chore: renovate opens PRs instead of committing to main - #63
Merged
Conversation
This config has never executed. No Renovate app is installed on the org, so every rule in here is a statement of intent that nothing has ever acted on — including the automerge rules, which is what makes turning it on a live risk rather than a routine switch. The patch+minor rule set automerge true with automergeType "branch". Branch mode does not open a pull request at all: Renovate pushes the update to a branch, waits for CI, and commits it to the base branch directly. On the first run that would land a batch of dependency updates on main unreviewed, and it contradicts how this org works — changes reach main through a pull request. automerge is now false and automergeType is "pr". The type is corrected rather than deleted so that re-enabling automerge later cannot silently reintroduce direct-to-main commits; whoever flips the boolean gets PR-based merging. The rest of the posture was already right and is unchanged: majors need review, and CVE-triggered updates are excluded from automerge twice over — once in vulnerabilityAlerts and once as the last packageRule, since per-package rules override top-level settings. Validated with renovate-config-validator: no migration needed, no errors.
The config rewrite expanded single-element arrays across multiple lines, which biome collapses back inline. Formatting only; no rule, schedule or automerge value changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why now
This config has never executed. No Renovate app is installed on the org, so every rule in here is a statement of intent that nothing has ever acted on — including the automerge rules. That is what makes turning Renovate on a live risk rather than a routine switch, and it is why this lands before the app does.
Five repos carry a
renovate.jsonwith automerge enabled: this one, the three sibling tenant repos, and eks-agent-platform (#204).What was armed
The patch+minor rule set
automerge: truewithautomergeType: "branch".Branch mode does not open a pull request at all. Renovate pushes the update to a branch, waits for CI, and commits it to the base branch directly. On the first run that would land a batch of dependency updates on
main, unreviewed — and it contradicts how this org works, where changes reach main through a pull request.What changed
automerge: trueautomerge: falseautomergeType: "branch"automergeType: "pr"The type is corrected rather than deleted, so re-enabling automerge later cannot silently reintroduce direct-to-main commits. Whoever flips the boolean gets PR-based merging.
The rest of the posture was already right and is untouched: majors need review, and CVE-triggered updates are excluded from automerge twice over — once in
vulnerabilityAlertsand once as the lastpackageRule, since per-package rules override top-level settings.Verified
renovate-config-validatorafter the change: config valid, no migration needed.Next step, which is yours
Installing the Renovate GitHub App is the remaining half. The acceptance test that actually closes the loop is the Dependency Dashboard issue appearing in each repo — not the config validating, which is what it has always done while doing nothing.
https://claude.ai/code/session_012iMnbboJuiUMSvu7n8oRhz