ci: consolidate dependency automation on renovate - #242
Merged
Conversation
Three paths were racing to merge the same PRs: renovate opening them, a `dependabot-automerge.yml` workflow, and Mergify rules. Only renovate stays. Mergify's rules were already dead — all three asked for `merge: squash`, and the repo has disallowed squash merges since the merge-settings baseline landed. That is why renovate PRs have been sitting open (#224 since July) with nothing merging them. A bot's direct `merge` action also bypasses the merge queue rather than feeding it, which is now the wrong shape for this repo regardless. Dependabot keeps raising *alerts* — renovate reads them to open fix PRs — but no longer opens version-update PRs of its own, so the automerge workflow has nothing to act on. The renovate config carries a local automerge policy because the shared preset, `unional/renovate-preset`, is still the two-line `config:base` body and has no automerge, no rebase policy and no release soak. That belongs upstream; it is inlined here only so this repo's bot PRs actually merge in the meantime. Majors stay manual.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 8 of the
modernize-repopass: one updater, one merge mechanism, feeding the merge queue natively.What was actually happening
Three paths were configured to merge the same PRs — Renovate opening them,
dependabot-automerge.yml, and Mergify — and none of them worked.All three Mergify rules ask for
merge: squash. The repo has hadallow_squash_merge: falsesince the merge-settings baseline landed, so every rule was a no-op. That is why #224 has sat open since 22 July and #237 since this morning with nothing touching them. The failure was silent: Mergify is installed org-wide and looked active.dependabot-automerge.ymlguards ongithub.actor == 'dependabot[bot]', and Dependabot opens no version-update PRs here — Renovate does.Independently, a bot's direct
mergeaction bypasses a merge queue rather than feeding it, and this repo now has a queue (added in the settings phase, verified by #239 merging throughgh-readonly-queue/main/pr-239-…). So both mechanisms were the wrong shape regardless of whether they worked.Changes
.github/mergify.yml.github/workflows/dependabot-automerge.yml.github/renovate.jsonan automerge policy:platformAutomerge(which enqueues natively),rebaseWhen: behind-base-branch, a 1-dayminimumReleaseAgesoak mirroringminimumreleaseage=1440in.npmrc, and majors excluded — those break builds in ways CI catches but a human should choose to absorb.Dependabot keeps raising alerts; Renovate reads them to open fix PRs. Only Dependabot's version updates and its automerge workflow go.
One thing that belongs upstream
The policy above is inlined here because the shared preset,
unional/renovate-preset, is still a two-lineconfig:basebody — no automerge, no rebase policy, no release soak. The baseline says this policy lives in the preset, not per repo. I did not edit that repository because this pass is scoped topath-equal; once the preset carries the canonical body, this block should be deleted and the file returned to the bareextends.