Replace dependabot.yml with renovate.json - #999
Merged
Conversation
Co-authored-by: dthaler <6547784+dthaler@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Replace dependabot configuration with renovate.json
Replace dependabot.yml with renovate.json
Mar 18, 2026
This comment was marked as resolved.
This comment was marked as resolved.
…esolved) Co-authored-by: dthaler <6547784+dthaler@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates automated dependency updates from GitHub Dependabot to Renovate (installed org-wide) by removing the repository’s Dependabot config and introducing an equivalent renovate.json configuration.
Changes:
- Remove
.github/dependabot.ymlto stop Dependabot-driven updates. - Add
renovate.jsondefining schedules, grouping rules, and allowed/ignored version ranges for the repo’s dependency ecosystems.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
renovate.json |
Adds Renovate configuration for update scheduling, grouping, and version constraints. |
.github/dependabot.yml |
Deletes the old Dependabot configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
dthaler
approved these changes
Mar 29, 2026
The `issue_comment` trigger existed so that commenting
`/refresh-heroku-status` on a PR would re-post the Heroku status checks.
It never worked, and it fired on every comment in the repo.
The `deployment-status` job's guard read:
github.event.deployment_status.state != 'pending' || (...)
On an `issue_comment` event that field is empty, so `'' != 'pending'` is
true and the job ran regardless of the comment body. It then built the
API route from `github.event.deployment.sha`, which is likewise empty on
a comment event, producing `POST /repos/orcasound/orcasite/statuses/`
and a 404. Across the last 200 runs, all 144 `issue_comment` runs failed
and all 56 `deployment_status` runs succeeded.
The feature is not salvageable as written: a comment payload carries no
deployment context to forward. Drop the trigger and both
`/refresh-heroku-status` clauses, leaving the working `deployment_status`
path alone.
Also bump the pinned actions, which were behind and triggering Node 20
deprecation warnings:
- step-security/harden-runner v2.12.2 -> v2.20.0
- octokit/request-action v2.4.0 -> v3.0.0
- jtalk/url-health-check-action v4 -> v5
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Aef29UGmzgktdmpr9tFiCz
rainhead
previously approved these changes
Jul 29, 2026
…ce-dependabot-with-renovate
rainhead
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renovate is installed at the org level and should replace Dependabot for dependency update automation. This swaps
.github/dependabot.ymlforrenovate.jsonat the repo root with equivalent configuration.Changes
.github/dependabot.ymlrenovate.jsonwith parity across all four ecosystems:github-actionsactionsgroup, max 3 PRsdockerfileallowedVersionsregex (more future-proof than listing specific versions)mix(server/)npm(ui/)frameworks,styles,requests,map,player,code-style,miscgroups;typescript,phoenix,@types/nodeget individual PRsignoreblocks to RenovateallowedVersionssemver ranges (eslint-plugin-unused-imports 4.0–4.1, @typescript-eslint/eslint-plugin 8.0–8.9)21.x,23.x, …) to a regex that auto-covers future odd releases:"/^([0-9]*[02468])\.(\d+)/"Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.