Skip to content

chore(renovate): give Renovate credentials for npm.pkg.github.com + move preset to default.json #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yakimoto merged 1 commit into from
Sep 8, 2026
Merged

chore(renovate): give Renovate credentials for npm.pkg.github.com + move preset to default.json #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions default.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"description": "WAVE org-wide Renovate preset. Every wave-av repo extends this via `local>wave-av/.github`. Named default.json (NOT renovate.json) because Renovate resolves a preset to default.json first and only falls back to renovate.json with a deprecation warning.",
"extends": [
"config:recommended",
":dependencyDashboard",
"helpers:pinGitHubActionDigests"
],
"npmrc": "@wave-av:registry=https://npm.pkg.github.com/",
"hostRules": [
{
"description": "Read credentials for GitHub Packages. Without this, every @wave-av/* lookup fails with `no-result` because npm.pkg.github.com requires auth even to READ. The token is NOT stored here: `{{ secrets.* }}` is resolved by the Mend-hosted app from an ORG-scoped secret set in the Credentials section of the wave-av org settings at developer.mend.io. Nothing secret is committed.",
"matchHost": "https://npm.pkg.github.com/",
"hostType": "npm",
"token": "{{ secrets.WAVE_PACKAGES_READ_TOKEN }}"
}
],
"packageRules": [
{
"description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates - which then triggers each spoke's deploy-on-merge.",
"matchPackageNames": [

@cubic-dev-ai cubic-dev-ai Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The @wave-av/** packageRule in default.json duplicates the pre-existing @wave-av rule in org-inherited-config.json (same package scope, both minimumReleaseAge: "0 days"). The org rule sets automerge: true for minor/patch under platformAutomerge: true, while the preset relies only on the chassis-automerge label for the reaper. Both now govern the same packages with different automerge semantics. Consolidate the @wave-av handling into one place (e.g. only the org-inherited config or only the preset) so the ~45 spokes that inherit both don't get competing/order-dependent behavior, and keep the minimumReleaseAge: "0 days" in a single rule.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At default.json, line 21:

<comment>The `@wave-av/**` packageRule in default.json duplicates the pre-existing @wave-av rule in org-inherited-config.json (same package scope, both `minimumReleaseAge: "0 days"`). The org rule sets `automerge: true` for minor/patch under `platformAutomerge: true`, while the preset relies only on the `chassis-automerge` label for the reaper. Both now govern the same packages with different automerge semantics. Consolidate the @wave-av handling into one place (e.g. only the org-inherited config or only the preset) so the ~45 spokes that inherit both don't get competing/order-dependent behavior, and keep the `minimumReleaseAge: "0 days"` in a single rule.</comment>

<file context>
@@ -0,0 +1,37 @@
+  "packageRules": [
+    {
+      "description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates - which then triggers each spoke's deploy-on-merge.",
+      "matchPackageNames": [
+        "@wave-av/**"
+      ],
</file context>

"@wave-av/**"
],
"rangeStrategy": "bump",
"semanticCommitType": "chore",
"commitMessageTopic": "spoke-chassis",
"labels": [
"chassis-automerge"
],
"minimumReleaseAge": "0 days"
}
],
"schedule": [
"after 1am and before 6am"
],
"timezone": "America/New_York"
}
26 changes: 2 additions & 24 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,6 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:recommended",
":dependencyDashboard",
"helpers:pinGitHubActionDigests"
],
"npmrc": "@wave-av:registry=https://npm.pkg.github.com",
"packageRules": [
{
"description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates — which then triggers each spoke's deploy-on-merge.",
"matchPackagePatterns": [
"^@wave-av/"
],
"rangeStrategy": "bump",
"semanticCommitType": "chore",
"commitMessageTopic": "spoke-chassis",
"labels": [
"chassis-automerge"
],
"minimumReleaseAge": "0 days"
}
],
"schedule": [
"after 1am and before 6am"
],
"timezone": "America/New_York"
"local>wave-av/.github"
]
}