chore(deps): switch from dependabot to renovate#232
Conversation
✅ Deploy Preview for mcp-lifecycle-operator ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Cali0707 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughRemoves Dependabot config and adds Renovate: a new ChangesDependency Management Migration
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
k8s-ci-robot
added
the
cncf-cla: yes
|
@Cali0707: GitHub didn't allow me to request PR reviews from the following users: creydr. Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
size/L
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/renovate-config.js (2)
25-25: 💤 Low valueRedundant
semanticCommitssetting.The
:semanticCommitspreset extended on line 8 already enables this. This explicit setting is unnecessary.🧹 Proposed fix
"rebaseWhen": "behind-base-branch", "baseBranchPatterns": ["main"], "recreateWhen": "always", - "semanticCommits": "enabled", "labels": ["dependencies"],🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/renovate-config.js at line 25, Remove the redundant "semanticCommits" property from the renovate configuration since the preset referenced (the :semanticCommits preset extended earlier) already enables it; specifically delete the "semanticCommits": "enabled", entry from the object in .github/renovate-config.js so the config relies on the preset only.
62-74: 💤 Low valueRedundant
pinDigestsandsetup-gorule.
pinDigests: true(line 65) is redundant with thehelpers:pinGitHubActionDigestspreset extended on line 9.- The
actions/setup-gorule (lines 69-73) only setsgroupName: "github actions", which the preceding rule already applies to all GitHub Actions.🧹 Proposed simplification
// Pin GitHub Actions to SHA digests and group updates { "matchManagers": ["github-actions"], - "pinDigests": true, "groupName": "github actions", }, - // For actions/setup-go, ensure compatibility with our Go version - { - "matchManagers": ["github-actions"], - "matchPackageNames": ["actions/setup-go"], - "groupName": "github actions", - }, ], };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/renovate-config.js around lines 62 - 74, Remove the redundant Renovate rules: delete the "pinDigests": true property from the GitHub Actions rule and remove the separate rule that matches "matchPackageNames": ["actions/setup-go"] which only repeats "groupName": "github actions"; rely on the existing helpers:pinGitHubActionDigests preset and the broader GitHub Actions rule that already assigns the groupName to cover setup-go.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/renovate.yml:
- Around line 21-22: Update the checkout step that uses
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 to add
persist-credentials: false so the action does not write the token into
.git/config; modify the step named "checkout" to include the
persist-credentials: false input (keeping the same uses value).
---
Nitpick comments:
In @.github/renovate-config.js:
- Line 25: Remove the redundant "semanticCommits" property from the renovate
configuration since the preset referenced (the :semanticCommits preset extended
earlier) already enables it; specifically delete the "semanticCommits":
"enabled", entry from the object in .github/renovate-config.js so the config
relies on the preset only.
- Around line 62-74: Remove the redundant Renovate rules: delete the
"pinDigests": true property from the GitHub Actions rule and remove the separate
rule that matches "matchPackageNames": ["actions/setup-go"] which only repeats
"groupName": "github actions"; rely on the existing
helpers:pinGitHubActionDigests preset and the broader GitHub Actions rule that
already assigns the groupName to cover setup-go.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ac816c71-d146-4933-9ae3-92c14cff43c2
📒 Files selected for processing (3)
.github/dependabot.yml.github/renovate-config.js.github/workflows/renovate.yml
💤 Files with no reviewable changes (1)
- .github/dependabot.yml
Signed-off-by: Calum Murray <cmurray@redhat.com>
2 participants
Multiple times in the last month we have had dependabot updates not sync our dockerfile and our go deps, leading to a need for manual PRs.
This PR adds a self-hosted renovate action (inspired by https://github.com/kubernetes-sigs/external-dns/blob/master/.github/workflows/dependency-update.yaml). This has the advantage that it should update both Dockerfiles and go.mod at the same time, keeping our go versions in sync.
Summary by CodeRabbit