Add Renovate config with automerge for GitHub Actions - #1
Conversation
Configure Renovate to manage the GitHub Actions used in the build workflow: - Extend config:recommended, enable the Dependency Dashboard, and pin action digests via helpers:pinGitHubActionDigests. - Automerge minor/patch/digest/pin updates once required checks pass; hold major updates for manual approval via the dashboard. - Apply a 3-day minimumReleaseAge with internalChecksFilter=strict as a supply-chain safeguard, and platform-native automerge for speed. - Schedule runs to non-office hours on weekdays and anytime on weekends to reduce PR noise. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R8mspxLA2mTZZguvZUGAiP
|
Warning Review limit reached
Next review available in: 24 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a renovate.json configuration file to automate dependency updates. The review feedback points out that "pinDigest" is an invalid update type in Renovate's schema and should be removed. Additionally, it is recommended to replace the standard cron schedules with Renovate's human-readable text-based schedules to ensure more reliable execution.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| { | ||
| "description": "Automerge non-major GitHub Actions updates once required checks pass", | ||
| "matchManagers": ["github-actions"], | ||
| "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "digest"], |
There was a problem hiding this comment.
The update type "pinDigest" is not a valid value in Renovate's schema. The allowed values for matchUpdateTypes are "major", "minor", "patch", "pin", "digest", "rollback", and "bump". Including an invalid value can cause schema validation errors or be ignored by Renovate.
| "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "digest"], | |
| "matchUpdateTypes": ["minor", "patch", "pin", "digest"], |
There was a problem hiding this comment.
pinDigest is actually a valid Renovate update type, so I'm keeping it. From Renovate's source of truth, lib/config/types.ts:
export type UpdateType =
| 'major' | 'minor' | 'patch' | 'pin' | 'digest' | 'pinDigest'
| 'lockFileMaintenance' | 'lockfileUpdate' | 'rollback' | 'bump' | 'replacement';matchUpdateTypes is typed UpdateType[], so "pinDigest" passes schema validation. Removing it would drop automerge coverage for pin-digest updates, which helpers:pinGitHubActionDigests produces. Leaving the config as-is.
(Same for the schedule comment: Renovate's scheduling docs now recommend cron syntax and mark the @breejs/later text syntax as deprecated, so the cron schedules are intentional.)
Generated by Claude Code
| "helpers:pinGitHubActionDigests" | ||
| ], | ||
| "timezone": "America/New_York", | ||
| "schedule": ["* 0-4 * * 1-5", "* * * * 0,6"], |
There was a problem hiding this comment.
Renovate uses the later library to parse schedules, and standard cron syntax can sometimes lead to unexpected behavior or missed runs if Renovate's execution trigger does not align perfectly with the cron minutes.
Using Renovate's recommended human-readable text-based schedules is more robust as they define continuous time ranges.
| "schedule": ["* 0-4 * * 1-5", "* * * * 0,6"], | |
| "schedule": ["before 5am on weekdays", "every weekend"], |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 75195276d9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "description": "Automerge non-major GitHub Actions updates once required checks pass", | ||
| "matchManagers": ["github-actions"], | ||
| "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "digest"], | ||
| "automerge": true |
There was a problem hiding this comment.
This automerge rule is not actually gated by the repo's build: I checked .github/workflows/build.yml, and it only runs on workflow_dispatch and release, so Renovate PRs won't start the build at all. Renovate's platformAutomerge docs warn that, unless GitHub branch protection requires status checks, GitHub may merge before tests have started or even after they fail (https://docs.renovatebot.com/configuration-options/#platformautomerge); in this repo that means a GitHub Actions update can land without ever compiling the release artifacts. Add a pull_request/required build check before enabling this automerge rule.
Useful? React with 👍 / 👎.
| "extends": [ | ||
| "config:recommended", | ||
| ":dependencyDashboard", | ||
| "helpers:pinGitHubActionDigests" |
There was a problem hiding this comment.
