[fabong]

Description

Sets up the shared Renovate security flow of algoan/private-actions (renovate-security, pinned to v2.3.0), with the Mend-hosted Renovate app, and replaces the Dependabot version updates.

• renovate.json: Mend Renovate config (npm + github-actions), routine updates grouped weekly (Monday before 6am, Europe/Paris), security fixes at once at the lowest fixing version, weekly lockfile maintenance, Renovate's own automerge off. Security fixes use rangeStrategy: bump (not pin as in the apps): @algoan/pubsub is a published library, an exact pin in its dependencies would be forced on every consumer.
• .github/workflows/renovate-triage.yml, renovate-auto-approve.yml, renovate-automerge.yml: hotfix flow off, ecosystems: npm, Notion sub-team Back.
• test-and-publish.yaml: new Tests job that waits for the Node.js matrix. The matrix check names (test (22.x, 11)) contain a comma, which required_checks (comma-separated) can't hold, and change with every Node.js bump. It is also the check to require in the ruleset.
• .github/dependabot.yml removed, with its old ignore entries (y18n, pino-pretty, ini: obsolete versions). Dependabot alerts stay on, they are a repo setting.
• docs/RENOVATE.md, linked from CONTRIBUTING.md.

flowchart TD
    PR[Renovate PR] --> T[renovate-triage<br/>max CVSS of the advisories fixed in package-lock.json]
    T -->|no advisory| N[auto-approve + 1 human review]
    T -->|CVSS < 4.0| M[needs-review + Notion ticket]
    T -->|CVSS ≥ 4.0| A[automerge + Notion ticket<br/>critical / P1 from 9.0]
    A -->|patch only, Tests + Socket green| MM[squash-merged on master by algoan-merger]
    A -->|minor / major| R[1 human review]
    MM --> P[manual run of Algoan PubSub Test and Publish Workflow<br/>semantic-release]

Loading

After an automerge nothing is published: a merge on master only runs the tests; the fix reaches npm at the next manual run of Algoan PubSub Test and Publish Workflow (semantic-release: fix(deps) gives a patch release).

⚠️ Coherence

• REPO_GHA_PAT is not available to this repository (public; only PUBLIC_REPO_GHA_PAT is). Every workflow checks out the private algoan/private-actions with it: until the org secret is shared with this repo (or another token with read access to private-actions is used), triage, auto-approve and automerge fail at checkout.
• No required approvals nor required checks today (org ruleset: 0 approvals): with the auto-approve, a Renovate PR would need no human review until the ruleset requires 2.
• Public repository: pull_request_target with secrets is fine here, the triage only runs for renovate[bot] PRs and reads the PR head as git objects; the automerge also ignores workflow_runs from forks (a fork can name its branch renovate/*). Workflow logs are public, as are the triage comments.
• The test job has continue-on-error: true: the CI workflow stays green when a test fails. The new Tests job does not rely on it: it reads the conclusion of the latest run of every matrix job (jobs?filter=latest, across attempts) and fails if one of them failed. The manual publish job (needs: test) still runs after failed tests: worth removing continue-on-error in a separate PR.
• Only the npm ecosystem: the root package-lock.json. examples/google-pubsub/package-lock.json is ignored by Renovate (examples/ is in its default ignorePaths; Dependabot didn't cover it either), so the example's dependencies are not updated. No Dockerfile.
• required_checks relies on the new Tests job; if the ruleset lists the matrix jobs instead, they will need updating at each Node.js bump.
• Release model: publish is manual (workflow_dispatch, semantic-release) and never triggered by a merge (push to master only runs the tests), so automerge can't publish blindly.

Before merging

• Allow GitHub Actions to create and approve pull requests (already on)
• Share the org secret REPO_GHA_PAT with this repository (ALGOAN_MERGER_APP_ID, ALGOAN_MERGER_PRIVATE_KEY, NOTION_TOKEN are already available)
• Squash merging allowed
• Default branch ruleset: 2 approvals, dismiss stale approvals on push, required checks Tests and Socket Security: Pull Request Alerts
• algoan-merger app installed (org-wide) and bypass actor in pull requests only mode (org ruleset enforce main branch)
• Dependabot alerts on
• No Mend secret needed (no private registry)

After merging

• The Mend onboarding PR chore: Configure Renovate #810 closes itself
• Close the open Dependabot PR chore(deps-dev): bump ava from 8.3.0 to 8.4.0 #821 (ava 8.4.0) if Dependabot doesn't, Renovate's weekly group takes it over
• Check the first Renovate PRs (weekly group, triage comment on a security PR)
• Disable Dependabot security updates (currently on), so security fixes come from Renovate only

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Repository tooling only (CI and dependency updates), no package change.

🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

[coderabbitai]

Pre-merge checks: 2

Failed checks: 2 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.
Description check		This assessment has not completed. The check will be retried on the next pre-merge check run.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[Copilot]

🟡 Changes recommended

The required test gate can pass despite failing matrix jobs because job-level continue-on-error masks failures, allowing ordinary PRs to merge with failing tests.

1 open issue

• Job-level continue-on-error lets failing tests pass the required check · New

What changed in this PR

Replaces Dependabot version updates with Mend-hosted Renovate and adds CVSS-based security routing through shared actions. Package publishing remains manual.

Changes:

• Configures weekly dependency updates and immediate security fixes at the lowest fixing version.
• Adds security triage, auto-approval, patch-only automerge, and a stable Tests check.
• Documents routing, repository setup, and release behavior.

File	Description
renovate.json	Configures update schedules, grouping, and security-fix behavior.
docs/​RENOVATE.md	Documents security routing, required settings, and manual releases.
CONTRIBUTING.md	Links to the dependency-update guide.
.github/​workflows/​test-and-publish.yaml	Adds the stable Tests matrix aggregation check.
.github/​workflows/​renovate-triage.yml	Adds CVSS scoring, Notion ticketing, and automerge dispatch.
.github/​workflows/​renovate-automerge.yml	Integrates guarded automerging for patch security fixes.
.github/​workflows/​renovate-auto-approve.yml	Adds automatic approval of Renovate commits.
.github/​dependabot.yml	Removes Dependabot version-update configuration.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The attempt-scoped query can let the required Tests check pass despite an unresolved matrix failure or fail after a successful matrix, so it must evaluate the latest result for each matrix job across all attempts.

1 open issue

• Evaluate latest results across all matrix job attempts · New

1 resolved since last review

• Job-level continue-on-error lets failing tests pass the required check

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Privileged approval and bypass merging depend on unavailable private-actions v2.3.0 code, requiring human verification of head/author/check validation, secret access, and required approval and ruleset configuration.

No open issues 🎉

1 resolved since last review

• Evaluate latest results across all matrix job attempts

_{Review effort: Balanced}