Update renovate config#2398
Conversation
WalkthroughSimplifies renovate.json configuration by removing granular package groupings and dependency-specific rules, replacing them with a single catch-all "all dependencies" rule. Enables automerge, dependencyDashboard, and pinDigests features while maintaining the existing branch prefix. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@renovate.json`:
- Around line 20-22: The current Renovate rule only disables major updates for
managers listed in "matchManagers" (npm, composer), so Docker Compose majors can
still automerge; update the rule in renovate.json to include the docker-compose
manager (add "docker-compose" to "matchManagers") or remove "matchManagers" so
"matchUpdateTypes": ["major"] applies repo-wide, and ensure "enabled": false
remains for that rule so major updates across all managers (including
docker-compose) are blocked from automerge.
- Line 3: The root-level "automerge" setting is currently true and applies to
all Renovate PRs; change the root "automerge" to false and add a packageRules
array that enables automerge only for low-risk updateTypes (e.g., "patch",
"digest", and optionally "minor") so large mixed or high-risk groups won't
auto-merge; update the renovate.json to add a packageRules entry targeting those
updateTypes and/or specific packagePatterns while leaving other updates
requiring manual review.
| ":prHourlyLimit2" | ||
| ], | ||
| "extends": ["config:recommended"], | ||
| "automerge": true, |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In Renovate, does root-level automerge: trueapply to grouped PRs created by a catch-allpackageRules group (matchPackageNames: ["*"])? What do Renovate docs recommend as a safe automerge strategy for grouped updates?
💡 Result:
Yes. In Renovate, a root-level "automerge": true becomes the default for all updates (including grouped PRs) unless a matching packageRules entry overrides it. Renovate evaluates all matching packageRules and merges their resulting config, with later rules able to override earlier ones—so a catch-all grouping rule like matchPackageNames: ["*"] + groupName: ... will still inherit root automerge: true if it doesn’t set automerge itself. [1] Grouping (groupName) just changes how updates are bundled into branches/PRs; it doesn’t disable automerge by itself. [2]
Docs’ safer automerge strategy for grouped updates: Renovate maintainers recommend enabling automerge only for updates you’d “merge anyway,” and commonly for lower-risk updates (e.g., lock file maintenance, dev tooling, and non-major updates when you have good tests). [3] Their examples show scoping automerge with packageRules (e.g., only patch/minor, and excluding pre-1.0.0 because SemVer allows breaking changes there), which is especially important if you’re grouping. [4] They also explicitly show automerging within a group by combining matchUpdateTypes: ["patch","minor"] with automerge: true. [5] If you want extra safety, the docs also note splitting patch vs minor (so you can automerge patch while reviewing minor) using separateMinorPatch: true. [6]
Sources
[1] https://docs.renovatebot.com/configuration-options/
[2] https://docs.renovatebot.com/configuration-options/#groupname
[3] https://docs.renovatebot.com/key-concepts/automerge/
[4] https://docs.renovatebot.com/key-concepts/automerge/#automerge-non-major-updates
[5] https://docs.renovatebot.com/key-concepts/automerge/#automerge-monorepo-prs
[6] https://docs.renovatebot.com/configuration-options/#separateminorpatch
Remove root-level automerge or scope it to safe update types.
Root-level "automerge": true (line 3) applies to all PRs, including the catch-all dependency group (lines 25–27). This creates high blast radius: a single large mixed-update PR can auto-merge on green CI, bypassing staged rollout safety.
Renovate docs recommend scoping automerge to lower-risk updates only (e.g., patch, minor, digest). Set root automerge to false and add a packageRule to automerge only specific update types:
Safer config
- "automerge": true,
+ "automerge": false,
{
"matchPackageNames": ["*"],
"groupName": "all dependencies",
"groupSlug": "all"
+ },
+ {
+ "matchUpdateTypes": ["patch", "minor", "digest", "pin"],
+ "automerge": true
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@renovate.json` at line 3, The root-level "automerge" setting is currently
true and applies to all Renovate PRs; change the root "automerge" to false and
add a packageRules array that enables automerge only for low-risk updateTypes
(e.g., "patch", "digest", and optionally "minor") so large mixed or high-risk
groups won't auto-merge; update the renovate.json to add a packageRules entry
targeting those updateTypes and/or specific packagePatterns while leaving other
updates requiring manual review.
| "matchManagers": ["npm", "composer"], | ||
| "matchUpdateTypes": ["major"], | ||
| "enabled": false |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Detecting common non-npm/composer manifests that Renovate may manage:"
fd -HI '(Dockerfile|docker-compose\.ya?ml|Chart\.yaml|values\.yaml|\.github/workflows/.*\.ya?ml|requirements\.txt|pyproject\.toml|Pipfile|go\.mod|pom\.xml|build\.gradle|Gemfile|Cargo\.toml)$' .
echo
echo "If files are listed above, consider whether major updates for those managers should also be disabled."Repository: drevops/vortex
Length of output: 2612
🏁 Script executed:
cat -n renovate.jsonRepository: drevops/vortex
Length of output: 1021
🏁 Script executed:
fd -HI '(renovate\.json|\.renovaterc|\.renovaterc\.json|\.renovaterc\.js|\.renovaterc\.cjs|renovate\.json5)$' .Repository: drevops/vortex
Length of output: 402
Major-update blocking is too narrow for repo-wide automerge.
This rule disables majors only for npm and composer (lines 20-22). Since the repo includes docker-compose.yml and Renovate is configured with "extends": ["config:recommended"], the docker-compose manager is active. Its major updates are not blocked and may auto-merge due to the global "automerge": true setting.
Suggested guardrail
{
- "matchManagers": ["npm", "composer"],
"matchUpdateTypes": ["major"],
"enabled": false
},🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@renovate.json` around lines 20 - 22, The current Renovate rule only disables
major updates for managers listed in "matchManagers" (npm, composer), so Docker
Compose majors can still automerge; update the rule in renovate.json to include
the docker-compose manager (add "docker-compose" to "matchManagers") or remove
"matchManagers" so "matchUpdateTypes": ["major"] applies repo-wide, and ensure
"enabled": false remains for that rule so major updates across all managers
(including docker-compose) are blocked from automerge.
|
Code coverage (threshold: 90%) Per-class coverage |
This comment has been minimized.
This comment has been minimized.
1 similar comment
|
Code coverage (threshold: 90%) Per-class coverage |
Codecov Report✅ All modified and coverable lines are covered by tests.
Additional details and impacted files@@ Coverage Diff @@
## main #2398 +/- ##
===========================================
- Coverage 79.37% 68.32% -11.06%
===========================================
Files 126 42 -84
Lines 6711 2510 -4201
Branches 44 0 -44
===========================================
- Hits 5327 1715 -3612
+ Misses 1384 795 -589 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
Updated renovate config via 🤠 RepoRanger.
Summary by CodeRabbit