From 52c0bcc33edb3c6f38a76faff1db8bd9ef1b975c Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Fri, 4 Sep 2026 22:56:05 -0400 Subject: [PATCH] Fix org-wide Renovate config: dashboard, deprecated matcher, credential placeholder Renovate's own Dependency Dashboard (wave-foundation issue #698) reports `Failed to look up npm package @wave-av/messaging: no-result` because npmrc pointed @wave-av at npm.pkg.github.com with no credential attached. This has meant zero @wave-av/* bumps in ~61 consumer repos. - dependencyDashboard: true set explicitly (was only implied via the :dependencyDashboard preset + config:recommended default) so every consumer surfaces its own Renovate failures instead of failing silently. - matchPackagePatterns (removed from current Renovate docs) migrated to matchPackageNames with glob syntax per https://docs.renovatebot.com/configuration-options/#packagerulesmatchpackagenames - hostRules added using the Mend-hosted-app-current `{{ secrets.NAME }}` reference (developer.mend.io Credentials UI), NOT the classic app.renovatebot.com/encrypt `encrypted` field, because Mend's own docs state cloud apps no longer read encrypted secrets from repo config files: https://docs.renovatebot.com/mend-hosted/credentials/ - npmrc registry URL aligned with hostRules matchHost (trailing slash) per Renovate's private-packages GitHub Packages example. Validated with renovate-config-validator --strict --no-global (both renovate@42.99.0 and current renovate@44.65.1): Config validated successfully. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01BdUbkR1zhogcTMWdbFRJKz --- renovate.json | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/renovate.json b/renovate.json index dcb3f81..1df8755 100644 --- a/renovate.json +++ b/renovate.json @@ -5,12 +5,20 @@ ":dependencyDashboard", "helpers:pinGitHubActionDigests" ], - "npmrc": "@wave-av:registry=https://npm.pkg.github.com", + "dependencyDashboard": true, + "npmrc": "@wave-av:registry=https://npm.pkg.github.com/", + "hostRules": [ + { + "hostType": "npm", + "matchHost": "https://npm.pkg.github.com/", + "token": "{{ secrets.WAVE_AV_NPM_PKG_GITHUB_TOKEN }}" + } + ], "packageRules": [ { "description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates — which then triggers each spoke's deploy-on-merge.", - "matchPackagePatterns": [ - "^@wave-av/" + "matchPackageNames": [ + "@wave-av/**" ], "rangeStrategy": "bump", "semanticCommitType": "chore",