From 1036ed11cd0309b4c8b6da4235d9ec28ba413502 Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Fri, 7 Aug 2026 17:04:55 -0700 Subject: [PATCH 1/2] chore: renovate opens PRs instead of committing to main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This config has never executed. No Renovate app is installed on the org, so every rule in here is a statement of intent that nothing has ever acted on — including the automerge rules, which is what makes turning it on a live risk rather than a routine switch. The patch+minor rule set automerge true with automergeType "branch". Branch mode does not open a pull request at all: Renovate pushes the update to a branch, waits for CI, and commits it to the base branch directly. On the first run that would land a batch of dependency updates on main unreviewed, and it contradicts how this org works — changes reach main through a pull request. automerge is now false and automergeType is "pr". The type is corrected rather than deleted so that re-enabling automerge later cannot silently reintroduce direct-to-main commits; whoever flips the boolean gets PR-based merging. The rest of the posture was already right and is unchanged: majors need review, and CVE-triggered updates are excluded from automerge twice over — once in vulnerabilityAlerts and once as the last packageRule, since per-package rules override top-level settings. Validated with renovate-config-validator: no migration needed, no errors. --- renovate.json | 137 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 99 insertions(+), 38 deletions(-) diff --git a/renovate.json b/renovate.json index 920dec5..786b8ae 100644 --- a/renovate.json +++ b/renovate.json @@ -5,103 +5,164 @@ ":semanticCommits", ":semanticCommitTypeAll(deps)", ":dependencyDashboard", - ":automergeMinor", "schedule:weekly", "group:allNonMajor" ], "timezone": "America/Los_Angeles", - "labels": ["deps"], + "labels": [ + "deps" + ], "prHourlyLimit": 4, "prConcurrentLimit": 8, "rebaseWhen": "behind-base-branch", "semanticCommitScope": "deps", "lockFileMaintenance": { "enabled": true, - "schedule": ["before 6am on monday"] + "schedule": [ + "before 6am on monday" + ] }, "packageRules": [ { - "description": "Auto-merge patch + minor when CI passes. The vulnerability-alert override at the end of this array re-disables automerge for CVE-triggered PRs (Renovate evaluates packageRules in order; later rules win).", - "matchUpdateTypes": ["patch", "minor"], - "automerge": true, - "automergeType": "branch" + "description": "Patch + minor open a PR and wait for a human. Renovate has never executed in this org, so nothing here has been observed doing what it claims; automerge stays off until a few cycles of real PRs have been reviewed. automergeType is 'pr' rather than 'branch' for when it is re-enabled: 'branch' commits straight to the base branch without ever opening a PR, which this org does not do.", + "matchUpdateTypes": [ + "patch", + "minor" + ], + "automerge": false, + "automergeType": "pr" }, { "description": "Major upgrades always need review", - "matchUpdateTypes": ["major"], + "matchUpdateTypes": [ + "major" + ], "automerge": false, - "labels": ["deps", "major"] + "labels": [ + "deps", + "major" + ] }, { "description": "Group @aws-sdk/* (npm) — they release together", - "matchManagers": ["npm"], - "matchPackagePatterns": ["^@aws-sdk/", "^@smithy/"], - "groupName": "aws-sdk-js" + "matchManagers": [ + "npm" + ], + "groupName": "aws-sdk-js", + "matchPackageNames": [ + "/^@aws-sdk//", + "/^@smithy//" + ] }, { "description": "Group @opentelemetry/* — the SDK + exporters + instrumentations move together", - "matchManagers": ["npm"], - "matchPackagePatterns": ["^@opentelemetry/"], - "groupName": "opentelemetry" + "matchManagers": [ + "npm" + ], + "groupName": "opentelemetry", + "matchPackageNames": [ + "/^@opentelemetry//" + ] }, { "description": "Group the Postgres