Repository navigation
chore: swap Dependabot for Renovate on the shared policy - #64
Conversation
Dependabot's version updates opened 27 pull requests here since July and none merged, while every other datum-cloud repository takes dependency updates from Renovate under the org's shared policy. Renovate had never been onboarded on this repository, so add the standard renovate.json that extends the shared config and remove the Dependabot config. One bot owns dependency pull requests; Dependabot alerts are unaffected. Claude-Session: https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Migration itself is correct: dependabot.yml deleted (no dual-bot conflict), renovate.json extends local>datum-cloud/.github:renovate-config matching the org pattern, JSON is valid, and the description clearly explains the reasoning. One gap: the removed dependabot.yml had repo-specific config (ignore: @backstage/* and a minor/patch grouping rule) that isn't carried over or mentioned as intentionally dropped. Worth confirming the shared preset covers this, or noting it's deliberately deprioritized, before merge.
The Backstage packages move as a set. A release bumps every @backstage/* package to matching versions, and the framework does not support running one at a version the rest are not. Bumping a single package on its own leaves an install that does not resolve. Dependabot handled this by ignoring @backstage/* outright, which also meant no advisory for a Backstage package ever reached anyone. Grouping keeps the packages in lockstep and still lets a security advisory open a pull request, now covering the whole set rather than one member of it. Routine minor and patch updates need no grouping rule here. The shared policy holds them on the dependency dashboard until someone asks, so they open no pull requests to group. Claude-Session: https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
The new commit adds a packageRule grouping @backstage/** into one PR, replacing the old minor-and-patch grouping. The old ignore: @backstage/* is effectively preserved by the shared preset's dependencyDashboardApproval: true, nothing opens without manual approval on the dashboard regardless, so these packages will surface there and land as one grouped PR when approved rather than auto-opening. Gap addressed, good to go.
2 participants
Summary
Two bots were supposed to keep this repository's dependencies current and neither did: Dependabot opened 27 version-update pull requests since July that nobody merged, and Renovate, which every other datum-cloud repository uses, was never onboarded here. This swaps one for the other, so Backstage takes updates under the same shared policy as the rest of the org, listed on a dependency dashboard and opened on request, with security fixes opening on their own. Dependabot alerts keep working; only its pull requests stop. The 27 open Dependabot pull requests were closed under the retirement issue below.
Test plan
Related to https://github.com/datum-cloud/infra/issues/5083
https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq