From 1fc1efbbd00b6db02e017f10403f517faca406a2 Mon Sep 17 00:00:00 2001 From: Matt Richardson Date: Mon, 27 Jul 2026 09:46:14 +1000 Subject: [PATCH 1/3] Migrate from Dependabot to Renovate Migrates dependency updates from Dependabot to the self-hosted Renovate setup used across team-builds repositories. Part of the team-builds Dependabot -> Renovate migration (DPT-3076). --- .github/dependabot.yml | 9 ------- .github/workflows/dependabot-automerge.yml | 27 ------------------- .github/workflows/renovate-approve-pr.yaml | 27 +++++++++++++++++++ .github/workflows/renovate.yaml | 30 ++++++++++++++++++++++ renovate.json | 16 ++++++++++++ 5 files changed, 73 insertions(+), 36 deletions(-) delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/dependabot-automerge.yml create mode 100644 .github/workflows/renovate-approve-pr.yaml create mode 100644 .github/workflows/renovate.yaml create mode 100644 renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 9c7d63f..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,9 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "nuget" # See documentation for possible values - directory: "/source/" # Location of package manifests - schedule: - interval: "daily" - open-pull-requests-limit: 1 - cooldown: - default-days: 3 diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml deleted file mode 100644 index 99bf071..0000000 --- a/.github/workflows/dependabot-automerge.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: "Dependabot Approve and Auto Merge" - -on: - pull_request: - branches: [ main ] - -# Increase the access for the GITHUB_TOKEN -permissions: - # This Allows the GITHUB_TOKEN to approve pull requests - pull-requests: write - # This Allows the GITHUB_TOKEN to auto merge pull requests - contents: write - -env: - PR_URL: ${{github.event.pull_request.html_url}} - # By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} - -jobs: - dependabot: - runs-on: ubuntu-latest - if: ${{ (github.actor == 'dependabot[bot]') && (contains(github.head_ref, 'dependabot')) }} - steps: - - name: Approve a dependabot created PR - run: gh pr review --approve "$PR_URL" - - name: Enable auto-merge for Dependabot PRs - run: gh pr merge --auto --squash "$PR_URL" diff --git a/.github/workflows/renovate-approve-pr.yaml b/.github/workflows/renovate-approve-pr.yaml new file mode 100644 index 0000000..0d0b6df --- /dev/null +++ b/.github/workflows/renovate-approve-pr.yaml @@ -0,0 +1,27 @@ +name: "Approve and auto-merge Renovate Pull Requests with automerge label" + +on: + pull_request: + branches: + - main + +env: + PR_URL: ${{github.event.pull_request.html_url}} + # By default, the GitHub Actions workflow will get a GITHUB_TOKEN with read-only permissions. + GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} + +permissions: + # This Allows the GITHUB_TOKEN to approve pull requests + pull-requests: write + # This Allows the GITHUB_TOKEN to auto merge pull requests + contents: write + +jobs: + approve-pr: + runs-on: ubuntu-latest + if: ${{ (github.actor == 'team-builds-bot') && contains(github.event.pull_request.labels.*.name, 'autoapprove') }} + steps: + - name: Approve a renovate PR with the 'autoapprove' label + run: gh pr review --approve "$PR_URL" + - name: Enable auto-merge for the PR + run: gh pr merge --auto --squash "$PR_URL" diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml new file mode 100644 index 0000000..29079f0 --- /dev/null +++ b/.github/workflows/renovate.yaml @@ -0,0 +1,30 @@ +name: Renovate Update dependencies +on: + schedule: + - cron: "20 10 * * *" + pull_request: # limit this to run on PRs that modify Renovate config files + paths: + - ".github/workflows/renovate.yaml" + - "renovate.json" + push: + branches: + - main + paths: + - ".github/workflows/renovate.yaml" + - "renovate.json" +jobs: + renovate: + name: Check Dependencies + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Run Renovate + uses: renovatebot/github-action@v46.1.19 + with: + token: ${{ secrets.RENOVATE_GITHUB_TOKEN }} + configurationFile: renovate.json + env: + RENOVATE_REPOSITORIES: ${{ github.repository }} + LOG_LEVEL: ${{ github.ref_name == 'main' && 'INFO' || 'DEBUG' }} + RENOVATE_BASE_BRANCHES: ${{ github.event.pull_request.head.ref || 'main' }} diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..b8756a2 --- /dev/null +++ b/renovate.json @@ -0,0 +1,16 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "labels": [ + "dependencies", + "autoapprove", + "{{datasource}}" + ], + "rebaseWhen": "conflicted", + "dependencyDashboard": true, + "dependencyDashboardTitle": "Renovate Dependency Dashboard", + "dependencyDashboardHeader": "This dashboard manages dependencies for the default branch.", + "dependencyDashboardOSVVulnerabilitySummary": "all", + "assigneesFromCodeOwners": true, + "prConcurrentLimit": 1, + "minimumReleaseAge": "3 days" +} From 9190730532963947daa92ad05002b9c628a0f81a Mon Sep 17 00:00:00 2001 From: Matt Richardson Date: Mon, 27 Jul 2026 10:23:24 +1000 Subject: [PATCH 2/3] Fix RENOVATE_BASE_BRANCHES targeting the PR's own head ref Renovate treats RENOVATE_BASE_BRANCHES as a branch to reconcile, including deleting it if Renovate considers it an orphan. Setting it to the triggering PR's own head ref is destructive whenever that branch happens to fall under Renovate's own branchPrefix (default "renovate/") -- which is exactly what happened to this migration's branch. Always target main. --- .github/workflows/renovate.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index 29079f0..c1f6cff 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -27,4 +27,4 @@ jobs: env: RENOVATE_REPOSITORIES: ${{ github.repository }} LOG_LEVEL: ${{ github.ref_name == 'main' && 'INFO' || 'DEBUG' }} - RENOVATE_BASE_BRANCHES: ${{ github.event.pull_request.head.ref || 'main' }} + RENOVATE_BASE_BRANCHES: main From b98af1817d1c9c9d181e08d3f30166d13b59bca0 Mon Sep 17 00:00:00 2001 From: Matt Richardson Date: Mon, 27 Jul 2026 11:03:52 +1000 Subject: [PATCH 3/3] Remove dependency dashboard from renovate.json Team preference is no dependency dashboard on any of these repos, regardless of whether GitHub Issues is enabled. --- renovate.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/renovate.json b/renovate.json index b8756a2..894d5c1 100644 --- a/renovate.json +++ b/renovate.json @@ -6,10 +6,6 @@ "{{datasource}}" ], "rebaseWhen": "conflicted", - "dependencyDashboard": true, - "dependencyDashboardTitle": "Renovate Dependency Dashboard", - "dependencyDashboardHeader": "This dashboard manages dependencies for the default branch.", - "dependencyDashboardOSVVulnerabilitySummary": "all", "assigneesFromCodeOwners": true, "prConcurrentLimit": 1, "minimumReleaseAge": "3 days"