client + its types", - "matchManagers": ["npm"], - "matchPackageNames": ["pg", "@types/pg"], + "matchManagers": [ + "npm" + ], + "matchPackageNames": [ + "pg", + "@types/pg" + ], "groupName": "pg" }, { "description": "Group typescript-eslint plugins", - "matchManagers": ["npm"], - "matchPackagePatterns": [ - "^@typescript-eslint/", - "^typescript-eslint$", - "^@eslint/", - "^eslint-plugin-" + "matchManagers": [ + "npm" ], - "groupName": "eslint-stack" + "groupName": "eslint-stack", + "matchPackageNames": [ + "/^@typescript-eslint//", + "/^typescript-eslint$/", + "/^@eslint//", + "/^eslint-plugin-/" + ] }, { "description": "Group vitest core + coverage", - "matchManagers": ["npm"], - "matchPackagePatterns": ["^vitest$", "^@vitest/"], - "groupName": "vitest" + "matchManagers": [ + "npm" + ], + "groupName": "vitest", + "matchPackageNames": [ + "/^vitest$/", + "/^@vitest//" + ] }, { "description": "GitHub Actions — group minor + patch into one PR", - "matchManagers": ["github-actions"], + "matchManagers": [ + "github-actions" + ], "groupName": "github-actions", - "schedule": ["before 6am on monday"] + "schedule": [ + "before 6am on monday" + ] }, { "description": "Pin GitHub Actions to commit SHAs (supply-chain hardening)", - "matchManagers": ["github-actions"], + "matchManagers": [ + "github-actions" + ], "pinDigests": true }, { "description": "Helm chart versions in gitops/applicationset-entry.yaml", - "matchManagers": ["argocd", "helm-values", "helmv3"], + "matchManagers": [ + "argocd", + "helm-values", + "helmv3" + ], "groupName": "helm-charts", - "schedule": ["before 6am on monday"] + "schedule": [ + "before 6am on monday" + ] }, { "description": "Docker base image (Dockerfile)", - "matchManagers": ["dockerfile"], + "matchManagers": [ + "dockerfile" + ], "groupName": "docker-base", - "schedule": ["before 6am on monday"] + "schedule": [ + "before 6am on monday" + ] }, { "description": "Security/CVE updates: ALWAYS human review. This rule is intentionally LAST in packageRules — Renovate evaluates rules in order with later rules winning, so without this entry the earlier 'auto-merge patch + minor' rule would silently auto-merge CVE-triggered patches. The vulnerabilityAlerts top-level block ALSO sets automerge: false, but per-package rules override top-level settings — hence the explicit packageRule here.", - "matchUpdateTypes": ["patch", "minor", "major"], + "matchUpdateTypes": [ + "patch", + "minor", + "major" + ], "isVulnerabilityAlert": true, "automerge": false, - "labels": ["security", "deps", "needs-review"] + "labels": [ + "security", + "deps", + "needs-review" + ] } ], "vulnerabilityAlerts": { - "labels": ["security", "deps"], + "labels": [ + "security", + "deps" + ], "automerge": false, - "schedule": ["at any time"] + "schedule": [ + "at any time" + ] }, "osvVulnerabilityAlerts": true } From bb4aa9ffa3a138fe8944b73772a8e7662219a66e Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Fri, 7 Aug 2026 17:11:51 -0700 Subject: [PATCH 2/2] style: format renovate.json with biome The config rewrite expanded single-element arrays across multiple lines, which biome collapses back inline. Formatting only; no rule, schedule or automerge value changes. --- renovate.json | 112 +++++++++++--------------------------------------- 1 file changed, 25 insertions(+), 87 deletions(-) diff --git a/renovate.json b/renovate.json index 786b8ae..eece165 100644 --- a/renovate.json +++ b/renovate.json @@ -9,77 +9,49 @@ "group:allNonMajor" ], "timezone": "America/Los_Angeles", - "labels": [ - "deps" - ], + "labels": ["deps"], "prHourlyLimit": 4, "prConcurrentLimit": 8, "rebaseWhen": "behind-base-branch", "semanticCommitScope": "deps", "lockFileMaintenance": { "enabled": true, - "schedule": [ - "before 6am on monday" - ] + "schedule": ["before 6am on monday"] }, "packageRules": [ { "description": "Patch + minor open a PR and wait for a human. Renovate has