chore(renovate): inline Renovate rules instead of extending an external preset#5
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📜 Recent review details🔇 Additional comments (5)
📝 WalkthroughWalkthroughThe PR inlines Renovate configuration previously inherited from ChangesRenovate Configuration Migration
🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
| Filename | Overview |
|---|---|
| renovate.json5 | Replaces the unresolvable private preset reference with inlined Renovate rules covering volume limits, scheduling, lockfile maintenance, OSV security alerts, and npm/GHA grouping. Logic is well-structured and commented; one minor: vulnerability-alert PRs inherit the global weekly schedule, so CVEs will only open on Monday mornings before 5am. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Renovate Run\nMonday before 5am] --> B{Update type?}
B -->|lockFileMaintenance| C[Group into\nlockfile-maintenance PR]
B -->|OSV vulnerability| D[vulnerabilityAlerts template\ngroupName: null\nunbatched CVE PR]
B -->|GHA update| E{GHA major?}
B -->|npm update| F{npm major?}
E -->|No: minor/patch/digest/pin| G[Group into\ngha-non-major PR\npinDigests + 3-day soak]
E -->|Yes: major| H[Isolated PR per action\npinDigests + 3-day soak]
F -->|No: minor/patch| I[Group into\nfrontend-non-major PR\n3-day soak]
F -->|Yes: major| J[Isolated PR per dep\n3-day soak]
G --> K{internalChecksFilter strict}
H --> K
I --> K
J --> K
C --> K
K -->|Pass| L[Open PR\nmax 4 concurrent\nmax 4/hour]
K -->|Fail| M[Suppress PR]
D --> L
Reviews (1): Last reviewed commit: "chore(renovate): inline conf-renovate ru..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| osvVulnerabilityAlerts: true, | ||
| vulnerabilityAlerts: { | ||
| enabled: true, | ||
| labels: ["security"], | ||
| // groupName:null is INTENTIONAL: security/CVE PRs must NEVER be batched | ||
| // with manager-grouping rules so individual review isn't delayed. | ||
| groupName: null, | ||
| }, |
There was a problem hiding this comment.
schedule: ["before 5am on monday"], so OSV-triggered CVE PRs will only be opened once a week. If a critical CVE drops on Tuesday, Renovate won't raise its PR until the following Monday morning. Adding schedule: ["at any time"] inside vulnerabilityAlerts bypasses the weekly window only for security fixes while leaving everything else on the Monday cadence.
| osvVulnerabilityAlerts: true, | |
| vulnerabilityAlerts: { | |
| enabled: true, | |
| labels: ["security"], | |
| // groupName:null is INTENTIONAL: security/CVE PRs must NEVER be batched | |
| // with manager-grouping rules so individual review isn't delayed. | |
| groupName: null, | |
| }, | |
| osvVulnerabilityAlerts: true, | |
| vulnerabilityAlerts: { | |
| enabled: true, | |
| labels: ["security"], | |
| // groupName:null is INTENTIONAL: security/CVE PRs must NEVER be batched | |
| // with manager-grouping rules so individual review isn't delayed. | |
| groupName: null, | |
| // Allow vulnerability PRs to open any day, bypassing the weekly schedule. | |
| schedule: ["at any time"], | |
| }, |
There was a problem hiding this comment.
Accepted — added schedule: ["at any time"] to vulnerabilityAlerts in 1562c50 so CVE PRs bypass the weekly Monday window. Thanks for the catch.
gofreight-jackyeh
force-pushed
the
fix/inline-renovate-rules
branch
from
8fa31a6 to
0be3309
Compare
gofreight-jackyeh
changed the title
…al preset Replaces the previous `extends` of an external preset with the actual rules inlined into this file. Renovate's GitHub App token on this repo cannot read that preset's source, so the prior `extends` resolved to nothing and Renovate silently fell back to its built-in defaults — losing SHA pinning, the 3-day release-age soak, OSV alerts, PR grouping, the weekly Monday schedule, and the PR volume caps. Inlined the subset that applies to this repo (frontend JS lib + GHA workflows): - Volume controls + Monday schedule + bundled lockfile maintenance - `internalChecksFilter: "strict"` - OSV vulnerability alerts (ungrouped, schedule overridden to `at any time` so CVE PRs are not held until Monday) - GitHub Actions: `pinDigests` + `minimumReleaseAge: "3 days"` - GHA grouping (minor/patch/digest/pin grouped; major isolated) - npm grouping (minor/patch grouped, major isolated; 3-day soak) Validated locally with `renovate-config-validator --strict --no-global`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
gofreight-jackyeh
force-pushed
the
fix/inline-renovate-rules
branch
from
0be3309 to
1562c50
Compare
3 participants
Reason
Renovate's GitHub App token on this repo cannot read the source of the external preset we were extending, so the previous
resolved to nothing — Renovate silently fell back to its built-in defaults and we lost every policy the preset was supposed to bring: SHA pinning, the 3-day release-age soak, OSV alerts, PR grouping, the weekly schedule, and the PR volume caps.
The fix is to inline the rules directly in this file.
Changes
Replaced the external
extendswith an inlined copy of the rules that actually apply to this repo (frontend JS lib + GHA workflows):prConcurrentLimit: 4,prHourlyLimit: 4, weekly Monday scheduleinternalChecksFilter: "strict"vulnerabilityAlertswithgroupName: nullso CVE PRs are never batched)pinDigests: true+minimumReleaseAge: "3 days"gha-non-major; major -> isolated PR per actionfrontend-non-major(3-day soak); major -> isolated PR per depDropped rules that have no matching files in this repo (backend Python deps, Docker, Terraform, datastore pinning) and the preset self-bump customManager (no preset pin remains).
Kept the existing
:preserveSemverRangesandlabels: ["dependencies"].Test Scope
npx --package renovate@43 -- renovate-config-validator --strict --no-global renovate.json5→Config validated successfully(matches thevalidate-renovate.ymlworkflow exactly).validate-renovate.ymlwill rerun on this PR.