ci: let Renovate automerge every non-major update once CI is green - #7171
Merged
Conversation
Renovate automerge was gated on matchDepTypes, so lockfile-only and transitive updates (the majority of the open Renovate PRs) never got `automerge: true` and sat waiting for a human. Widen the rule to all non-major update types and keep the dep-type rules for labeling only. Also set rebaseWhen=conflicted: Renovate was re-pushing branches while CI ran, and the workflows' `cancel-in-progress` concurrency group cancelled rspec/docker each time, so required checks never reached a green conclusion. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Security review flagged the widened matchUpdateTypes list: `rollback` and `replacement` would automerge a version downgrade or a package identity swap, and `digest`/`lockFileMaintenance` sidestep minimumReleaseAge (digests have no release age, and lockFileMaintenance pulls transitive deps straight to latest). Narrow the blanket rule to minor/patch/pin/pinDigest/bump and restore the explicit automerge on the github-actions rule, so Actions digest pinning keeps the behavior it had before this branch and nothing else gains digest automerge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The Renovate rule changes don’t fully align with the PR’s stated scope (notably around additional updateTypes like lockfile-only maintenance), which risks the main problem remaining unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates the repository’s Renovate configuration to allow automatic merging of eligible non-major dependency updates once required CI checks complete, and reduces CI churn by limiting Renovate rebases.
Changes:
- Enabled explicit PR automerge behavior (
automergeType: "pr",automergeStrategy: "squash") and limited rebases to conflicts (rebaseWhen: "conflicted"). - Broadened the non-major automerge rule beyond just runtime dependency depTypes to apply across depTypes for several non-major update kinds.
- Adjusted packageRules so dev dependency updates are primarily differentiated via labeling (rather than separate automerge gating).
File summaries
| File | Description |
|---|---|
| renovate.json | Expands automerge rules and configures rebase/merge strategy to allow green Renovate PRs to merge automatically. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+31
to
33
| "description": "Minor/patch/pin, any depType: automerge after stability window once CI is green", | ||
| "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "bump"], | ||
| "automerge": true, |
Comment on lines
+37
to
40
| "description": "Dev deps get their own label", | ||
| "matchUpdateTypes": ["minor", "patch"], | ||
| "matchDepTypes": ["devDependencies", "development"], | ||
| "automerge": true, | ||
| "labels": ["renovate", "devDependencies", "automerge"] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Renovate PRs that are fully green sit open instead of merging — e.g. #7158 (tom-select 2.6.1 → 2.6.2), open since Sep 1, approved, lockfile-only.
Two causes, both fixable in
renovate.json:matchDepTypesgating.automerge: truewas only set fordependencies/requireanddevDependencies/development. Lockfile-only and transitive updates carry no matching depType, so they never inheritedautomergeand waited on a human — which is most of the open Renovate PRs.rebaseWhen: auto, Renovate re-pushes the branch while CI is running;rspec.yml/docker.ymluseconcurrency: cancel-in-progress: true, so those required checks get cancelled rather than finishing. On chore(deps): update dependency tom-select to v2.6.2 #7158 there are three pushes inside three minutes, each cancelling the previousrspecanddockerruns — required checks never reach a green conclusion, so auto-merge staysBLOCKED.What changed
minor,patch,pin,pinDigest,digest,lockFileMaintenance,bump,replacement,rollbackwithautomerge: true. Major stays dashboard-gated and never automerges.automergefrom the rule above, so behavior is unchanged for them.rebaseWhen: "conflicted"— only rebase when the branch actually conflicts, so a run that goes green stays green.automergeType: "pr"+automergeStrategy: "squash"— explicit, matches the repo's squash-only merge setting.minimumReleaseAge: "7 days"is unchanged, so nothing merges inside the stability window (vulnerability alerts still bypass it).Branch protection (already applied, outside this PR)
mainrequires code-owner review, and theautoapprovalapp is not inCODEOWNERS, so its approval ofrenovate[bot]never satisfied that requirement — #7158 only became approved because @compwron reviewed it by hand. GitHub Apps cannot be listed inCODEOWNERS, so the fix is a bypass allowance instead: the Renovate app (mend/renovate) has been added tobypass_pull_request_allowancesonmain, alongside the existing @compwron entry.required_approving_review_count: 1andrequire_code_owner_reviews: trueare unchanged for everyone else.Scope notes
Deliberately not automerged, so the blast radius stays where it was:
major— still dashboard-gated.rollback/replacement— a version downgrade or a package identity swap should get eyes on it.digestoutside github-actions, andlockFileMaintenance— these sidestepminimumReleaseAge(digests have no release age; lockFileMaintenance pulls transitive deps straight to latest). GitHub Actions digest automerge is kept because it already existed before this branch.Verification
renovate-config-validatorpasses on the new file.🤖 Generated with Claude Code