Switch dependency updates from Dependabot to Renovate - #492
Merged
chalin merged 15 commits intoAug 27, 2026
Conversation
Commits the renovate.json5 that supersedes Renovate's onboarding proposal (google#485), aligned with the docsy repo's config: 7-day minimumReleaseAge, npm + github-actions managers only, hugo-extended and theme-managed assets excluded (same carve-outs dependabot.yml held). Repo-level security alerts are unaffected: grouped security PRs never depended on dependabot.yml. Config validated with renovate-config-validator --strict (44.35.2).
- disable lockFileMaintenance (via config:best-practices): a weekly full lock re-resolve pulls in-range latests UNGATED by minimumReleaseAge - hugo-extended comment: enabled:false silences Renovate security bumps too; name the actual net (repo-level Dependabot security updates + fail-closed installs), not 'alerts' - age-exemptions comment: drop the claims about PR-time review that internalChecksFilter:strict invalidates
- vulnerabilityAlerts off: Dependabot security updates own vuln PRs; Renovate's are immediate, unscheduled, age-exempt duplicates - configMigration off: migration PRs may rewrite JSON5 to JSON and drop the comments this file keeps its policy in - schedule widens to all Monday: a narrow window can miss the hosted scheduler's daily visit on a not-yet-activated repo, never bootstrapping - lockFileMaintenance comment: correct rationale (lock churn + the ETARGET age-gate fallback; v44 gates the normal path with --before) - bootstrap/FA rule comment: names the Dependabot-security-PR behavior the retired unscoped ignore used to suppress - age-exemptions comment: pending-on-dashboard, not PR-time review
Colon/semicolon constructs replace the spaced-dash asides; drop the stale claim that security updates bypass the age gate (Renovate raises no security PRs here since vulnerabilityAlerts went off).
- comments keep only what Renovate config can't say: CONTRIBUTING's maintainer notes own the update flows (linked, not restated); drop the internalChecksFilter override (documented default) and the minimumReleaseAge comment (spoke only of hypothetical growth) - hugo-extended rule scoped to matchUpdateTypes major/minor/patch (the docsy#2747 shape): the manual policy covers version bumps, not the security lane
Owner call: an in-config, platform-independent advisory path (repo-level Dependabot security-update settings are admin-side and org-specific); the rare duplicate security PR is accepted. lockFileMaintenance comment now names the alert-driven pair as the transitive-fix path.
Full-day Sunday window (PRs batch for Monday review); drop the unverifiable hosted-scheduler theory and the misplaced bot catalog in the lockFileMaintenance tail.
'on sunday' rides the deprecated @breejs/later parser, slated for removal in a future major; with configMigration off, majors are manual, so don't commit a known migration.
Owner pass: config comments shrink to pointers and one-liners; CONTRIBUTING's new Dependency updates section owns the whys (cooldown preset exclusion + rename caution, lock maintenance, manager whitelist, package-rule carve-outs, the security-PR posture). Also: timezone America/Montreal, hugo-extended rule unscoped (matchUpdateTypes had no effect: security fixes arrive as version bumps and matched anyway), configMigration left at default (owner accepts catching a rewrite).
- gomod: {enabled: false} replaces the enabledManagers whitelist; the
docker managers turn on as a result (best-effort setup, accepted)
- each rule keeps a one-liner; CONTRIBUTING's Dependency updates section
owns the rationale (hugoautogen-regeneration mechanism moved there)
The Dockerfile manager took over base-image bumps when the manager whitelist became a gomod blocklist; DART_SASS_VERSION stays manual.
'done manually' contradicted CONTRIBUTING (re-resolves are avoided, not done by hand); the header pointer owns the rationale.
Adversarial round 3: name the blocklist consequence (all detected managers active, Docker included -- tag bumps and digest pins); restore the bootstrap/FA security-PR guidance lost in the comment trims; 'created on Sundays' over 'batched weekly'; drop a stale cSpell word.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate.jsonwould shadow the committedrenovate.json5); post-merge, verify the Dependency Dashboard.renovate-config-validator --strict, site tests, andcheck:linkspass.