chore(renovate): disable renovate; dependabot owns updates - #233
Merged
Merged
Conversation
This repo has no portfolio-standards customManager, so Renovate has nothing to do that Dependabot does not already do. enabled: false stops it opening PRs that duplicate Dependabot's updates.
ChelseaKR
added a commit
that referenced
this pull request
Sep 18, 2026
…ping (#234) Renovate was disabled here in #233. A Renovate extract dry run of main with config:recommended shows it also tracked files no Dependabot entry covers: the digest-pinned python base in infra/Dockerfile, the caddy image in infra/aws/docker-compose.deploy.yml, the AWS provider in infra/aws/terraform, and the npm harness in tools/a11y_browser. Add docker, docker-compose, terraform and npm entries for them in this file's existing style (weekly, limit 5, dependencies label, build prefix). The compose entry ignores the locally built `ledger` image, which Dependabot would otherwise try to look up on Docker Hub. infra/Dockerfile no longer says Renovate tracks the digest. The pins Dependabot cannot update (.python-version, setup-* version inputs) are listed in dependabot.yml as a manual check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Turns Renovate off in this repo (
"enabled": false) and adds a one-linedescriptionexplaining why..github/dependabot.ymlis unchanged.Why
The Renovate app was just installed here. With
config:recommendedit would open PRs for the samepipandgithub-actionsdependencies Dependabot already updates, so every bump would show up twice. The agreed split is that Dependabot owns all dependency and version updates, and Renovate only bumps the vendored portfolio-standards pin through a regex customManager.This repo doesn't have that customManager, so Renovate has nothing left to do here. It's a
ci-fetchconsumer: the standards pin is theref: v1.0.1on theactions/checkoutstep in.github/workflows/standards.yml, kept in lockstep with the root.standards-version. No Renovate manager bumps that pin today, and neither does Dependabot.The
codeql-actiongrouping rule is gone along with the rest. It only applied to Renovate'sgithub-actionsmanager, anddependabot.ymlalready has its own codeql-action group.Checks
renovate-config-validator --strict(Renovate 44.97.6, repo mode) passes.--platform=local --dry-run=extract) now ends withRepository result: disabled-by-config.renovate/*branches, or a Dependency Dashboard issue here yet, so there are no duplicates to close.What Renovate covered that Dependabot doesn't
dependabot.ymlonly declarespipandgithub-actions. The before-change dry run shows Renovate's defaults also tracked the files below. After this PR, none of them are tracked automatically:infra/Dockerfile: the digest-pinnedpython:3.12-slimbase. The Dockerfile comment says "Renovate tracks this digest and opens a PR when it moves", which is no longer true.infra/aws/docker-compose.deploy.yml:caddyinfra/aws/terraform/versions.tf: theawsprovider andhashicorp/terraformtools/a11y_browser/package.json:@axe-core/playwright,@playwright/test.python-versionA few docs also describe Renovate as active:
README.md("Dependabot + Renovate"),docs/DORA-DELIVERY-HEALTH-REVIEW.md("renovate.jsonnow handles Actions digest pinning"), and the.pre-commit-config.yamlheader. Restoring the Dockerfile, compose, terraform, and npm coverage would mean addingdocker,terraform, andnpmentries todependabot.yml. That's a separate decision.Prepared with AI assistance; reviewed before submission.