[PR #117] [MERGED] [ci] Teach Renovate to merge the safe categories itself #124

New issue

Closed

opened 2026-10-13 19:47:38 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:47:38 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/117
Author: @Glitchy-Sheep
Created: 8/8/2026
Status: ✅ Merged
Merged: 8/8/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: ci/renovate-tuning

📝 Commits (2)

0e1b1ad ci: 💚 Teach Renovate to merge the safe categories itself
382c675 docs: 📝 Add a developer note on working with Renovate

📊 Changes

3 files changed (+108 additions, -21 deletions)

View changed files

➖ .github/renovate.json (+0 -21)
➕ .github/renovate.json5 (+78 -0)
➕ docs/concepts/renovate.md (+30 -0)

📄 Description

Summary

The bot showed every update as raw noise and decided nothing: security fixes sat unmerged for months. Now it merges the safe categories on green CI, and majors appear only when a human ticks their checkbox.

Problem

The old config was almost empty (config:recommended + a Saturday schedule), so every update became a notification for a human
Security PRs waited months for a manual merge
group:allNonMajor bundled unrelated bumps: one red member (a ruff rule drift) blocked the whole batch
The yt-dlp range was capped by year, while upstream fixes YouTube weekly

Fix

Automerge on green CI for: dev tools (grouped), GitHub Actions, lockfile-only bumps, and security fixes (created immediately, ignoring the schedule)
User-facing range changes still wait for a human - except yt-dlp, whose range now widens instead of getting capped
Majors don't even open a PR until approved via a dashboard checkbox
In-range releases move only poetry.lock (rangeStrategy: update-lockfile)
The config is renovate.json5 with an inline comment on every choice, validated with renovate-config-validator
A developer note in docs/concepts/renovate.md: what merges itself, what waits, and the day-to-day moves

Before / After

Before: every update, big or trivial, was a notification; five security PRs sat red on the changelog gate since February.

After: the human sees a handful of decisions per year - majors by checkbox and user-facing range changes; the rest merges itself after the four CI jobs pass.

Notes

The safety chain assumes the branch ruleset requires the four CI jobs - a repo-settings follow-up right after this merge
Automerge lands on the bot's next visit after checks pass (platformAutomerge stays off, no repo auto-merge setting needed)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/117 **Author:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Created:** 8/8/2026 **Status:** ✅ Merged **Merged:** 8/8/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `ci/renovate-tuning` --- ### 📝 Commits (2) - [`0e1b1ad`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/0e1b1ade58fd18c949d6d0b809717da9398a0776) ci: :green_heart: Teach Renovate to merge the safe categories itself - [`382c675`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/382c67509a6c904676638c4084e7205cf13a5900) docs: :memo: Add a developer note on working with Renovate ### 📊 Changes **3 files changed** (+108 additions, -21 deletions) <details> <summary>View changed files</summary> ➖ `.github/renovate.json` (+0 -21) ➕ `.github/renovate.json5` (+78 -0) ➕ `docs/concepts/renovate.md` (+30 -0) </details> ### 📄 Description ## Summary The bot showed every update as raw noise and decided nothing: security fixes sat unmerged for months. Now it merges the safe categories on green CI, and majors appear only when a human ticks their checkbox. ## Problem - The old config was almost empty (`config:recommended` + a Saturday schedule), so every update became a notification for a human - Security PRs waited months for a manual merge - `group:allNonMajor` bundled unrelated bumps: one red member (a ruff rule drift) blocked the whole batch - The yt-dlp range was capped by year, while upstream fixes YouTube weekly ## Fix - Automerge on green CI for: dev tools (grouped), GitHub Actions, lockfile-only bumps, and security fixes (created immediately, ignoring the schedule) - User-facing range changes still wait for a human - except `yt-dlp`, whose range now widens instead of getting capped - Majors don't even open a PR until approved via a dashboard checkbox - In-range releases move only `poetry.lock` (`rangeStrategy: update-lockfile`) - The config is `renovate.json5` with an inline comment on every choice, validated with `renovate-config-validator` - A developer note in `docs/concepts/renovate.md`: what merges itself, what waits, and the day-to-day moves ## Before / After **Before:** every update, big or trivial, was a notification; five security PRs sat red on the changelog gate since February. **After:** the human sees a handful of decisions per year - majors by checkbox and user-facing range changes; the rest merges itself after the four CI jobs pass. ## Notes - The safety chain assumes the branch ruleset requires the four CI jobs - a repo-settings follow-up right after this merge - Automerge lands on the bot's next visit after checks pass (`platformAutomerge` stays off, no repo auto-merge setting needed) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 19:47:38 +00:00