From 43e5fdb34047f451dd3a591e7bf42248e97c7cf7 Mon Sep 17 00:00:00 2001 From: Linda Goldstein Date: Mon, 7 Sep 2026 22:25:53 -0700 Subject: [PATCH 1/2] ci: let Renovate automerge every non-major update once CI is green Renovate automerge was gated on matchDepTypes, so lockfile-only and transitive updates (the majority of the open Renovate PRs) never got `automerge: true` and sat waiting for a human. Widen the rule to all non-major update types and keep the dep-type rules for labeling only. Also set rebaseWhen=conflicted: Renovate was re-pushing branches while CI ran, and the workflows' `cancel-in-progress` concurrency group cancelled rspec/docker each time, so required checks never reached a green conclusion. Co-Authored-By: Claude Opus 5 --- renovate.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/renovate.json b/renovate.json index 8f3f84bbca..51f996f30f 100644 --- a/renovate.json +++ b/renovate.json @@ -10,6 +10,9 @@ "prConcurrentLimit": 3, "prHourlyLimit": 2, "platformAutomerge": true, + "automergeType": "pr", + "automergeStrategy": "squash", + "rebaseWhen": "conflicted", "minimumReleaseAge": "7 days", "labels": ["renovate", "dependencies"], "enabledManagers": ["bundler", "npm", "github-actions", "dockerfile", "docker-compose"], @@ -25,24 +28,21 @@ "labels": ["renovate", "dependencies", "major"] }, { - "description": "Minor/patch runtime deps: automerge after stability window", - "matchUpdateTypes": ["minor", "patch"], - "matchDepTypes": ["dependencies", "require"], + "description": "Everything below major: automerge after stability window once CI is green", + "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "digest", "lockFileMaintenance", "bump", "replacement", "rollback"], "automerge": true, "labels": ["renovate", "dependencies", "automerge"] }, { - "description": "Minor/patch dev deps: automerge after stability window", + "description": "Dev deps get their own label", "matchUpdateTypes": ["minor", "patch"], "matchDepTypes": ["devDependencies", "development"], - "automerge": true, "labels": ["renovate", "devDependencies", "automerge"] }, { - "description": "GitHub Actions: pin to digests and automerge minor/patch", + "description": "GitHub Actions get their own label", "matchManagers": ["github-actions"], "matchUpdateTypes": ["minor", "patch", "digest"], - "automerge": true, "labels": ["renovate", "github-actions", "automerge"] } ] From 8393778e363beb325c16783021b78c03f11fa324 Mon Sep 17 00:00:00 2001 From: Linda Goldstein Date: Mon, 7 Sep 2026 22:30:37 -0700 Subject: [PATCH 2/2] ci: keep rollback/replacement/digest out of blanket automerge Security review flagged the widened matchUpdateTypes list: `rollback` and `replacement` would automerge a version downgrade or a package identity swap, and `digest`/`lockFileMaintenance` sidestep minimumReleaseAge (digests have no release age, and lockFileMaintenance pulls transitive deps straight to latest). Narrow the blanket rule to minor/patch/pin/pinDigest/bump and restore the explicit automerge on the github-actions rule, so Actions digest pinning keeps the behavior it had before this branch and nothing else gains digest automerge. Co-Authored-By: Claude Opus 5 --- renovate.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/renovate.json b/renovate.json index 51f996f30f..51fb059f65 100644 --- a/renovate.json +++ b/renovate.json @@ -28,8 +28,8 @@ "labels": ["renovate", "dependencies", "major"] }, { - "description": "Everything below major: automerge after stability window once CI is green", - "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "digest", "lockFileMaintenance", "bump", "replacement", "rollback"], + "description": "Minor/patch/pin, any depType: automerge after stability window once CI is green", + "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "bump"], "automerge": true, "labels": ["renovate", "dependencies", "automerge"] }, @@ -40,9 +40,10 @@ "labels": ["renovate", "devDependencies", "automerge"] }, { - "description": "GitHub Actions get their own label", + "description": "GitHub Actions: pin to digests and automerge minor/patch", "matchManagers": ["github-actions"], "matchUpdateTypes": ["minor", "patch", "digest"], + "automerge": true, "labels": ["renovate", "github-actions", "automerge"] } ]