never executed in this org, so nothing here has been observed doing what it claims; automerge stays off until a few cycles of real PRs have been reviewed. automergeType is 'pr' rather than 'branch' for when it is re-enabled: 'branch' commits straight to the base branch without ever opening a PR, which this org does not do.", - "matchUpdateTypes": [ - "patch", - "minor" - ], + "matchUpdateTypes": ["patch", "minor"], "automerge": false, "automergeType": "pr" }, { "description": "Major upgrades always need review", - "matchUpdateTypes": [ - "major" - ], + "matchUpdateTypes": ["major"], "automerge": false, - "labels": [ - "deps", - "major" - ] + "labels": ["deps", "major"] }, { "description": "Group @aws-sdk/* (npm) — they release together", - "matchManagers": [ - "npm" - ], + "matchManagers": ["npm"], "groupName": "aws-sdk-js", - "matchPackageNames": [ - "/^@aws-sdk//", - "/^@smithy//" - ] + "matchPackageNames": ["/^@aws-sdk//", "/^@smithy//"] }, { "description": "Group @opentelemetry/* — the SDK + exporters + instrumentations move together", - "matchManagers": [ - "npm" - ], + "matchManagers": ["npm"], "groupName": "opentelemetry", - "matchPackageNames": [ - "/^@opentelemetry//" - ] + "matchPackageNames": ["/^@opentelemetry//"] }, { "description": "Group the Postgres client + its types", - "matchManagers": [ - "npm" - ], - "matchPackageNames": [ - "pg", - "@types/pg" - ], + "matchManagers": ["npm"], + "matchPackageNames": ["pg", "@types/pg"], "groupName": "pg" }, { "description": "Group typescript-eslint plugins", - "matchManagers": [ - "npm" - ], + "matchManagers": ["npm"], "groupName": "eslint-stack", "matchPackageNames": [ "/^@typescript-eslint//", @@ -90,79 +62,45 @@ }, { "description": "Group vitest core + coverage", - "matchManagers": [ - "npm" - ], + "matchManagers": ["npm"], "groupName": "vitest", - "matchPackageNames": [ - "/^vitest$/", - "/^@vitest//" - ] + "matchPackageNames": ["/^vitest$/", "/^@vitest//"] }, { "description": "GitHub Actions — group minor + patch into one PR", - "matchManagers": [ - "github-actions" - ], + "matchManagers": ["github-actions"], "groupName": "github-actions", - "schedule": [ - "before 6am on monday" - ] + "schedule": ["before 6am on monday"] }, { "description": "Pin GitHub Actions to commit SHAs (supply-chain hardening)", - "matchManagers": [ - "github-actions" - ], + "matchManagers": ["github-actions"], "pinDigests": true }, { "description": "Helm chart versions in gitops/applicationset-entry.yaml", - "matchManagers": [ - "argocd", - "helm-values", - "helmv3" - ], + "matchManagers": ["argocd", "helm-values", "helmv3"], "groupName": "helm-charts", - "schedule": [ - "before 6am on monday" - ] + "schedule": ["before 6am on monday"] }, { "description": "Docker base image (Dockerfile)", - "matchManagers": [ - "dockerfile" - ], + "matchManagers": ["dockerfile"], "groupName": "docker-base", - "schedule": [ - "before 6am on monday" - ] + "schedule": ["before 6am on monday"] }, { "description": "Security/CVE updates: ALWAYS human review. This rule is intentionally LAST in packageRules — Renovate evaluates rules in order with later rules winning, so without this entry the earlier 'auto-merge patch + minor' rule would silently auto-merge CVE-triggered patches. The vulnerabilityAlerts top-level block ALSO sets automerge: false, but per-package rules override top-level settings — hence the explicit packageRule here.", - "matchUpdateTypes": [ - "patch", - "minor", - "major" - ], + "matchUpdateTypes": ["patch", "minor", "major"], "isVulnerabilityAlert": true, "automerge": false, - "labels": [ - "security", - "deps", - "needs-review" - ] + "labels": ["security", "deps", "needs-review"] } ], "vulnerabilityAlerts": { - "labels": [ - "security", - "deps" - ], + "labels": ["security", "deps"], "automerge": false, - "schedule": [ - "at any time" - ] + "schedule": ["at any time"] }, "osvVulnerabilityAlerts": true }