From f146bcd591bb54a9621ce5fa2390ff30f46fd700 Mon Sep 17 00:00:00 2001 From: Matthias Linhuber Date: Fri, 28 Aug 2026 03:08:43 +0200 Subject: [PATCH] fix(renovate): process our forked repositories EduIDE, EduIDE-Cloud and EduIDE-Helm show as disabled in the Mend portal. They are GitHub forks, and Renovate skips forks by default when running in autodiscover mode, which is how the hosted app runs. A valid renovate.json does not override that - forkProcessing does. These three are actively developed products rather than upstream-tracking mirrors, so they should be managed like any other repo. Setting this org-wide is safe only because the Renovate app installation is scoped to a selected repository list. If it were widened to "All repositories" this would also start processing genuine upstream mirrors such as theia (a 188 MB fork of eclipse-theia/theia). Noted in the preset description and in renovate/README.md. The README also now records the second, unrelated reason a repo can show as disabled: Renovate treats a human closing a "Configure Renovate" PR as declining, and stores that in Mend's database rather than in the repo, so no config change clears it. EduIDE-deployment and EduIDE-Landing-Page were both declined that way before this rollout and need re-enabling in the portal. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QLGHEpzx7D9NYHx4fCmHa9 --- renovate-config.json | 3 +++ renovate/README.md | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/renovate-config.json b/renovate-config.json index caa8a40..35b0a6a 100644 --- a/renovate-config.json +++ b/renovate-config.json @@ -4,6 +4,7 @@ "EduIDE org-wide Renovate policy. Single source of truth for every repo.", "Consume it with: { \"extends\": [\"local>EduIDE/.github:renovate-config\"] }", "Policy: no automerge anywhere. Security fixes raised immediately, everything else batched Monday morning.", + "forkProcessing is enabled because EduIDE, EduIDE-Cloud and EduIDE-Helm are GitHub forks, and Renovate skips forks by default in autodiscover mode - which is how the Mend hosted app runs. They are actively developed products, not upstream mirrors. This is safe org-wide only because the app installation is scoped to a selected repository list.", "See renovate/README.md in this repo for how to change or test this file." ], @@ -46,6 +47,8 @@ "updatePinnedDependencies": true, "configMigration": true, + "forkProcessing": "enabled", + "osvVulnerabilityAlerts": true, "vulnerabilityAlerts": { "description": "Security fixes bypass the Monday schedule and the release-age quarantine. Rate limits are bypassed unconditionally by Renovate itself.", diff --git a/renovate/README.md b/renovate/README.md index a482abe..d3be383 100644 --- a/renovate/README.md +++ b/renovate/README.md @@ -117,6 +117,26 @@ tracked and must be bumped by hand. The only way to automate it today is a `customDatasources` entry against the open-vsx API, which is still flagged experimental upstream; not worth the fragility for two pins. Revisit if open-vsx support lands. +## A repo shows "disabled" in the Mend portal + +Two different causes, and only one of them is fixable in git. + +**It is a fork.** Renovate skips forked repositories by default in autodiscover mode, which is +how the hosted app runs - a valid `renovate.json` does not override this. `EduIDE`, +`EduIDE-Cloud` and `EduIDE-Helm` are forks. The preset sets `"forkProcessing": "enabled"` to +cover them. That is safe only while the app installation is scoped to a **selected** +repository list; if someone widens it to "All repositories", this setting would also start +processing genuine upstream mirrors like `theia`. + +**Someone closed its onboarding PR.** Renovate reads a human closing a "Configure Renovate" +PR as declining, and records that against the repo in the Mend portal. This lives in Mend's +database, not in the repo, so **no config change clears it** - re-enable the repo at +. `EduIDE-deployment` (#40) and +`EduIDE-Landing-Page` (#4) were both declined this way before the current rollout. + +Note that Renovate *auto*-closing an onboarding PR is different and harmless - it does that +when it finds a repo is already onboarded, and it does not disable anything. + ## Things that are deliberate, not oversights - **`pinDigests` is off.** Several workflows call `ls1intum/.github/...@feature/...`, which