chore(renovate): centralize renovate configuration - #110
iamvikshan wants to merge 1 commit into
Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
PR Summary by QodoCentralize Renovate config to shared org preset
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
1. Schema removed
|
| @@ -1,77 +1,5 @@ | |||
| { | |||
| "$schema": "https://docs.renovatebot.com/renovate-schema.json", | |||
There was a problem hiding this comment.
1. Schema removed 🐞 Bug ⚙ Maintainability
The Renovate config no longer declares the Renovate JSON schema, which removes schema-based validation/autocomplete and makes configuration mistakes easier to miss. This is a tooling/maintainability regression that can lead to silently misconfigured Renovate behavior.
Agent Prompt
## Issue description
`.github/renovate.json` removed the `$schema` declaration, which reduces schema validation and editor assistance.
## Issue Context
Even when centralizing rules via `extends`, keeping `$schema` in the local config helps prevent accidental config typos/regressions.
## Fix Focus Areas
- .github/renovate.json[1-5]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "labels": ["security"] | ||
| }, | ||
| "osvVulnerabilityAlerts": true | ||
| "github>iamvikshan/.github//renovate/base" |
There was a problem hiding this comment.
Preset Becomes Sole Safety Gate
This file now delegates every Renovate rule to github>iamvikshan/.github//renovate/base. If that preset does not carry the removed vulnerabilityAlerts, osvVulnerabilityAlerts, lockfile maintenance, and major-update automerge: false rules, Renovate can stop opening security update PRs or can auto-merge breaking major updates that this repo previously forced through manual review.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/renovate.json
Line: 3
Comment:
**Preset Becomes Sole Safety Gate**
This file now delegates every Renovate rule to `github>iamvikshan/.github//renovate/base`. If that preset does not carry the removed `vulnerabilityAlerts`, `osvVulnerabilityAlerts`, lockfile maintenance, and major-update `automerge: false` rules, Renovate can stop opening security update PRs or can auto-merge breaking major updates that this repo previously forced through manual review.
How can I resolve this? If you propose a fix, please make it concise.
📝 WalkthroughWalkthroughThe .github/renovate.json configuration file was simplified by removing all inlined settings—including presets, reviewers, assignees, labels, timezone, limits, automerge behavior, lockfile maintenance schedule, packageRules, and vulnerability alert settings—and replacing them with a single extends entry referencing a shared base configuration. Estimated code review effort: 1 (Trivial) | ~3 minutes Changes
Sequence Diagram(s)No sequence diagram applicable — this change is a configuration simplification with no observable runtime flow. Related issues: None specified. Related PRs: None specified. Suggested labels: dependencies, configuration Suggested reviewers: None specified. Poem 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/renovate.json:
- Around line 2-4: The Renovate config is extending a preset path that cannot be
resolved, so update the .github/renovate.json "extends" entry to point to an
existing shared preset or add the missing preset in the referenced .github repo.
Use the renovate config in .github/renovate.json and the preset reference
github>iamvikshan/.github//renovate/base to verify the target is valid and
loadable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: b4381515-4ae0-4b37-a794-a04d8a191fbf
📒 Files selected for processing (1)
.github/renovate.json
| "extends": [ | ||
| "config:recommended", | ||
| ":dependencyDashboard", | ||
| ":semanticCommits", | ||
| "schedule:daily" | ||
| ], | ||
| "reviewers": ["iamvikshan"], | ||
| "assignees": ["iamvikshan"], | ||
| "labels": ["dependencies"], | ||
| "timezone": "Africa/Nairobi", | ||
| "prConcurrentLimit": 5, | ||
| "prHourlyLimit": 2, | ||
|
|
||
| "automerge": true, | ||
| "minimumReleaseAge": "3 days", | ||
| "pinDigests": false, | ||
| "semanticCommitType": "chore", | ||
|
|
||
| "lockFileMaintenance": { | ||
| "enabled": true, | ||
| "schedule": ["before 4am on monday"], | ||
| "labels": ["dependencies", "lockfile"] | ||
| }, | ||
|
|
||
| "packageRules": [ | ||
| { | ||
| "description": "Group the Elysia backend framework and its official plugins", | ||
| "matchPackagePatterns": ["^elysia", "^@elysiajs/"], | ||
| "groupName": "elysia ecosystem", | ||
| "labels": ["dependencies", "elysia", "backend"] | ||
| }, | ||
| { | ||
| "description": "Group all semantic-release and conventional-changelog packages together", | ||
| "matchPackagePatterns": [ | ||
| "^@semantic-release/", | ||
| "^semantic-release", | ||
| "^conventional-changelog" | ||
| ], | ||
| "groupName": "semantic-release ecosystem", | ||
| "labels": ["dependencies", "semantic-release", "ops"] | ||
| }, | ||
| { | ||
| "description": "Group code quality tools, formatters, and git hooks", | ||
| "matchPackageNames": ["eslint", "prettier", "husky"], | ||
| "matchPackagePatterns": ["^@typescript-eslint/"], | ||
| "groupName": "linters and formatters", | ||
| "labels": ["dependencies", "tooling", "lint"] | ||
| }, | ||
| { | ||
| "description": "Keep Bun runtime type definitions in their own silent group", | ||
| "matchPackageNames": ["@types/bun"], | ||
| "groupName": "bun types", | ||
| "labels": ["dependencies", "bun", "types"] | ||
| }, | ||
| { | ||
| "description": "Catch GitHub Actions updates, group them, and ensure Semantic Release ignores them", | ||
| "matchManagers": ["github-actions"], | ||
| "semanticCommitScope": "ci", | ||
| "groupName": "github actions", | ||
| "labels": ["dependencies", "github-actions", "ci"] | ||
| }, | ||
| { | ||
| "description": "Safety Gate: Force manual review for any breaking Major upgrades", | ||
| "matchUpdateTypes": ["major"], | ||
| "automerge": false, | ||
| "labels": ["dependencies", "major-update"] | ||
| } | ||
| ], | ||
|
|
||
| "vulnerabilityAlerts": { | ||
| "enabled": true, | ||
| "labels": ["security"] | ||
| }, | ||
| "osvVulnerabilityAlerts": true | ||
| "github>iamvikshan/.github//renovate/base" | ||
| ] |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the shared preset file exists in the central config repo.
