refactor(renovate): consolidate packageRules and fix major-grace ordering#346
Conversation
…ring Four changes, one focused review: 1. Merge the two `matchUpdateTypes: ["major"]` rules into one. Same selector, two attributes (minimumReleaseAge + automerge) — no reason to split. 2. Fix the ordering so the 30-day major grace actually applies to trusted-org majors. Previously the trusted-orgs rule appeared AFTER the major rule, so per Renovate's last-match-wins attribute merge, trusted-org majors auto-merged at 1 day and the 30-day grace was silently bypassed. New order: trusted-orgs → major-default → own-orgs. 3. Extend the own-orgs auto-merge rule to cover dryvist/** alongside JacobPEvans/**. Both are owned-by-us and should keep immediate merging even for majors (the major-default rule above is overridden by this one per-attribute). 4. Deduplicate the trusted-orgs `matchPackageNames` list. Every org was listed twice — once as `actions/**` and once as `https://github.com/actions/**`. Renovate's matchPackageNames matches against the resolved `packageName`, which is `owner/repo` for both GitHub Actions (github-tags datasource) and Nix flake `github:` inputs. The URL form never matched anything in the org (verified via `gh search code 'depName=https://github.com/' org:JacobPEvans` = zero hits). ~54 dead entries removed. 5. Unify the two Python-manager rules to share an identical manager list (pep621, pip_requirements, pip_setup, poetry, pipenv). The minor/patch auto-merge rule previously covered only pep621 and pip_requirements — an unintentional gap relative to the major bump rule that covers all five. Line count: 244 → 188 (-56 lines, -23%).
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refactors the Renovate configuration to streamline package management rules and ensure consistent update behavior. By reordering rule precedence and unifying manager lists, the changes enforce a safer 30-day grace period for major updates while ensuring own-org dependencies and minor/patch updates remain auto-merged. The cleanup also removes significant dead configuration entries, improving maintainability. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Rules defined in JSON flow, / To keep our dependencies in tow. / Major bumps now wait their turn, / While minor patches quickly learn. Footnotes
|
1 participant
Summary
Five consolidations to
renovate-presets.json. Line count drops 244 → 188 (-56 lines, -23%). One behavior fix included.1. Merge the two major-update packageRules
Two rules with identical
matchUpdateTypes: ["major"]selectors collapsed into one with both attributes (minimumReleaseAge: 30 days,automerge: false).2. Fix the ordering — 30-day grace now actually applies to trusted-org majors
Previously the trusted-orgs rule appeared AFTER the major rule. Renovate's last-match-wins per-attribute merge meant trusted-org majors auto-merged at 1 day, silently bypassing the 30-day grace. New order:
gh-awdisableBehavior matrix after:
actions/checkoutv5 (trusted, major)actions/checkoutv4.2.0 (trusted, minor)JacobPEvans/somethingv2 (own, major)requestsv3 (external, major)vulnerabilityAlerts)3. Add
dryvist/**to the own-orgs auto-mergedryvist is your second org (11 public repos). Own deps should keep immediate merging for all update types including major.
4. Dedup the trusted-orgs
matchPackageNameslistEvery org was listed twice —
actions/**ANDhttps://github.com/actions/**. Renovate matchesmatchPackageNamesagainst the resolvedpackageName, which isowner/repofor both GitHub Actions (github-tags datasource) and Nix flakegithub:inputs.Verified the URL form was dead code:
```
$ gh search code 'depName=https://github.com/' org:JacobPEvans
(no results)
```
~54 dead entries removed.
5. Unify the two Python-manager rules' manager lists
The minor/patch auto-merge rule covered only
pep621, pip_requirements. The major bump rule covers all five Python managers (pep621, pip_requirements, pip_setup, poetry, pipenv). Made the lists match —pip_setup,poetry, andpipenvminor/patch updates now auto-merge twice-weekly too (was an unintentional gap).Test plan
jq . renovate-presets.jsonpasses)actions/**major Renovate PR observably waits ≥ 30 days from release before opening, does not auto-mergeJacobPEvans/**ordryvist/**update (any type) auto-merges immediatelyvulnerabilityAlertspoetry/pipenvminor/patch update post-merge auto-merges (previously gated on manual review)