Skip to content

chore: add Renovate config for automated dependency updates#329

Merged
Haz3-jolt merged 1 commit intoBlazeUp-AI:mainfrom
HemalathaMadeswaran18:chore/add-renovate-328
Apr 16, 2026
Merged

chore: add Renovate config for automated dependency updates#329
Haz3-jolt merged 1 commit intoBlazeUp-AI:mainfrom
HemalathaMadeswaran18:chore/add-renovate-328

Conversation

@HemalathaMadeswaran18
Copy link
Copy Markdown
Contributor

Closes #328

Purpose / Description

Dependencies are currently updated manually with no automated tooling to
detect outdated or vulnerable packages across the Python, Node.js, Docker,
GitHub Actions, and pre-commit ecosystems. This adds a Renovate Bot
configuration to automate dependency update PRs.

Fixes

Approach

Added renovate.json at the repo root with the following behavior:

  • Groups minor/patch updates into a single PR per ecosystem (Python,
    Node/pnpm, Docker, GitHub Actions, pre-commit) to reduce noise
  • Major updates get individual PRs for careful review
  • Patch-level updates automerge if CI passes
  • Scheduled to run weekly on Saturdays to avoid disrupting active development
  • Adds a Dependency label to all generated PRs

Covered package managers:

  • Python: pep621 + uv (pyproject.toml, uv.lock)
  • Node/pnpm: npm (web/package.json, pnpm-lock.yaml)
  • Docker: dockerfile + docker-compose (docker/Dockerfile.api,
    docker/Dockerfile.web, docker/docker-compose.yml)
  • GitHub Actions: .github/workflows/
  • pre-commit: .pre-commit-config.yaml

How Has This Been Tested?

  • Validated the JSON against the Renovate
    schema
  • Config uses only documented options from the Renovate
    docs
  • Full functionality will be verified once the Renovate GitHub App is
    installed on the repo — it will create a Dependency Dashboard issue confirming
    detection of all package managers

Learning (optional, can help others)

  • Renovate's config:recommended preset handles most sensible defaults
    (pinning, range strategies, etc.)
  • The matchManagers field scopes rules to specific ecosystems so grouping
    doesn't mix unrelated deps
  • Renovate auto-detects all package files recursively — no need to specify
    paths manually
  • Docs: https://docs.renovatebot.com/configuration-options/

Checklist

  • All commits are signed off (git commit -s) per the
    DCO
  • You have a descriptive commit message with a short title (first line,
    max 50 chars).
  • You have commented your code, particularly in hard-to-understand areas
  • You have performed a self-review of your own code
    - [ ] UI changes: include screenshots of all affected screens (in particular
    showing any new or changed strings) and run any tests if necessary

Closes BlazeUp-AI#328

Signed-off-by: Hemalatha Madeswaran <hemalathamadeswaran@gmail.com>
@HemalathaMadeswaran18
Copy link
Copy Markdown
Contributor Author

Note to Maintainer :
After this PR is merged, the Renovate GitHub App needs to be installed on the BlazeUp-AI org (scoped to the Observal repo). Once installed, Renovate will detect the existing config, skip the onboarding PR, and immediately start opening grouped dependency update PRs on the schedule defined here (weekly on Saturdays).

@Haz3-jolt Haz3-jolt merged commit acfadae into BlazeUp-AI:main Apr 16, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Renovate Bot for automated dependency updates

2 participants