gh api repos/iamvikshan/.github/contents/renovate/base.json \
--jq '.path, .type, .download_url'Repository: iamvikshan/linktree
Length of output: 309
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the Renovate config in this repo.
git ls-files .github/renovate.json
cat -n .github/renovate.json
# Check whether the referenced shared preset repo/path is discoverable through GitHub API.
gh api repos/iamvikshan/.github --jq '{full_name, private, default_branch, archived}'
gh api repos/iamvikshan/.github/contents/renovate --jq '.[].path' || true
gh api repos/iamvikshan/.github/contents/renovate/base.json --jq '{path, type, download_url}' || true
gh api repos/iamvikshan/.github/contents/renovate/base --jq '{path, type, download_url}' || trueRepository: iamvikshan/linktree
Length of output: 832
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# List Renovate-related files in the shared config repo.
gh api repos/iamvikshan/.github/git/trees/main?recursive=1 \
--jq '.tree[] | select(.path | test("^renovate(/|$)")) | {path, type}'
# Probe for common preset filenames under the renovate directory.
for p in renovate/base renovate/base.json renovate/base.json5 renovate/base.js renovate/base.yaml renovate/base.yml; do
echo "== $p =="
gh api "repos/iamvikshan/.github/contents/$p" --jq '{path, type, download_url}' || true
doneRepository: iamvikshan/linktree
Length of output: 1212
Use a resolvable shared Renovate preset .github/renovate.json points at github>iamvikshan/.github//renovate/base, but that preset path doesn’t exist in iamvikshan/.github; Renovate will stop loading this config until the preset is added or the reference is corrected.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/renovate.json around lines 2 - 4, The Renovate config is extending a
preset path that cannot be resolved, so update the .github/renovate.json
"extends" entry to point to an existing shared preset or add the missing preset
in the referenced .github repo. Use the renovate config in .github/renovate.json
and the preset reference github>iamvikshan/.github//renovate/base to verify the
target is valid and loadable.
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/renovate.json">
<violation number="1" location=".github/renovate.json:3">
P2: This change removes all repository-local Renovate configuration, including critical safeguards that previously prevented automerging major updates, configured vulnerability alerts, and set PR rate limits. Because the shared preset `github>iamvikshan/.github//renovate/base` is not visible in this PR, reviewers cannot verify these protections are preserved. Consider keeping the most critical rules—such as the major-update automerge gate, vulnerability alert settings, and PR rate limits—as local overrides alongside the shared preset.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| "labels": ["security"] | ||
| }, | ||
| "osvVulnerabilityAlerts": true | ||
| "github>iamvikshan/.github//renovate/base" |
There was a problem hiding this comment.
P2: This change removes all repository-local Renovate configuration, including critical safeguards that previously prevented automerging major updates, configured vulnerability alerts, and set PR rate limits. Because the shared preset github>iamvikshan/.github//renovate/base is not visible in this PR, reviewers cannot verify these protections are preserved. Consider keeping the most critical rules—such as the major-update automerge gate, vulnerability alert settings, and PR rate limits—as local overrides alongside the shared preset.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/renovate.json, line 3:
<comment>This change removes all repository-local Renovate configuration, including critical safeguards that previously prevented automerging major updates, configured vulnerability alerts, and set PR rate limits. Because the shared preset `github>iamvikshan/.github//renovate/base` is not visible in this PR, reviewers cannot verify these protections are preserved. Consider keeping the most critical rules—such as the major-update automerge gate, vulnerability alert settings, and PR rate limits—as local overrides alongside the shared preset.</comment>
<file context>
@@ -1,77 +1,5 @@
- "labels": ["security"]
- },
- "osvVulnerabilityAlerts": true
+ "github>iamvikshan/.github//renovate/base"
+ ]
}
</file context>
This PR centralizes the Renovate configuration to use the shared organization-wide preset
github>iamvikshan/.github//renovate/base.All rules are now defined in the central configuration repository.
Summary by cubic
Centralizes Renovate to the shared org preset
github>iamvikshan/.github//renovate/base, removing the in-repo rules. This reduces duplication and keeps dependency update behavior consistent across repos.Written for commit 877e558. Summary will update on new commits.
Confidence Score: 5/5
The change looks mergeable once the shared preset is confirmed to preserve the removed safety rules.
The JSON shape is valid. The only concern is behavioral drift from moving all Renovate rules into an external preset. No blocking local code issue was found.
.github/renovate.json
What T-Rex did
Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "chore(renovate): centralize configuratio..." | Re-trigger Greptile