Skip to content

ci: replace Dependabot with Renovate for dependency updates #1095

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frankieyan merged 1 commit into from
Jul 27, 2026
Merged

ci: replace Dependabot with Renovate for dependency updates #1095

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 0 additions & 11 deletions .github/dependabot.yml
View file
Open in desktop

This file was deleted.

28 changes: 28 additions & 0 deletions .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"github>doist/renovate-config:frontend-base",
"github>doist/renovate-config-internal:npm-registry-token"
],
"packageRules": [
{
"description": "Reactist releases should mirror @doist/product-libraries-tokens releases. Simple token value changes are categorized as patches.",
"matchPackageNames": ["@doist/product-libraries-tokens"],
"matchUpdateTypes": ["patch"],
"semanticCommitType": "fix"
},
{
"description": "Reactist releases should mirror @doist/product-libraries-tokens releases. When new tokens are added, we categorize it as a minor release.",
"matchPackageNames": ["@doist/product-libraries-tokens"],
"matchUpdateTypes": ["minor"],
"semanticCommitType": "feat"
},
{
"description": "Reactist releases should mirror @doist/product-libraries-tokens releases. Token removals are categorized as breaking changes and should be reviewed.",
"matchPackageNames": ["@doist/product-libraries-tokens"],
"matchUpdateTypes": ["major"],
"commitMessagePrefix": "feat(deps)!:",

@doistbot doistbot Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 commitMessagePrefix is ignored by Renovate when semanticCommits is enabled. Semantic commits are on here: the patch/minor rules depend on semanticCommitType (only honored with semantic commits enabled), and Renovate's default auto detection will enable them given Reactist's conventional-commit history, which the check-semantic-pull-request workflow enforces. So a major @doist/product-libraries-tokens bump won't actually get feat(deps)!: — Renovate builds the prefix from the base preset's semanticCommitType/semanticCommitScope (likely chore/deps) with no !, and semantic-release won't cut a breaking/major release, defeating the rule's stated purpose. Add "semanticCommits": "disabled" to this package rule so commitMessagePrefix takes effect; it's a per-rule override and won't affect the patch/minor rules, which keep using semanticCommitType.

@frankieyan frankieyan Jul 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@doistbot the docs is kind of ambiguous, because it says:

Prefix to add to start of commit messages and PR titles. Uses a semantic prefix if semanticCommits is enabled.

However, looking at the source, it looks like semanticCommits is guarded with a !upgrade.commitMessagePrefix check: https://github.com/renovatebot/renovate/blob/170b972320cd4a6de644992586f5156eb20d9de5/lib/workers/repository/updates/generate.ts#L69

So that seems to me that semanticCommits is filling in as the default value, and commitMessagePrefix is used to override it. I guess it doesn't hurt to disable it, but I don't think it's necessary either.

@doistbot doistbot Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You’re right—the Renovate source confirms that semanticCommits only supplies a prefix when upgrade.commitMessagePrefix is unset. For the major rule, commitMessagePrefix: "feat(deps)!:" therefore takes precedence and produces the intended breaking conventional-commit title. That’s also what the repository’s semantic PR check and semantic-release configuration consume.

"semanticCommits": "disabled" would be redundant rather than harmful. I’ll withdraw that concern; the configuration can remain as-is.

"automerge": false
}
]
}
Loading