build(deps): renovate replaces dependabot here too - #44
Merged
Merged
Conversation
The website moved to Renovate and the Mend app is installed across the organisation, so this repository is already in its scope with no configuration of its own. Two bots editing the same manifests would fight over the same lines, so dependabot.yml goes in the same commit. The policy it replaces carries over: a weekly run, a seven-day cooldown, minor and patch grouped per ecosystem, tools/ in its own group because it decides release version numbers, and Actions pinned by digest. A major now waits for dashboard approval rather than opening a pull request nobody asked for. The TypeScript 7 hold survives as allowedVersions "<7" — openapi-ts still dies at import time on the reshaped compiler API — and the note that nothing in CI exercises release.yml moves onto the Actions rule. The title lint skipped dependabot[bot] because its subjects were capitalised unpredictably and could not be edited. The same holds for renovate[bot], whose titles it rewrites on each run, so the exclusion follows the bot.
The analysis builds the client to scan it, and the extractor refuses a
compiler it does not know:
Kotlin version 2.4.20 is too recent. CodeQL currently supports versions
below 2.4.20
Dependabot's 2.4.20 bump therefore cannot go green in either client. The hold
sits next to the TypeScript 7 one, for the same reason and with the same
instruction: lift it once the tool supports the version.
Merged
github-actions Bot
added a commit
that referenced
this pull request
Sep 16, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>1.0.6</summary> ## [1.0.6](v1.0.5...v1.0.6) (2026-09-16) ### Build and Dependencies * **deps:** renovate replaces dependabot here too ([#44](#44)) ([bf1fdc4](bf1fdc4)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ESA-Blueshell/websitemoved from Dependabot to Renovate, and the Mend app is installed across this organisation, so this repository is already in its scope — it just has no configuration of its own. Two bots raising pull requests against the same manifests would fight over the same lines, so this is a replacement rather than an addition.What this achieves
One bot for the three ecosystems this repository actually has — the spec pipeline, the TypeScript client, the Kotlin client — plus the Actions pins, on one weekly schedule with one dashboard listing whatever is behind.
How
renovate.jsonmirrors the Dependabot configuration it replaces wherever the two overlap: a weekly run, a seven-day cooldown before a freshly published release is proposed, and minor and patch folded into one grouped pull request per ecosystem.semanticCommitTypeisbuild, so the titles keep thebuild(deps)prefix release-please already sorts into "Build and Dependencies".tools/stays in its own group for the reason the old comment gave: it decides release version numbers, so its updates deserve review on their own rather than riding along with the client's.A major now waits for dashboard approval instead of opening a pull request nobody asked for. The TypeScript 7 hold survives as
allowedVersions: "<7"— openapi-ts still dies at import time on the reshaped compiler API, and the reason travels with the rule.Actions keep
pinDigests, so the SHA and its version comment move together. The note aboutrelease.ymlnever running in CI moves into that rule, where the next person to approve an Actions major will read it.Not in scope
The open Dependabot pull requests on this repository. Renovate raises its own equivalents on its first run; these can be merged or closed by hand.
Verification
renovate-config-validator renovate.jsonpasses. The three stale references to Dependabot — inpr-title.yml,SECURITY.mdanddocs/versioning.md— are updated to match; the title lint's bot exclusion now namesrenovate[bot], which is the one that changes behaviour rather than wording.