning those exact TypeScript minors sotest:typeproves the emitted declarations still compile on the oldest supported compilers. Bumping them to~5.9.0deletes the matrix. chore(deps): update dependency ts-5.4 to ~5.9.0 #530 and chore(deps): update dependency ts-5.5 to ~5.9.0 #531 had been asking to do precisely that since February 2025..github/mergify.ymland the Dependabot automerge workflow are deleted. Dependabot's version updates are retired in favour of Renovate — the two were filing the same bump twice (#624 and #625 are bothvitest4.1.0).Incidental fix
@size-limit/esbuild-whyhad been automerged to^12.0.0whilesize-limitand@size-limit/preset-small-libstayed on^11.1.5— a plugin a full major ahead of the host it plugs into. All three now on^13.0.3.Release impact
None. No changeset. Nothing here reaches the published artifact: CI config, lint-time tooling, and a devDependency.
pnpm verifygreen locally: 7/7 turbo tasks, includingsizeon size-limit 13.