This preset only pins dependencies with Renovate depType action, but the same workflow also runs the compiler in container.image: pangbox/openwatcom-action:latest at .github/workflows/build.yml:41. Renovate's GitHub Actions manager extracts job containers as container dependencies (https://docs.renovatebot.com/modules/manager/github-actions/), while helpers:pinGitHubActionDigests is limited to matchDepTypes: ["action"] (https://docs.renovatebot.com/presets-helpers/#helperspingithubactiondigests), so the mutable latest build image will not get a digest-pinning PR and release builds can change outside review. Add Docker/container digest pinning for the workflow container too.
Useful? React with 👍 / 👎.
Address review feedback on the Renovate config: - Add a pull_request trigger to build.yml so the compile (build job) runs on PRs, giving Renovate a real status check to gate automerge on. The heavier bundle/release packaging jobs stay off PR runs via an event guard. - Pin the workflow's job container and service images to immutable digests via a Renovate packageRule (matchDepTypes container/service, pinDigests), so the build image can't change outside review. Digest updates are covered by the existing automerge rule. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R8mspxLA2mTZZguvZUGAiP
The GitHub runner now forces Node 24 for JavaScript actions, but the pangbox/openwatcom-action base image ships an Alpine musl too old to run the injected Node 24 binary (checkout fails with a pthread_getname_np relocation error). Set ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true on the build job so actions fall back to Node 20 until the base image is updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R8mspxLA2mTZZguvZUGAiP
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f5f8c8502
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Compile on pull requests so dependency updates (e.g. Renovate action | ||
| # bumps) are validated before merge. Only the `build` job runs on PRs - | ||
| # see its `if` guard on the heavier `bundle` job below. | ||
| pull_request: |
There was a problem hiding this comment.
Adding the pull_request trigger makes PR runs inherit the workflow-level permissions: contents: write. For same-repository PRs such as Renovate action-update branches, the build executes PR-controlled code with a write-scoped GITHUB_TOKEN, so a compromised action update or build script can modify repository contents/releases before review. Set the PR/build job permissions to read-only and grant contents: write only to the release-attachment job that needs it.
Useful? React with 👍 / 👎.
| needs: build | ||
| # Skip the packaging pipeline (and its external downloads) on PRs; | ||
| # PR runs only need the `build` job's compile + MZ-header check. | ||
| if: github.event_name != 'pull_request' |
There was a problem hiding this comment.
This guard means Renovate PRs that update actions/download-artifact or softprops/action-gh-release skip the only jobs that execute those actions, while renovate.json still automerges every non-major GitHub Actions update. A broken digest/patch/minor update to the download or release steps can therefore merge after a green PR run that never loaded it; either run these jobs for action-update PRs or exclude the unexercised actions from automerge.
Useful? React with 👍 / 👎.
| "minimumReleaseAge": "3 days", | ||
| "internalChecksFilter": "strict", |
There was a problem hiding this comment.
With this global cooldown and strict internal checks, the digest updates this config is trying to enable are not handled reliably: Renovate documents pin/pinDigest as unsupported and digest as generally unsupported for minimumReleaseAge, so initial action/container pinning or later SHA refreshes can either stay pending indefinitely or bypass the intended 3-day safeguard depending on the datasource. Scope the cooldown to version updates, or add a package rule that disables minimumReleaseAge for digest-only updates and reviews/automerge-gates them separately.
Useful? React with 👍 / 👎.
Now that pull_request runs execute the workflow, default GITHUB_TOKEN permissions to contents: read so PR-controlled code (e.g. Renovate action-update branches) can't write repository contents or releases. Grant contents: write only to the attach-to-release job, which uploads assets to the triggering release. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R8mspxLA2mTZZguvZUGAiP
download-artifact and action-gh-release only run in the bundle and release-only jobs, which the PR build skips, so a green PR build never loads them. Require manual review for these two actions instead of automerging on an unrelated green check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R8mspxLA2mTZZguvZUGAiP
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 948b78e044
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "description": "Automerge non-major GitHub Actions updates once required checks pass", | ||
| "matchManagers": ["github-actions"], | ||
| "matchUpdateTypes": ["minor", "patch", "pin", "pinDigest", "digest"], | ||
| "automerge": true |
There was a problem hiding this comment.
This automerge rule still covers actions/upload-artifact, but I checked .github/workflows/build.yml and the bundle job is skipped on PRs while containing a second actions/upload-artifact@v4 invocation that uploads the release artifact using the multi-path path: block. The existing non-automerge exclusion missed this release-only upload usage, so a bad upload-artifact patch/digest update that passes the simple build artifact upload can still merge and only fail when publishing release artifacts. Either run bundle for action-update PRs or include actions/upload-artifact in the manual-review list.
Useful? React with 👍 / 👎.
|
@codex review Generated by Claude Code |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 948b78e044
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "labels": ["dependencies"], | ||
| "prHourlyLimit": 2, | ||
| "prConcurrentLimit": 10, | ||
| "platformAutomerge": true, |
There was a problem hiding this comment.
Renovate's platformAutomerge docs warn that, unless GitHub branch protection selects required status checks, the platform may merge Renovate PRs before tests start or even after failures. In any repo where main does not require the new build PR check, this global setting bypasses the validation added in .github/workflows/build.yml for auto-merged action updates; either require that check in branch protection or set platformAutomerge to false so Renovate waits for green checks itself.
Useful? React with 👍 / 👎.
| { | ||
| "description": "Require manual review for actions the PR build never exercises (they only run in the bundle/release-only jobs, so a green PR build does not validate them)", | ||
| "matchManagers": ["github-actions"], | ||
| "matchPackageNames": ["actions/download-artifact", "softprops/action-gh-release"], |
There was a problem hiding this comment.
Because PR runs skip the bundle job, the release artifact upload in .github/workflows/build.yml is not exercised before Renovate merges. This exception list omits actions/upload-artifact, so a non-major update can be auto-merged after only the build job's simple EXE upload passes, while the skipped multi-file release upload may still break manual/release packaging; include actions/upload-artifact here or run that upload path on PRs.
Useful? React with 👍 / 👎.
| "minimumReleaseAge": "3 days", | ||
| "internalChecksFilter": "strict", |
There was a problem hiding this comment.
With helpers:pinGitHubActionDigests, follow-up updates to pinned actions are digest updates, but Renovate currently does not attach a release timestamp to GitHub Actions digest refreshes; with minimumReleaseAge plus strict internal checks, those releases remain pending instead of opening PRs. After the initial pinning PR, the action SHAs will stop being refreshed, so add a digest/github-actions rule that disables the age gate or uses minimumReleaseAgeBehaviour: "timestamp-optional" for these updates.
Useful? React with 👍 / 👎.
- Set platformAutomerge to false so Renovate performs the merge itself and waits for the build check to pass, rather than relying on GitHub native auto-merge (which only honors checks that branch protection marks required - the new build check is not required yet). - Exempt pin/pinDigest/digest updates from minimumReleaseAge. GitHub Actions digest refreshes have no release timestamp, so with the 3-day cooldown and strict internal checks they would stay pending and pinned SHAs would stop refreshing. Version updates keep the cooldown. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R8mspxLA2mTZZguvZUGAiP
2 participants
Summary
Adds a root
renovate.jsonso Renovate can keep the repo's dependencies up to date automatically. The only Renovate-managed dependencies here are the GitHub Actions in.github/workflows/build.yml(actions/checkout,actions/upload-artifact,actions/download-artifact,softprops/action-gh-release), so the config is tuned around those.What it does
config:recommended,:dependencyDashboardfor an at-a-glance overview issue, andhelpers:pinGitHubActionDigeststo pin actions to immutable commit digests.buildworkflow gates every merge. Uses platform-native automerge (platformAutomerge: true) for speed.majorbumps require manual approval via the Dependency Dashboard rather than opening PRs automatically.minimumReleaseAge: "3 days"withinternalChecksFilter: "strict"means a new release must have existed for 3 days before Renovate will even create a branch, giving time for malicious releases to be caught.* 0-4 * * 1-5) and anytime on weekends (* * * * 0,6) to reduce PR notification noise. Timezone set toAmerica/New_York.prHourlyLimit: 2,prConcurrentLimit: 10, and adependencieslabel on every PR.Notes
security:minimumReleaseAgeNpm) andlockFileMaintenancewere intentionally omitted — there are no npm packages or lock files in this repo. The top-levelminimumReleaseAgealready covers the GitHub Actions datasource.main) Renovate must be permitted to merge.🤖 Generated with Claude Code
Generated by Claude Code