Renovate updates - #222
Merged
Merged
Conversation
Renovate reads renovate.json5 with the same precedence as renovate.json. JSON5 allows comments, which the following commits use to record why each setting is there. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
Every dependency in pyproject.toml is a ">=" floor. Any newer release
already satisfies it, so the default rangeStrategy ("auto", which resolves
to "replace" for pep621) looks the new version up and then correctly
decides there is nothing to replace. Result: Renovate has never opened a
single python dependency PR. PR cfengine#221 bumped cf-remote and cfbs by hand.
rangeStrategy "bump" raises the floor and updates uv.lock.
Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
lockFileMaintenance is off by default, so packages that only appear in uv.lock have not been updated since dependabot was removed. That config had package-ecosystem "uv", which is where the idna, urllib3 and requests bumps came from. uv.lock is what actually gets installed: both coverage.yml and pypi-publish.yml run "uv lock --check". Runs weekly rather than on every daily run, since it regenerates the whole lock file rather than bumping one package. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
Security fixes bypass the normal flow and get a "security" label so they are visible in the PR list without opening the dependency dashboard. osvVulnerabilityAlerts is enabled alongside GitHub's own alerts: this is a self-hosted run using a PAT, and OSV lookups do not depend on that token being able to read the repository's vulnerability alerts API. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
renovate.yml is on a daily cron, so the default prHourlyLimit of 2 acts as a daily limit of 2: a backlog of six grouped PRs would take three days to appear. Set it to 0 (unlimited) and let prConcurrentLimit cap the review queue instead. rebaseWhen "conflicted" replaces the default "auto", which rebases every open Renovate PR whenever main moves and restarts a make-check matrix run per PR. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
Renovate does not read maintenance branches out of git, they have to be listed. No effect today since main is the default branch, but it means a maintenance branch cut later gets dependency PRs by adding one line rather than by someone noticing it never got any. Trade-off: renaming the default branch now requires updating this list. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
Without grouping, rangeStrategy "bump" opens one PR per package: nine on the current tree. Three groups instead: cfengine-deps cf-remote, cfbs, tree-sitter-cfengine python-deps third-party runtime and build-system deps python-dev-deps the dev dependency-group CFEngine's own packages are split out because bumping them is a product decision, not a routine third-party bump. Their rule sits after the python-dependencies rule since packageRules are last-match-wins. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
Git history shows a steady stream of one-action-per-PR bumps: patch and digest updates into a single PR. Majors stay separate, so an actions/download-artifact v8 -> v9 style change still gets its own review. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
The python version is pinned in six places: .python-version, requires-python, the make-check matrix, two setup-python steps, and the classifiers. Renovate only reaches .python-version and the setup-python steps, so left ungrouped a 3.15 release opens three PRs that each leave the repo half-migrated. Signed-off-by: Roberto Giovanardi <roberto.giovanardi@northern.tech>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #222 +/- ##
=======================================
Coverage 52.33% 52.33%
=======================================
Files 32 32
Lines 4108 4108
=======================================
Hits 2150 2150
Misses 1958 1958 🚀 New features to boost your workflow:
|
Signed-off-by: Ole Herman Schumacher Elgesem <ole@northern.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Co-authored-with: Claude