Skip to content

Conversation

@Marcel-Nordeck
Copy link
Contributor

@Marcel-Nordeck Marcel-Nordeck commented Jun 5, 2025

(FYI: the renovate branch name makes it run it on the actual renovate for validation which is a nice thing. It doesnt actually do anything more than that. See https://docs.renovatebot.com/config-validation/#validation-of-renovate-config-change-prs for more info)

TODOs:

✔️ Checklist

  • A changeset describing the change and affected packages (more info).
  • Added or updated documentation.
  • Tests for new functionality and regression tests for bug fixes.
  • Screenshots or videos attached (for UI changes).
  • All your commits have a Signed-off-by line in the message (more info).

@Marcel-Nordeck Marcel-Nordeck requested a review from a team as a code owner June 5, 2025 12:19
@changeset-bot
Copy link

changeset-bot bot commented Jun 5, 2025

⚠️ No Changeset found

Latest commit: e731ccd

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@Marcel-Nordeck Marcel-Nordeck marked this pull request as draft June 5, 2025 12:19
vulnerabilityAlerts: {
enabled: false,
},
// https://docs.renovatebot.com/configuration-options/#automergetype - We use branch to not get raced by commits to main
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'm not sure i understand completely the risk of "races" here.

do I understand correctly that with default PR automergeType:

  • renovate runs
  • renovate creates some PRs
  • CI runs on each PR
  • renovate runs again (on what schedule exactly?)
  • renovate merges PR(s? or only one because then it needs to rebase the rest?) if they are green

but with branch merge type

  • renovate runs
  • CI runs on each branch
  • renovate somehow tracks if tests passed without running again?
  • renovate merges branch (but still has to rebase and repeat for all the others?)

we definitely need to consider setting up the schedules so it can actually get a week's work done within the week.

n.b. we would also need to reconfigure CI AND branch protection rules for this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You kind of understand them, right. They both rebase I believe but renovate waits for CI to stabilise essentially before opening a PR when using the branch merge type, and crucially, it will not open an PR for automerge things. So it reduces the noise.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. As far as I could observe rebases happen based on webhooks and therefor immdiately.
  2. CI is observed via webhooks as well it seems
  3. PR and branch behaviour is the same apart from it does not first create PR when automerging was successful.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: Setup branch protections to support it

Copy link
Contributor

@maheichyk maheichyk Jun 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using branch for automergeType looks currently not that convincing to me. PR noise mentioned here, however not really seems that an issue, I would prefer to see changes applied in PRs, no matter if they are done by devs or the bot. I am not sure if I really got an issue with racing to main.

This branch type is not a default, it is already important in my opinion. What if a dependency breaks a test, we devs need to create a PR or not to fix the code/test? Generally automerge itself is already quite a feature, I wonder if we should make things even more implicit. I checked few repos where automerge is used (example matrix.org) see 'pr' used, but some good stats how this feature is used would be good to decide. Generally I think we should have a good objection why we need to use 'branch' instead of default 'pr'.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the end I am fine with both solutions. They will work either way. I am just not sure how many more PRs will be created by that which cause notifications.

Copy link
Contributor

@HarHarLinks HarHarLinks Jun 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the benefit of having PRs that automerge over branches that automerge to you @maheichyk?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could see all the changes that are done to repository using repository pull requests. I would feel strange if there are basically no PRs, but changes are done in background. I would like to see CI pipeline information (tests, console messages, etc) to be able to check possible issues (not sure if that gets stored somewhere in the case of branches)

Copy link
Contributor

@maheichyk maheichyk Jun 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However, I think we talk about only patch automerge, right. So no really strong objections. However, if a patch update is merged once a week, it would not be spammy in terms of notifications.

Copy link
Contributor

@HarHarLinks HarHarLinks Jun 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • see everything in PRs: it is true that you will not have a PR for every change. i am not sure how useful the PR history is to browsing history; personally I think git blame is more useful? you will also be able to browse commit history.
  • CI pipeline: is stored for commits, so the commits on the "feature branches" will have a CI status. when the branches get merged using "merge" strategy, you can still find them. if the get merged using "squash" or "rebase", then i think it will be harder to find them. CI runs will still be in https://github.com/nordeck/matrix-widget-toolkit/actions/workflows/ci.yml. regardless, even with using branch here instead of PRs, renovate needs to pass all CI, so for anything it merges, CI will have been green. What would you be interested in looking at?
  • patch automerge: yes, for now we are only talking about patch, lockfilemaintenance, pin, and similar automerge. not minor or major updates.
  • once a week: the current configuration is to automerge during all 5 weekdays (120h) at any time. renovate is triggered every 4h, so it runs automerges up to 30 times per week. if our understanding in another comment thread is correct, then it detect and merges all available automerges for each one. our "once a week" (monday morning) setting is about all non-auto merges, i.e. PRs opened for maintainers to review by renovate.

