From 396504089476edfba976119d7ecd8231d1ffe51c Mon Sep 17 00:00:00 2001 From: chicoxyzzy Date: Fri, 21 Aug 2026 02:20:17 +0200 Subject: [PATCH] ci: switch dependency automation from Renovate to Dependabot Renovate's config was dormant (the app was never installed), so nothing acted on security alerts. Switch to native Dependabot: - Add .github/dependabot.yml for npm + github-actions, grouped, weekly, with conventional-commit prefixes (fix(deps) for runtime bumps so release-please cuts a patch; ci/chore for actions and dev-deps). - Remove the unused renovate.json to avoid dual tooling. - Extend the dist-rebuild workflow to also fire on dependabot[bot] PRs, reading the app id from either the Actions variable or the Dependabot secret store (Dependabot has no variables store). Dependabot alerts + security updates are enabled at the repo level, so advisories now open PRs automatically instead of sitting idle. --- .github/dependabot.yml | 40 +++++++++++++++++++++++++++ .github/workflows/rebuild-dist.yml | 24 +++++++++++----- renovate.json | 44 ------------------------------ 3 files changed, 57 insertions(+), 51 deletions(-) create mode 100644 .github/dependabot.yml delete mode 100644 renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..771d8ddd --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,40 @@ +version: 2 +updates: + # GitHub Actions used in workflows (all SHA-pinned; Dependabot rewrites + # the SHA and the trailing version comment together). + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + groups: + actions: + patterns: ['*'] + commit-message: + # Action bumps don't change the published action → no release. + prefix: ci + include: scope + labels: [dependencies, ci] + + # npm deps. Runtime (@actions/*) bumps can change the committed dist/ + # bundle; the rebuild-dist workflow regenerates it on the PR. Dev-tool + # bumps (esbuild, typescript, @types) usually don't. + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + groups: + actions-toolkit: + patterns: ['@actions/*'] + dev-dependencies: + dependency-type: development + commit-message: + # `fix(deps):` so a runtime bump cuts a patch release; dev-dep bumps + # get `chore(deps-dev):` (hidden by release-please). + prefix: fix + prefix-development: chore + include: scope + labels: [dependencies] diff --git a/.github/workflows/rebuild-dist.yml b/.github/workflows/rebuild-dist.yml index 4425b407..6592ed91 100644 --- a/.github/workflows/rebuild-dist.yml +++ b/.github/workflows/rebuild-dist.yml @@ -1,9 +1,17 @@ name: rebuild-dist -# When Renovate bumps a bundled dependency, the committed dist/ goes stale -# and the dist-drift gate in `test` fails. Renovate can't run the build -# itself, so this workflow rebuilds dist/ on Renovate's PRs and pushes the +# When a bot bumps a bundled dependency, the committed dist/ goes stale +# and the dist-drift gate in `test` fails. The bot can't run the build +# itself, so this workflow rebuilds dist/ on its PR and pushes the # regenerated bundle back onto the PR branch. +# +# Works out of the box for Renovate (its PRs can read Actions secrets). +# For Dependabot, GitHub runs the PR with a read-only token and the +# *Dependabot* secret store, not the Actions one — so the app-token step +# only works once RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are also +# added under Settings → Secrets and variables → Dependabot. Until then, +# a dist-changing Dependabot PR needs a manual `npm ci && npm run build` +# commit (rare: only @actions/* runtime bumps change the bundle). on: pull_request: @@ -22,9 +30,9 @@ concurrency: jobs: rebuild: name: Rebuild committed bundle - # Only act on Renovate's own PRs to avoid pushing to forks or arbitrary - # contributor branches. - if: ${{ github.actor == 'renovate[bot]' }} + # Only act on trusted bot PRs (in-repo branches), never forks or + # arbitrary contributor branches. + if: ${{ github.actor == 'renovate[bot]' || github.actor == 'dependabot[bot]' }} runs-on: ubuntu-latest permissions: contents: write @@ -37,7 +45,9 @@ jobs: id: app-token uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: - app-id: ${{ vars.RELEASE_APP_ID }} + # Renovate/Actions runs read the variable; Dependabot runs have + # no variables store, so fall back to the Dependabot secret. + app-id: ${{ vars.RELEASE_APP_ID || secrets.RELEASE_APP_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - name: Check out PR branch uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 diff --git a/renovate.json b/renovate.json deleted file mode 100644 index 9675ea2f..00000000 --- a/renovate.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:recommended", - ":semanticCommits", - ":dependencyDashboard" - ], - "labels": ["dependencies"], - "schedule": ["before 5am on monday"], - "rangeStrategy": "bump", - "lockFileMaintenance": { - "enabled": true, - "schedule": ["before 5am on the first day of the month"] - }, - "packageRules": [ - { - "description": "Group all @actions/* runtime deps together", - "matchPackageNames": ["@actions/**"], - "groupName": "actions toolkit" - }, - { - "description": "Group GitHub Actions workflow updates", - "matchManagers": ["github-actions"], - "groupName": "github actions", - "pinDigests": true - }, - { - "description": "Auto-merge non-major dev dependency updates after CI passes", - "matchDepTypes": ["devDependencies"], - "matchUpdateTypes": ["patch", "minor"], - "automerge": true - }, - { - "description": "Hold tsgo at preview track; review majors by hand", - "matchPackageNames": ["@typescript/native-preview"], - "matchUpdateTypes": ["major"], - "enabled": false - } - ], - "vulnerabilityAlerts": { - "labels": ["security"], - "automerge": true - } -}