Renovate config: grouped PRs, 7-day quarantine, lockfile-only (#44) #60

Merged

james merged 1 commit from 44-renovate into main 2026-06-15 12:38:53 +00:00

Conversation 0 Commits 1 Files changed 5 +436

james commented 2026-06-15 12:23:22 +00:00

Owner

Copy link

Closes #44.

What lands

• renovate.json — behavioural configuration for Renovate against this repo.
• docs/ci.md — new home for repo-level CI policy that isn't obvious from the workflow files. Starts with the Renovate section; hooks for the policy bits added by #46 (--ignore-scripts) will land in the same file.
• docs/adr/0008-renovate-supply-chain-hardening.md — rationale.
• CLAUDE.md — pointer to docs/ci.md in the Working in this repo section.

No .forgejo/workflows/renovate.yml is checked in — Renovate is triggered by an instance-wide workflow that lives outside this repo, so this repo only ships behaviour.

The four load-bearing settings

1. minimumReleaseAge: "7 days" — quarantine. Vulnerability alerts bypass.
2. rangeStrategy: "update-lockfile" — lockfile-only by default. Major bumps that need a range change get their own opt-in PR with rangeStrategy: "bump", separate group, never auto-merged.
3. Five packageRules groups: npm production deps, npm dev deps, npm major bumps, forgejo actions, dockerfile base images. Only the first two carry automerge: true.
4. lockFileMaintenance weekly to catch transitive bumps with no direct-dep trigger.

The github-actions manager is extended via managerFilePatterns to also parse .forgejo/workflows/ — without that, Renovate would silently ignore every action in this repo.

Acceptance criteria

• renovate.json checked in. Renovate runs on a schedule via the instance-wide workflow (out of repo) and opens grouped PRs per the rules here.
• Operational verification: hold back a dev dep released within the quarantine window and confirm Renovate defers the PR. Cannot be tested inline in this PR — verified post-merge on the next runner cycle.
• A PR that changes a package.json range cannot auto-merge. Structural, not procedural: only the lockfile-only update types (patch, minor, digest, pin, pinDigest) inside the two non-major npm groups carry automerge: true. The npm major bumps group sets rangeStrategy: "bump" and automerge: false.
• Policy documented in docs/ci.md; rationale in ADR-0008.

Composes with

• #45 (now merged) — Renovate's forgejo actions group keeps the SHA pins fresh; humans review.
• #16 — once the Dockerfile base image is digest-pinned, Renovate's dockerfile base images group bumps the digest under the same human-review rule.
• #14 / ADR-0005 — scanners catch disclosed CVEs in deps we already have; this work catches hijacked releases of deps we already trust. Complementary, not overlapping.

Test plan

• After merge, confirm the instance-wide Renovate runner picks up renovate.json on its next cycle (look for the Dependency Dashboard issue to appear).
• Confirm the next Renovate PR (whichever group fires first) opens against this repo with the expected group name and labels.
• If a forgejo actions PR opens before #16 lands, confirm it does not auto-merge.

Closes #44. ## What lands - `renovate.json` — behavioural configuration for Renovate against this repo. - `docs/ci.md` — new home for repo-level CI policy that isn't obvious from the workflow files. Starts with the Renovate section; hooks for the policy bits added by #46 (`--ignore-scripts`) will land in the same file. - `docs/adr/0008-renovate-supply-chain-hardening.md` — rationale. - `CLAUDE.md` — pointer to `docs/ci.md` in the *Working in this repo* section. No `.forgejo/workflows/renovate.yml` is checked in — Renovate is triggered by an instance-wide workflow that lives outside this repo, so this repo only ships behaviour. ## The four load-bearing settings 1. `minimumReleaseAge: "7 days"` — quarantine. Vulnerability alerts bypass. 2. `rangeStrategy: "update-lockfile"` — lockfile-only by default. Major bumps that need a range change get their own opt-in PR with `rangeStrategy: "bump"`, separate group, never auto-merged. 3. Five `packageRules` groups: `npm production deps`, `npm dev deps`, `npm major bumps`, `forgejo actions`, `dockerfile base images`. Only the first two carry `automerge: true`. 4. `lockFileMaintenance` weekly to catch transitive bumps with no direct-dep trigger. The `github-actions` manager is extended via `managerFilePatterns` to also parse `.forgejo/workflows/` — without that, Renovate would silently ignore every action in this repo. ## Acceptance criteria - [x] `renovate.json` checked in. Renovate runs on a schedule via the instance-wide workflow (out of repo) and opens grouped PRs per the rules here. - [ ] *Operational verification:* hold back a dev dep released within the quarantine window and confirm Renovate defers the PR. Cannot be tested inline in this PR — verified post-merge on the next runner cycle. - [x] A PR that changes a `package.json` range cannot auto-merge. Structural, not procedural: only the lockfile-only update types (`patch`, `minor`, `digest`, `pin`, `pinDigest`) inside the two non-major npm groups carry `automerge: true`. The `npm major bumps` group sets `rangeStrategy: "bump"` and `automerge: false`. - [x] Policy documented in `docs/ci.md`; rationale in ADR-0008. ## Composes with - #45 (now merged) — Renovate's `forgejo actions` group keeps the SHA pins fresh; humans review. - #16 — once the Dockerfile base image is digest-pinned, Renovate's `dockerfile base images` group bumps the digest under the same human-review rule. - #14 / ADR-0005 — scanners catch *disclosed* CVEs in deps we already have; this work catches *hijacked* releases of deps we already trust. Complementary, not overlapping. ## Test plan - [ ] After merge, confirm the instance-wide Renovate runner picks up `renovate.json` on its next cycle (look for the *Dependency Dashboard* issue to appear). - [ ] Confirm the next Renovate PR (whichever group fires first) opens against this repo with the expected group name and labels. - [ ] If a `forgejo actions` PR opens before #16 lands, confirm it does not auto-merge.

james added 1 commit 2026-06-15 12:23:22 +00:00

Renovate config: grouped PRs, 7-day quarantine, lockfile-only (#44) ... 1954777e2d

renovate.json sets `rangeStrategy: update-lockfile` as the default,
groups PRs by manager + dep type, quarantines releases for 7 days
(vulnerabilityAlerts bypass), and auto-merges only lockfile-only
patch/minor updates. The github-actions manager is extended to also
parse `.forgejo/workflows/`.

Renovate is triggered by an instance-wide workflow that lives outside
this repo, so no `.forgejo/workflows/renovate.yml` is checked in —
this repo only contributes behavioural configuration.

Policy lives in docs/ci.md (new); rationale in ADR-0008.

james force-pushed 44-renovate from 1954777e2d to 6f3663c629 2026-06-15 12:38:09 +00:00 Compare

james merged commit 1342d4890f into main 2026-06-15 12:38:53 +00:00

james referenced this pull request from a commit 2026-06-15 12:38:54 +00:00

Merge pull request 'Renovate config: grouped PRs, 7-day quarantine, lockfile-only (#44)' (#60) from 44-renovate into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

Authentication and authorization

  

area:ci

Forgejo Actions, build, test, security, release

  

area:db

Database abstraction, migrations, persistence

  

area:infra

Containerization, deployment, foundational tooling

  

area:native

React Native app (Android + Linux Flatpak)

  

area:pwa

PWA / web frontend

  

area:service

Backend service, API routes, persistence

  

epic

High-level tracker; links several feature tickets

  

feature

A user-facing feature

  

foundation

Foundational work that other tickets build on

No labels

area:auth

area:ci

area:db

area:infra

area:native

area:pwa

area:service

epic

feature

foundation

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

james/carol!60

No description provided.