@HarHarLinks
Copy link
Contributor

HarHarLinks commented Jun 11, 2025

in case i didn't mention it: we should stop pinning minor versions of mui and consider if we need to pin major versions

@HarHarLinks
Copy link
Contributor

@HarHarLinks
Copy link
Contributor

HarHarLinks commented Jun 13, 2025

Testing was helpful with LOG_LEVEL=debug renovate --platform=local --dry-run=lookup --repository-cache=reset.

Here are the branches it creates with respective packages and update types:

  • renovate/development-dependencies:
    • '@playwright/test: minor'
    • 'msw: minor'
    • '@eslint/compat: minor'
    • 'eslint-plugin-testing-library: minor'
    • 'rollup: minor'
    • 'typescript-eslint: minor'
  • renovate/major-major-updates:
    • '@mui/icons-material: major'
    • '@mui/material: major'
    • 'react: major'
    • 'react-dom: major'
    • '@types/react: major'
    • '@types/react-dom: major'
    • '@vitejs/plugin-basic-ssl: major'
    • 'happy-dom: major'
    • 'lint-staged: major'
    • '@mui/icons-material: major'
    • '@mui/material: major'
    • '@mui/utils: major'
    • '@types/react: major'
    • 'react: major'
    • '@types/react: major'
    • 'react: major'
  • renovate/nginx-1.x:
    • 'nginx: minor'
  • renovate/patch-development-dependencies:
    • '@types/node: patch'
    • '@vitejs/plugin-react-swc: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@vitest/eslint-plugin: patch'
    • 'rollup: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
  • renovate/patch-patch-updates:
    • 'nginx: patch'
  • renovate/patch-production-dependencies:
    • '@reduxjs/toolkit: patch'
    • 'react-i18next: patch'
    • 'i18next-browser-languagedetector: patch'
    • 'react-i18next: patch'
  • renovate/pin-dependencies:
    • 'nginx: pinDigest'
    • 'ghcr.io/nordeck/matrix-widget-toolkit/widget-server: pinDigest'
  • renovate/production-dependencies:
    • '@reduxjs/toolkit: minor'
    • 'react-router-dom: minor'
    • '@fontsource/inter: minor'
    • 'i18next-browser-languagedetector: minor'

Some deps are missing (e.g. it refuses to check github actions in dry run) but this is the overall result. I think some branch names can be improved, and I have to review the general logic.

Copy link
Contributor

@HarHarLinks HarHarLinks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

something about the addLabels does not work yet

@HarHarLinks
Copy link
Contributor

Moving the general groups from the bottom to the top of the packageRules yields:

  • renovate/development-dependencies:
    • '@playwright/test: minor'
    • 'msw: minor'
    • 'rollup: minor'
  • renovate/i18next-dependencies:
    • 'i18next-browser-languagedetector: minor'
  • renovate/linter-dependencies:
    • '@eslint/compat: minor'
    • '@eslint/js: minor'
    • 'eslint: minor'
    • 'eslint-plugin-testing-library: minor'
    • 'typescript-eslint: minor'
  • renovate/major-major-updates:
    • '@mui/icons-material: major'
    • '@mui/material: major'
    • '@vitejs/plugin-basic-ssl: major'
    • 'happy-dom: major'
    • 'lint-staged: major'
    • '@mui/icons-material: major'
    • '@mui/material: major'
    • '@mui/utils: major'
  • renovate/major-react-dependencies:
    • 'react: major'
    • 'react-dom: major'
    • '@types/react: major'
    • '@types/react-dom: major'
    • '@types/react: major'
    • 'react: major'
    • '@types/react: major'
    • 'react: major'
  • renovate/nginx-1.x:
    • 'nginx: minor'
  • renovate/patch-development-dependencies:
    • '@types/node: patch'
    • '@vitejs/plugin-react-swc: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@rollup/plugin-commonjs: patch'
    • '@vitest/eslint-plugin: patch'
    • 'rollup: patch'
    • '@rollup/plugin-commonjs: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
    • '@types/node: patch'
    • '@vitest/coverage-v8: patch'
    • 'vitest: patch'
  • renovate/patch-i18next-dependencies:
    • 'react-i18next: patch'
    • 'i18next-browser-languagedetector: patch'
    • 'react-i18next: patch'
  • renovate/patch-patch-updates:
    • 'nginx: patch'
  • renovate/patch-production-dependencies:
    • '@reduxjs/toolkit: patch'
  • renovate/pin-dependencies:
    • 'nginx: pinDigest'
    • 'ghcr.io/nordeck/matrix-widget-toolkit/widget-server: pinDigest'
  • renovate/production-dependencies:
    • '@reduxjs/toolkit: minor'
    • '@fontsource/inter: minor'
  • renovate/react-dependencies:
    • 'react-router-dom: minor'

I think this is at least close to what we want.

