From 456bfafc92123b657665696ea0d37f32af7a5d6c Mon Sep 17 00:00:00 2001 From: Matt Richardson Date: Mon, 27 Jul 2026 09:45:09 +1000 Subject: [PATCH 1/3] Migrate from Dependabot to Renovate Migrates dependency updates from Dependabot to the self-hosted Renovate setup used across team-builds repositories. Part of the team-builds Dependabot -> Renovate migration (DPT-3076). --- .github/dependabot.yml | 10 -------- .github/workflows/dependabot-automerge.yml | 27 ------------------- .github/workflows/renovate-approve-pr.yaml | 27 +++++++++++++++++++ .github/workflows/renovate.yaml | 30 ++++++++++++++++++++++ renovate.json | 16 ++++++++++++ 5 files changed, 73 insertions(+), 37 deletions(-) delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/dependabot-automerge.yml create mode 100644 .github/workflows/renovate-approve-pr.yaml create mode 100644 .github/workflows/renovate.yaml create mode 100644 renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 95eb3f2..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,10 +0,0 @@ -version: 2 - -updates: - - package-ecosystem: "nuget" - directory: "/source" - schedule: - interval: "daily" - open-pull-requests-limit: 1 - cooldown: - default-days: 3 diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml deleted file mode 100644 index 99bf071..0000000 --- a/.github/workflows/dependabot-automerge.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: "Dependabot Approve and Auto Merge" - -on: - pull_request: - branches: [ main ] - -# Increase the access for the GITHUB_TOKEN -permissions: - # This Allows the GITHUB_TOKEN to approve pull requests - pull-requests: write - # This Allows the GITHUB_TOKEN to auto merge pull requests - contents: write - -env: - PR_URL: ${{github.event.pull_request.html_url}} - # By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} - -jobs: - dependabot: - runs-on: ubuntu-latest - if: ${{ (github.actor == 'dependabot[bot]') && (contains(github.head_ref, 'dependabot')) }} - steps: - - name: Approve a dependabot created PR - run: gh pr review --approve "$PR_URL" - - name: Enable auto-merge for Dependabot PRs - run: gh pr merge --auto --squash "$PR_URL" diff --git a/.github/workflows/renovate-approve-pr.yaml b/.github/workflows/renovate-approve-pr.yaml new file mode 100644 index 0000000..0d0b6df --- /dev/null +++ b/.github/workflows/renovate-approve-pr.yaml @@ -0,0 +1,27 @@ +name: "Approve and auto-merge Renovate Pull Requests with automerge label" + +on: + pull_request: + branches: + - main + +env: + PR_URL: ${{github.event.pull_request.html_url}} + # By default, the GitHub Actions workflow will get a GITHUB_TOKEN with read-only permissions. + GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} + +permissions: + # This Allows the GITHUB_TOKEN to approve pull requests + pull-requests: write + # This Allows the GITHUB_TOKEN to auto merge pull requests + contents: write + +jobs: + approve-pr: + runs-on: ubuntu-latest + if: ${{ (github.actor == 'team-builds-bot') && contains(github.event.pull_request.labels.*.name, 'autoapprove') }} + steps: + - name: Approve a renovate PR with the 'autoapprove' label + run: gh pr review --approve "$PR_URL" + - name: Enable auto-merge for the PR + run: gh pr merge --auto --squash "$PR_URL" diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml new file mode 100644 index 0000000..29079f0 --- /dev/null +++ b/.github/workflows/renovate.yaml @@ -0,0 +1,30 @@ +name: Renovate Update dependencies +on: + schedule: + - cron: "20 10 * * *" + pull_request: # limit this to run on PRs that modify Renovate config files + paths: + - ".github/workflows/renovate.yaml" + - "renovate.json" + push: + branches: + - main + paths: + - ".github/workflows/renovate.yaml" + - "renovate.json" +jobs: + renovate: + name: Check Dependencies + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Run Renovate + uses: renovatebot/github-action@v46.1.19 + with: + token: ${{ secrets.RENOVATE_GITHUB_TOKEN }} + configurationFile: renovate.json + env: + RENOVATE_REPOSITORIES: ${{ github.repository }} + LOG_LEVEL: ${{ github.ref_name == 'main' && 'INFO' || 'DEBUG' }} + RENOVATE_BASE_BRANCHES: ${{ github.event.pull_request.head.ref || 'main' }} diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..b8756a2 --- /dev/null +++ b/renovate.json @@ -0,0 +1,16 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "labels": [ + "dependencies", + "autoapprove", + "{{datasource}}" + ], + "rebaseWhen": "conflicted", + "dependencyDashboard": true, + "dependencyDashboardTitle": "Renovate Dependency Dashboard", + "dependencyDashboardHeader": "This dashboard manages dependencies for the default branch.", + "dependencyDashboardOSVVulnerabilitySummary": "all", + "assigneesFromCodeOwners": true, + "prConcurrentLimit": 1, + "minimumReleaseAge": "3 days" +} From 4844d5f89b5271e4780390901e5651233a3ff15e Mon Sep 17 00:00:00 2001 From: Matt Richardson Date: Mon, 27 Jul 2026 10:22:03 +1000 Subject: [PATCH 2/3] Fix RENOVATE_BASE_BRANCHES targeting the PR's own head ref Renovate treats RENOVATE_BASE_BRANCHES as a branch to reconcile, including deleting it if Renovate considers it an orphan. Setting it to the triggering PR's own head ref is destructive whenever that branch happens to fall under Renovate's own branchPrefix (default "renovate/") -- which is exactly what happened to this migration's branch. Always target main. --- .github/workflows/renovate.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index 29079f0..c1f6cff 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -27,4 +27,4 @@ jobs: env: RENOVATE_REPOSITORIES: ${{ github.repository }} LOG_LEVEL: ${{ github.ref_name == 'main' && 'INFO' || 'DEBUG' }} - RENOVATE_BASE_BRANCHES: ${{ github.event.pull_request.head.ref || 'main' }} + RENOVATE_BASE_BRANCHES: main From e216c70aa0d4c704b95b7a16858356f8d003b847 Mon Sep 17 00:00:00 2001 From: Matt Richardson Date: Mon, 27 Jul 2026 11:03:34 +1000 Subject: [PATCH 3/3] Remove dependency dashboard from renovate.json Team preference is no dependency dashboard on any of these repos, regardless of whether GitHub Issues is enabled. --- renovate.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/renovate.json b/renovate.json index b8756a2..894d5c1 100644 --- a/renovate.json +++ b/renovate.json @@ -6,10 +6,6 @@ "{{datasource}}" ], "rebaseWhen": "conflicted", - "dependencyDashboard": true, - "dependencyDashboardTitle": "Renovate Dependency Dashboard", - "dependencyDashboardHeader": "This dashboard manages dependencies for the default branch.", - "dependencyDashboardOSVVulnerabilitySummary": "all", "assigneesFromCodeOwners": true, "prConcurrentLimit": 1, "minimumReleaseAge": "3 days"