From 2df60b39d62980537cdefcdd6f473607c7698707 Mon Sep 17 00:00:00 2001 From: Sal Date: Sun, 30 Aug 2026 03:23:06 +0100 Subject: [PATCH] fix(deps): deduplicate GitHub Actions updates Use Renovate's weekly preset and highest-release bucketing for GitHub Actions. Keep non-major action updates grouped while preserving isolated, approval-gated majors, and avoid broad manager-wide dependency groups. Refs z-shell/.github#452 Refs z-shell/F-Sy-H#111 --- renovate-config.json | 10 +++++----- runbooks/dependency-management.md | 12 ++++++++++++ 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/renovate-config.json b/renovate-config.json index 05a0a103b..41d497109 100644 --- a/renovate-config.json +++ b/renovate-config.json @@ -4,10 +4,11 @@ "extends": [ "config:best-practices", ":semanticCommits", + ":approveMajorUpdates", + "schedule:weekly", ":disableVulnerabilityAlerts" ], "timezone": "UTC", - "schedule": ["* 0-4 * * 1"], "minimumReleaseAge": "3 days", "dependencyDashboard": true, "dependencyDashboardTitle": "Dependency Dashboard", @@ -17,10 +18,9 @@ "automerge": false, "packageRules": [ { - "description": "Group non-major updates by package manager", - "matchUpdateTypes": ["minor", "patch", "pin", "digest"], - "groupName": "{{manager}} non-major updates", - "groupSlug": "{{manager}}-non-major" + "description": "Propose only the highest available GitHub Actions release", + "matchManagers": ["github-actions"], + "separateMajorMinor": false }, { "description": "Group non-major GitHub Actions updates", diff --git a/runbooks/dependency-management.md b/runbooks/dependency-management.md index 7c7271c6f..78363c570 100644 --- a/runbooks/dependency-management.md +++ b/runbooks/dependency-management.md @@ -54,6 +54,18 @@ also reference it explicitly: } ``` +The organization preset builds on Renovate's `config:best-practices` and weekly +schedule presets. It leaves Renovate's curated monorepo and related-package +groups in place instead of grouping every dependency handled by the same +manager. Broad manager-wide groups make one unrelated failure block all other +updates and make the cause harder to isolate. + +GitHub Actions are the narrow exception. Their non-major updates are grouped to +reduce workflow-only pull request volume, while major updates remain isolated +and require Dependency Dashboard approval. Renovate is configured not to open +parallel major and non-major branches for the same action: when both are +available, it proposes only the highest release. + Repository consumer configuration belongs at `.github/renovate.json`. Renovate also recognizes `renovate.json` at the repository root, but searches that location first and stops after the first match. Never keep both paths; a