Current behavior
Currently renovate.json applies lockFileMaintenance only to examples/** projects, not to the root of the repo. This was added by #1735
|
"lockFileMaintenance": { |
|
"enabled": true |
|
}, |
|
"packageRules": [ |
|
{ |
|
"matchUpdateTypes": ["lockFileMaintenance"], |
|
"enabled": false |
|
}, |
|
{ |
|
"matchUpdateTypes": ["lockFileMaintenance"], |
|
"matchFileNames": ["examples/**"], |
|
"enabled": true |
|
}, |
The reason for excluding the root of the repo is that some lockfile updates can cause changes to the built version of the action, and this requires manual intervention, since currently there is no automated way to rebuild the action in a workflow.
The downside is that every vulnerability in the repo root requires a manually created PR in order to remediate, whether or not it would need an action rebuild.
Desired behavior
Allow lockFileMaintenance also on the root of the repo. This may mean that some Renovate PRs will fail in CI if they make a change needing an action rebuild. Those PRs would need to be closed and replaced with a manual PR that includes an action rebuild.
In total this would result in less manual work, as lockFileMaintenance PRs that succeed in CI would only need to be approved, instead of needing to be created manually.
Other
If there is no objection to this, I would submit a PR to make the change to the Renovate config. It would just remove the special handling:
|
{ |
|
"matchUpdateTypes": ["lockFileMaintenance"], |
|
"enabled": false |
|
}, |
|
{ |
|
"matchUpdateTypes": ["lockFileMaintenance"], |
|
"matchFileNames": ["examples/**"], |
|
"enabled": true |
|
}, |
Current behavior
Currently renovate.json applies
lockFileMaintenanceonly toexamples/**projects, not to the root of the repo. This was added by #1735github-action/renovate.json
Lines 23 to 35 in 47646e1
The reason for excluding the root of the repo is that some lockfile updates can cause changes to the built version of the action, and this requires manual intervention, since currently there is no automated way to rebuild the action in a workflow.
The downside is that every vulnerability in the repo root requires a manually created PR in order to remediate, whether or not it would need an action rebuild.
Desired behavior
Allow
lockFileMaintenancealso on the root of the repo. This may mean that some Renovate PRs will fail in CI if they make a change needing an action rebuild. Those PRs would need to be closed and replaced with a manual PR that includes an action rebuild.In total this would result in less manual work, as
lockFileMaintenancePRs that succeed in CI would only need to be approved, instead of needing to be created manually.Other
If there is no objection to this, I would submit a PR to make the change to the Renovate config. It would just remove the special handling:
github-action/renovate.json
Lines 27 to 35 in 47646e1