-
Notifications
You must be signed in to change notification settings - Fork 1
ci: Replace Dependabot with Renovatebot #103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR replaces Dependabot with Renovatebot for automated dependency management. The change switches from GitHub's native Dependabot service to Renovate, which offers more advanced configuration options and dependency update strategies.
Key Changes
- Removes existing Dependabot configuration
- Adds comprehensive Renovate configuration with GitHub Actions support
- Implements automerge policies and scheduling controls
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
File | Description |
---|---|
.github/dependabot.yml |
Removes Dependabot configuration for GitHub Actions updates |
.github/renovate.json |
Adds Renovate configuration with GitHub Actions grouping, automerge rules, and scheduling |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
"github-actions": { | ||
"addLabels": [ | ||
"skip changelog" | ||
], | ||
"packageRules": [ | ||
{ | ||
"groupName": "GitHub Actions", | ||
"matchPackageNames": [ | ||
"actions/**", | ||
"github/**" | ||
] | ||
}, | ||
{ | ||
"enabled": false, | ||
"matchUpdateTypes": [ | ||
"digest" | ||
] | ||
}, | ||
{ | ||
"automerge": true, | ||
"matchUpdateTypes": [ | ||
"minor", | ||
"patch" | ||
], | ||
"matchCurrentVersion": "!/^0/" | ||
} | ||
] | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The 'github-actions' key is not a valid Renovate configuration option. This should be nested within 'packageRules' as a manager-specific rule or moved to the root level as separate configuration options.
"github-actions": { | |
"addLabels": [ | |
"skip changelog" | |
], | |
"packageRules": [ | |
{ | |
"groupName": "GitHub Actions", | |
"matchPackageNames": [ | |
"actions/**", | |
"github/**" | |
] | |
}, | |
{ | |
"enabled": false, | |
"matchUpdateTypes": [ | |
"digest" | |
] | |
}, | |
{ | |
"automerge": true, | |
"matchUpdateTypes": [ | |
"minor", | |
"patch" | |
], | |
"matchCurrentVersion": "!/^0/" | |
} | |
] | |
} | |
"packageRules": [ | |
{ | |
"groupName": "GitHub Actions", | |
"manager": "github-actions", | |
"matchPackageNames": [ | |
"actions/**", | |
"github/**" | |
], | |
"addLabels": [ | |
"skip changelog" | |
] | |
}, | |
{ | |
"enabled": false, | |
"manager": "github-actions", | |
"matchUpdateTypes": [ | |
"digest" | |
], | |
"addLabels": [ | |
"skip changelog" | |
] | |
}, | |
{ | |
"automerge": true, | |
"manager": "github-actions", | |
"matchUpdateTypes": [ | |
"minor", | |
"patch" | |
], | |
"matchCurrentVersion": "!/^0/", | |
"addLabels": [ | |
"skip changelog" | |
] | |
} | |
] |
Copilot uses AI. Check for mistakes.
"minor", | ||
"patch" | ||
], | ||
"matchCurrentVersion": "!/^0/" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The regex pattern '!/^0/' is invalid syntax for Renovate's matchCurrentVersion. It should use standard regex format without the negation prefix, such as '^[1-9]' to match versions not starting with 0.
"matchCurrentVersion": "!/^0/" | |
"matchCurrentVersion": "^[1-9]" |
Copilot uses AI. Check for mistakes.
e7b5ee0
to
709b18f
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM but did not run the script locally (commands are simple enough to not be warranted)
Proposed changes
This PR enables Renovatebot for managing dependency updates on this repo and only on this repo. When using this repo as a template, a script is run that removes the Renovatebot config and enables Dependabot. This is done to account for the fact that Dependabot works out of the box on GitHub, and Renovatebot requires some level of manual configuration to enable. By defaulting to Dependabot, we always ensure there will be some level of dependency management in place.
Checklist
Before creating a PR, run through this checklist and mark each as complete:
README.md
and/orCHANGELOG.md
).