Skip to content

Conversation

alessfg
Copy link
Member

@alessfg alessfg commented Aug 28, 2025

Proposed changes

This PR enables Renovatebot for managing dependency updates on this repo and only on this repo. When using this repo as a template, a script is run that removes the Renovatebot config and enables Dependabot. This is done to account for the fact that Dependabot works out of the box on GitHub, and Renovatebot requires some level of manual configuration to enable. By defaulting to Dependabot, we always ensure there will be some level of dependency management in place.

Checklist

Before creating a PR, run through this checklist and mark each as complete:

@Copilot Copilot AI review requested due to automatic review settings August 28, 2025 21:44
@alessfg alessfg self-assigned this Aug 28, 2025
@alessfg alessfg added the enhancement New feature or request label Aug 28, 2025
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR replaces Dependabot with Renovatebot for automated dependency management. The change switches from GitHub's native Dependabot service to Renovate, which offers more advanced configuration options and dependency update strategies.

Key Changes

  • Removes existing Dependabot configuration
  • Adds comprehensive Renovate configuration with GitHub Actions support
  • Implements automerge policies and scheduling controls

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
.github/dependabot.yml Removes Dependabot configuration for GitHub Actions updates
.github/renovate.json Adds Renovate configuration with GitHub Actions grouping, automerge rules, and scheduling

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment on lines +15 to +42
"github-actions": {
"addLabels": [
"skip changelog"
],
"packageRules": [
{
"groupName": "GitHub Actions",
"matchPackageNames": [
"actions/**",
"github/**"
]
},
{
"enabled": false,
"matchUpdateTypes": [
"digest"
]
},
{
"automerge": true,
"matchUpdateTypes": [
"minor",
"patch"
],
"matchCurrentVersion": "!/^0/"
}
]
}
Copy link
Preview

Copilot AI Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'github-actions' key is not a valid Renovate configuration option. This should be nested within 'packageRules' as a manager-specific rule or moved to the root level as separate configuration options.

Suggested change
"github-actions": {
"addLabels": [
"skip changelog"
],
"packageRules": [
{
"groupName": "GitHub Actions",
"matchPackageNames": [
"actions/**",
"github/**"
]
},
{
"enabled": false,
"matchUpdateTypes": [
"digest"
]
},
{
"automerge": true,
"matchUpdateTypes": [
"minor",
"patch"
],
"matchCurrentVersion": "!/^0/"
}
]
}
"packageRules": [
{
"groupName": "GitHub Actions",
"manager": "github-actions",
"matchPackageNames": [
"actions/**",
"github/**"
],
"addLabels": [
"skip changelog"
]
},
{
"enabled": false,
"manager": "github-actions",
"matchUpdateTypes": [
"digest"
],
"addLabels": [
"skip changelog"
]
},
{
"automerge": true,
"manager": "github-actions",
"matchUpdateTypes": [
"minor",
"patch"
],
"matchCurrentVersion": "!/^0/",
"addLabels": [
"skip changelog"
]
}
]

Copilot uses AI. Check for mistakes.

"minor",
"patch"
],
"matchCurrentVersion": "!/^0/"
Copy link
Preview

Copilot AI Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern '!/^0/' is invalid syntax for Renovate's matchCurrentVersion. It should use standard regex format without the negation prefix, such as '^[1-9]' to match versions not starting with 0.

Suggested change
"matchCurrentVersion": "!/^0/"
"matchCurrentVersion": "^[1-9]"

Copilot uses AI. Check for mistakes.

@alessfg alessfg force-pushed the replace-dependabot-renovatebot branch from e7b5ee0 to 709b18f Compare August 28, 2025 21:48
Copy link
Member

@TasoOneAsia TasoOneAsia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM but did not run the script locally (commands are simple enough to not be warranted)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants