Adopt the org Renovate preset - #86
Merged
Merged
Conversation
Eight settings here were identical to the three sibling configs - timezone, the Monday batch, automerge:false, the PR caps, dependencyDashboard, osvVulnerabilityAlerts, the security schedule bypass, and config:recommended plus pinGitHubActionDigests - with nothing keeping them in sync. They now come from FactoryGameFan/.github. The duplicate "github actions" grouping rule goes too; the preset has it. What stays is what is true here and nowhere else: the npm-not-pnpm minimumReleaseAge, the 25-hour security floor, git-submodules disabled for the three upstream pins, dependencyDashboardTitle, and every NuGet and npm hold. lockFileMaintenance especially stays ON here - it is the one place this config deliberately departs from the sibling pnpm repo, and it is the mechanism that closed the fast-uri, dompurify and brace-expansion advisories in #30. Comments were kept for settings that moved. The automerge prerequisites in particular are repo-specific - four required checks, and the paths-filtered fifth that must NOT be required - so the reasoning stays even though the flag now comes from the preset. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqNvPFuFeotbk9TsngcNvh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of standardising Renovate across the org, alongside the new
FactoryGameFan/.githubpreset repo.What moved out
Eight settings identical to the three sibling configs:
timezone, the Monday batch,automerge: false,prConcurrentLimit/prHourlyLimit,dependencyDashboard,osvVulnerabilityAlerts, thevulnerabilityAlertsschedule bypass, andconfig:recommended+helpers:pinGitHubActionDigests. The duplicategithub actionsgrouping rule goes too - the preset carries it verbatim.What stayed, and why
minimumReleaseAge: "3 days"- a judgement call here, not a pnpm-derived constraint, and the comment says so.lockFileMaintenance: { enabled: true }- the one place this config deliberately departs from the sibling pnpm repo. It is the mechanism that closed the fast-uri / dompurify / brace-expansion advisories in Update front-end dependencies (patch/minor) and clear all npm advisories #30, none of which had a direct-dependency bump available. FactorioMapWebUI pins it off for a measured pnpm-specific reason. Both are correct, which is why neither belongs in a shared preset.git-submodules: { enabled: false }for the three upstream pins,dependencyDashboardTitle, and every NuGet and npm hold.Comments kept for settings that moved
The
automergeprerequisites are repo-specific - four separate required checks, plus the paths-filtered fifth fromdeploy-cloudflare.ymlthat must not be required or it blocks merges permanently. That reasoning stays even though the flag now comes from the preset. Same for the note that digest updates carry no release timestamp, sorenovate/stability-dayssits PENDING forever on re-pin PRs.Verification
renovate-config-validator(renovate 44.32.2) passes, as a repo config and standalone.vulnerabilityAlertsdeep-merges so the preset's schedule override survives alongside this repo's 25-hour floor.github actionsgrouping is a pure consolidation here.FactoryGameFan/.githubticked in the Renovate app installation before this takes effect.🤖 Generated with Claude Code
https://claude.ai/code/session_01FqNvPFuFeotbk9TsngcNvh