🔧 QD-15046 Switch dependency updates from Dependabot to Renovate-only - #979
Draft
Anna Zhukova (bindreams) wants to merge 1 commit into
Draft
🔧 QD-15046 Switch dependency updates from Dependabot to Renovate-only#979Anna Zhukova (bindreams) wants to merge 1 commit into
Anna Zhukova (bindreams) wants to merge 1 commit into
Conversation
Qodana for Go114 new problems were found
@@ Code coverage @@
+ 65% total lines covered
10664 lines analyzed, 6959 lines covered
# Calculated according to the filters of your coverage tool☁️ View the detailed Qodana report Contact Qodana teamContact us at qodana-support@jetbrains.com
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Make Renovate the sole dependency-update tool. Removes Dependabot and rewrites the Renovate config in JSON5, taking over Dependabot's scope and adding the requested behaviors.
Ticket: QD-15046
Changes
.github/dependabot.yml..github/renovate.json→.github/renovate.json5(modernized deprecated keys:config:base→config:recommended,regexManagers→customManagers,fileMatch→managerFilePatterns,datasources→matchDatasources,packagePatterns→matchPackageNames,paths→matchFileNames)..github/workflows/renovate-validate.yml— runsrenovate-config-validator --stricton config changes (there was no CI validation before).internal/tooling/scripts/pom.xml.Behaviors
automerge+platformAutomerge(semi-auto: still gated bymain's 1 required review + Test checks)minor+patch+digestgroups; majors stay individual:arrow_up: QD-12983(gomod/actions/maven), bareQD-8148(docker/custom)minimumReleaseAge: "7 days"+internalChecksFilter: "strict"; security updates bypass ithostRulesfordhi.io(hostType: docker) using dashboard secretsDHI_USERNAME/DHI_PASSWORDosvVulnerabilityAlerts+vulnerabilityAlerts; Dependabot security updates are already disabled at repo level and alerts stay onDecisions made autonomously — please confirm
gomod*docker*exclusion. It existed to avoid overlap with Renovate, which already updates those modules (e.g. the recent security PR QD-8148 Update module github.com/docker/cli to v29 [SECURITY] #972). In a Renovate-only world they should be covered. Docker Go SDK bumps will now group + auto-merge on green CI. Re-add apackageRuleif you'd rather keep them manual.ignorePaths(**/testdata/**,.teamcity/**) so it never starts bumping test fixtures (poms, Dockerfiles, compose) or the TeamCity DSL pom — verified excluded..devcontainer/Dockerfile(real file, usesdhi.io) — a small superset of Dependabot's hand-picked dirs.repology/docker-datasource rules from the old config (no matching deps today). Say the word to drop them.Coordination
dhi.iohostRules are also added by the in-flight QD-14979 (47e82a1e, same secret names) on the oldrenovate.json. This PR puts the identical rules inrenovate.json5and deletesrenovate.json, so whichever merges second needs a trivial rebase. QD-14979 additionally pins thedhi.io/golangdigest — that part is untouched here.Verification
renovate-config-validator --strictpasses (repo + global modes).renovate --platform=local --dry-run=extractconfirms: custom managers match all 34 Dockerfiles + the JBR pin; maven scoped to onlyinternal/tooling/scripts/pom.xml; no testdata/.teamcityfixtures extracted; DHI secret interpolation succeeds with secrets present.renovate@43.227.0) for reproducible CI; bump manually (or add a self-update annotation) as desired.