@renovate
Copy link
Contributor

renovate bot commented Jun 18, 2025

Reconfigure PR Results

This is an reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:


Detected Package Files

  • containers/widget-server/Dockerfile (dockerfile)
  • example-widget-mui/Dockerfile (dockerfile)
  • .github/workflows/ci.yml (github-actions)
  • charts/example-widget-mui/values.yaml (helm-values)
  • containers/widget-server/package.json (npm)
  • example-widget-mui/package.json (npm)
  • package.json (npm)
  • packages/api/package.json (npm)
  • packages/mui/package.json (npm)
  • packages/react/package.json (npm)
  • packages/testing/package.json (npm)

Configuration Summary

Based on the default config's presets, Renovate will:

  • Hopefully safe environment variables to allow users to configure.
  • Show all Merge Confidence badges for pull requests.
  • Group all minor and patch updates together.
  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Automerge patch upgrades if they pass tests.
  • Pin Docker digests.
  • Pin github-action digests.
  • Pin dependency versions for development dependencies.
  • Weekly schedule on early Monday mornings (before 4 AM).
  • Schedule automerge anytime on weekdays.
  • Run Renovate on following schedule: * 0-3 * * 1

What to Expect

With your current configuration, Renovate will create 18 Pull Requests:

Pin dependencies
Update dependency @​reduxjs/toolkit to v2.6.1
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/patch-production-dependencies
  • Merge into: main
  • Upgrade @reduxjs/toolkit to 2.6.1
Update dependency @​rollup/plugin-commonjs to v28.0.6
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/patch-rollup-dependencies
  • Merge into: main
  • Upgrade @rollup/plugin-commonjs to 28.0.6
Update dependency i18next-browser-languagedetector to v8.0.5
Update development-dependencies (patch)
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/patch-development-dependencies
  • Merge into: main
  • Upgrade @types/node to 22.15.31
  • Upgrade rollup to 4.41.2
Update patch updates (patch)
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/patch-patch-updates
  • Merge into: main
  • Upgrade changesets/action to 06245a4e0a36c064a573d4150030f5ec548e4fcc
  • Upgrade nginx to sha256:113552fa0c0cbb9d049fe837303e28a6faa3c695bdfcbfb96d4196dbf5d7ec41
Update vite dependencies (patch)
Update all non-major dependencies (minor)
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/all-minor-patch
  • Merge into: main
  • Upgrade changesets/action to e0145edc7d9d8679003495b11f87bd8ef63c0cba
  • Upgrade nginx to sha256:8c0ec5e32733110f07f037e47a317fcc4d584c72df812afa19a29265ace71283
Update dependency i18next-browser-languagedetector to v8.1.0
Update dependency react-router-dom to v7.6.2
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/react-monorepo
  • Merge into: main
  • Upgrade react-router-dom to 7.6.2
Update development-dependencies (minor)
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/development-dependencies
  • Merge into: main
  • Upgrade msw to 2.10.2
  • Upgrade rollup to 4.42.0
Update linters (minor)
Update production-dependencies (minor)
Update dependency @​vitejs/plugin-basic-ssl to v2
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/major-vite-dependencies
  • Merge into: main
  • Upgrade @vitejs/plugin-basic-ssl to 2.0.0
Update major updates (major)
  • Schedule: ["* 0-3 * * 1"]
  • Branch name: renovate/major-major-updates
  • Merge into: main
  • Upgrade happy-dom to 17.6.3
  • Upgrade lint-staged to 16.1.0
Update mui dependencies to v7 (major)
Update react monorepo to v19 (major)
Lock file maintenance
  • Schedule: ["before 4am on monday"]
  • Branch name: renovate/lockfilemaintenance-updates
  • Merge into: main
  • Regenerate lock files to use latest dependency versions

🚸 Branch creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prhourlylimit for details.

