feat(renovate): enable automerge for low-risk PRs#2546
Conversation
PR Summary by QodoEnable Renovate automerge for low-risk dependency PRs Description
Diagram
High-Level Assessment
Files changed (1)
|
Site previewPreview: https://0721cbaa-site.fullsend-ai.workers.dev Commit: |
Code Review by Qodo
Context used✅ Tickets:
🎫 Enable auto-merge for Renovate PRs✅ Compliance rules (platform):
51 rules✅ Skills:
writing-user-docs, writing-adrs 1. automerge unscoped in renovate.json
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| "automerge": true, | ||
| "automergeType": "pr", | ||
| "platformAutomerge": true, |
There was a problem hiding this comment.
1. automerge unscoped in renovate.json 📎 Requirement gap ⛨ Security
renovate.json enables automerge globally, which means any Renovate PR that meets merge conditions—including higher-risk minor/major updates and updates produced by the custom regex manager (e.g., OpenShell version pins)—can be auto-merged rather than limiting auto-merge to patch bumps and pin updates. This violates the requirement to configure conservative, low-risk-only auto-merge behavior.
Agent Prompt
## Issue description
`automerge` is enabled globally in `renovate.json` (`automerge: true`) without any `packageRules` or update-type scoping, so Renovate can auto-merge updates beyond the intended low-risk set (patch bumps and pin updates), including potentially higher-risk minor/major upgrades and updates produced by the custom regex manager.
## Issue Context
PR Compliance ID 1062109 requires Renovate auto-merge to be configured conservatively (patch/pin-only) after CI passes. Repo documentation also characterizes automerging as appropriate for “known-safe dependency bumps” / “patch version” bumps, but the current Renovate config does not encode or enforce that limitation.
## Fix Focus Areas
- renovate.json[1-27]
- docs/glossary.md[57-60]
- docs/problems/intent-representation.md[34-37]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
🤖 Finished Review · ✅ Success · Started 9:33 AM UTC · Completed 9:44 AM UTC |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ReviewFindingsLow
Previous runReviewFindingsHigh
Low
Labels: PR modifies renovate.json dependency management configuration to enable automerge. |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| { | ||
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||
| "extends": ["config:recommended"], | ||
| "automerge": true, |
There was a problem hiding this comment.
[high] logic-error
Top-level automerge: true applies to ALL update types (major, minor, patch, pin, digest), but the issue (#2506) and PR title both specify scoping to 'low-risk PRs' / 'patch bumps and pin updates' only. The config:recommended preset does NOT restrict automerge scope -- it does not set automerge at all. As written, a major version bump that passes CI will be automerged without human review.
Suggested fix: Remove the top-level automerge: true and instead scope it via packageRules with matchUpdateTypes: ["patch", "pin"]. automergeType and platformAutomerge can remain at the top level since they only take effect when automerge is true for a given update.
| { | ||
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||
| "extends": ["config:recommended"], | ||
| "automerge": true, |
There was a problem hiding this comment.
[high] authorization
Top-level automerge: true combined with the Renovate app being a bypass actor on the main branch ruleset means major and minor dependency upgrades can land on main with no human approval.
Suggested fix: Scope automerge to low-risk update types only by moving the automerge setting into packageRules with matchUpdateTypes: ["patch", "pin", "digest"].
| "extends": ["config:recommended"], | ||
| "automerge": true, | ||
| "automergeType": "pr", | ||
| "platformAutomerge": true, |
There was a problem hiding this comment.
[low] authorization
platformAutomerge: true delegates merge execution to GitHub's native auto-merge feature. If CI workflows are path-filtered or misconfigured for dependency-only changes, the PR could merge with no effective review. Risk is significantly reduced if the high finding is addressed (scoping automerge to patch/pin only).
| { | ||
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||
| "extends": ["config:recommended"], | ||
| "automerge": true, |
There was a problem hiding this comment.
[low] json-formatting
The three new automerge fields are inserted before prHourlyLimit rather than grouped with other behavior configuration. Minor style preference.
fullsend-ai-review
Bot
added
the
dependencies
Scope automerge to patch bumps and pin updates via packageRules. Combined with repo-level allow_auto_merge and the ruleset bypass for renovate-fullsend, these low-risk updates merge automatically after CI passes. Closes #2506 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: Hector Martinez <hemartin@redhat.com>
rh-hemartin
force-pushed
the
feat/2506-renovate-automerge
branch
from
c0dd35b to
ec62ff0
Compare
|
🤖 Finished Review · ✅ Success · Started 11:43 AM UTC · Completed 11:51 AM UTC |
| "platformAutomerge": true, | ||
| "prHourlyLimit": 1, | ||
| "packageRules": [ | ||
| { |
There was a problem hiding this comment.
[low] authorization
Automerge is enabled for patch and pin update types. Combined with the Renovate app being a bypass actor on the main branch ruleset (configured outside this diff), these PRs will merge without human review after CI passes. This is scoped to the lowest-risk update types, which is appropriate, but relies on required status checks being correctly configured for dependency-only PRs to provide the CI gate.
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | ||
| "extends": ["config:recommended"], | ||
| "automergeType": "pr", | ||
| "platformAutomerge": true, |
There was a problem hiding this comment.
[low] authorization
platformAutomerge: true delegates merge execution to GitHub's native auto-merge. If any required CI status checks are path-filtered and do not trigger on dependency-only file changes (e.g., go.mod, go.sum, package.json), the PR could merge with no effective CI validation. Verify that required status checks fire on all file paths that Renovate PRs touch.
fullsend-ai-review
Bot
added
the
ready-for-merge
2 participants
Summary
patchandpinupdate types viapackageRulesautomergeType: prandplatformAutomerge: trueconfigure merge behaviorallow_auto_mergealready enabled via APIrenovate-fullsendapp added as bypass actor on main ruleset via APILow-risk dependency updates (patch bumps and pin updates) will merge automatically after CI passes. Major/minor updates still require human review.
Closes #2506
Test plan
🤖 Generated with Claude Code