Switch Dependabot to Renovate #2893
Conversation
| "automerge": true, | ||
| "automergeType": "branch", | ||
| "schedule": ["* * * * 1"], | ||
| "automergeSchedule": ["* * * * 2"] |
There was a problem hiding this comment.
This would update all unpinned dependencies in uv.lock once per week:
- Branch is created every Monday.
- If the branch build succeeded, Renovate will automatically merge it without a PR on Tuesday.
- If build failed, a PR will be opened with the changes.
There was a problem hiding this comment.
In the future, packageRules can be used to configure similar automerge behavior for a wider range of packages.
| @@ -0,0 +1,13 @@ | |||
| { | |||
| "dependencyDashboard": true, | |||
There was a problem hiding this comment.
If this is enabled, Renovate will maintain a GitHub issue about the status of various dependency updates, it can also be used to control its behavior via checkboxes. Example:
| push: | ||
| branches: | ||
| - master | ||
| - "renovate/**" |
There was a problem hiding this comment.
This is needed for Renovate "automerge" to be able to verify branch changes without a PR.
There was a problem hiding this comment.
This causes to double all our CI jobs, see #2898
It starts 83 checks :(
There was a problem hiding this comment.
Ah, good point. There are two options:
- Configure GitHub Actions concurrency to terminate the branch job when PR job starts.
- Only whitelist
renovate/lock-file-maintenancefor the branch CI.
Option (2) looks simpler -- but the downside is that if we were to expand "automerge" to other package updates, then the list of branches needs updating manually.
ISTM that we actually could use automerge for most version bumps -- in those PRs we usually just check that CI is passing. So automation could save time.
|
I'm +1 |
UnknownPlatypus
left a comment
UnknownPlatypus
left a comment
There was a problem hiding this comment.
I'm +1 for renovate, lgtm
|
@sobolevn don't forget you need to grant Renovate access to the repo also. https://developer.mend.io/github/typeddjango |
Follow-up to #2893 (comment) -- prevent unnecessary test runs in Renovate branches. Currently only "lock file maintenace" has automerge enabled, other Renovate branches will use PR tests not branch tests.
3 participants
I already migrated
djangorestframework-stubsto Renovate and it's working fine. Though it did take me some time to get the configuration right for "automerge" of lock file maintenance.@sobolevn mentioned in typeddjango/djangorestframework-stubs#863 (comment) that
django-stubsalso has "problems with uv in django-stubs. dependabot does not even create PRs there". So this might resolve those.But for this to work, a maintainer with admin access (sobolevn) needs to enroll this repository at https://developer.mend.io/