@Marcel-Nordeck
Copy link
Contributor Author

Marcel-Nordeck commented Jun 18, 2025

a9ed4a6 now yields:

renovate/all-minor-patch:
  - "nginx: minor"
renovate/development-dependencies:
  - "@playwright/test: minor"
  - "msw: minor"
  - "rollup: minor"
renovate/i18next-dependencies:
  - "i18next-browser-languagedetector: minor"
renovate/linters:
  - "@eslint/compat: minor"
  - "@eslint/js: minor"
  - "eslint: minor"
  - "eslint-plugin-testing-library: minor"
  - "typescript-eslint: minor"
renovate/major-major-updates:
  - "happy-dom: major"
  - "lint-staged: major"
renovate/major-mui-dependencies:
  - "@mui/icons-material: major"
  - "@mui/material: major"
  - "@mui/icons-material: major"
  - "@mui/material: major"
  - "@mui/utils: major"
renovate/major-react-monorepo:
  - "react: major"
  - "react-dom: major"
  - "@types/react: major"
  - "@types/react-dom: major"
  - "@types/react: major"
  - "react: major"
  - "@types/react: major"
  - "react: major"
renovate/major-vite-dependencies:
  - "@vitejs/plugin-basic-ssl: major"
renovate/patch-development-dependencies:
  - "@types/node: patch"
  - "rollup: patch"
  - "@types/node: patch"
  - "@types/node: patch"
  - "@types/node: patch"
  - "@types/node: patch"
renovate/patch-i18next-dependencies:
  - "react-i18next: patch"
  - "i18next-browser-languagedetector: patch"
  - "react-i18next: patch"
renovate/patch-patch-updates:
  - "nginx: patch"
renovate/patch-production-dependencies:
  - "@reduxjs/toolkit: patch"
renovate/patch-rollup-dependencies:
  - "@rollup/plugin-commonjs: patch"
  - "@rollup/plugin-commonjs: patch"
renovate/patch-vite-dependencies:
  - "@vitejs/plugin-react-swc: patch"
  - "@vitest/coverage-v8: patch"
  - "vitest: patch"
  - "@vitest/eslint-plugin: patch"
  - "@vitest/coverage-v8: patch"
  - "vitest: patch"
  - "@vitest/coverage-v8: patch"
  - "vitest: patch"
  - "@vitest/coverage-v8: patch"
  - "vitest: patch"
  - "@vitest/coverage-v8: patch"
  - "vitest: patch"
renovate/pin-dependencies:
  - "nginx: pinDigest"
  - "ghcr.io/nordeck/matrix-widget-toolkit/widget-server: pinDigest"
renovate/production-dependencies:
  - "@reduxjs/toolkit: minor"
  - "@fontsource/inter: minor"
renovate/react-monorepo:
  - "react-router-dom: minor"

@Marcel-Nordeck Marcel-Nordeck marked this pull request as ready for review June 18, 2025 17:16
MTRNord and others added 10 commits June 18, 2025 19:16
…stead of labels to extend rather than replace and set rangeStrategy to replace on engine updates. Also do not extend monorepos to prevent matching issues and reintroduce the labeling groups

Signed-off-by: MTRNord <[email protected]>
Copy link
Contributor

@HarHarLinks HarHarLinks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Marcel-Nordeck
Copy link
Contributor Author

what's the conclusion to #943 (comment)?

Both are activated now and it seems like for now we can just run both. Better save than sorry.

and for this TODO #943 (comment)? there is no comment added about the "clock giver"

you missed #943 (comment)

CI needs to be set to LTS #943 (comment) is it possible to do quickly or do we do it in a followup?

Done in d12165f

@HarHarLinks
Copy link
Contributor

what's the conclusion to #943 (comment)?

Both are activated now and it seems like for now we can just run both. Better save than sorry.

Ok, dependabot vuln alerts are on implicitly (be default), provided that the repo and renovate app are configured correctly: https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts

and for this TODO #943 (comment)? there is no comment added about the "clock giver"

you missed #943 (comment)

I meant for that info to go into .github/renovate.json5.

Marcel-Nordeck and others added 2 commits June 23, 2025 18:18
Co-authored-by: Kim Brose <[email protected]>
Signed-off-by: Marcel-Nordeck <[email protected]>
@Marcel-Nordeck
Copy link
Contributor Author

what's the conclusion to #943 (comment)?

Both are activated now and it seems like for now we can just run both. Better save than sorry.

Ok, dependabot vuln alerts are on implicitly (be default), provided that the repo and renovate app are configured correctly: https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts

and for this TODO #943 (comment)? there is no comment added about the "clock giver"

you missed #943 (comment)

I meant for that info to go into .github/renovate.json5.

Fixed

HarHarLinks
HarHarLinks previously approved these changes Jun 24, 2025
Signed-off-by: Kim Brose <[email protected]>
@HarHarLinks HarHarLinks changed the title NEO-1216: Use newer style config which fixes some of our issues Update Renovate config Jun 24, 2025
@Marcel-Nordeck Marcel-Nordeck merged commit 70da6e3 into main Jun 24, 2025
5 checks passed
@Marcel-Nordeck Marcel-Nordeck deleted the renovate/reconfigure branch June 24, 2025 08:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants