Repository navigation
Consolidate dependency updates into Renovate - #169
Merged
Merged
Conversation
Renovate and Dependabot were both watching this repository and proposing the same upgrades, so every dependency produced two pull requests that had to be compared and one closed by hand -- six such pairs were open at once. Remove the Dependabot configuration and keep Renovate, which already covers both ecosystems Dependabot was configured for (Gradle and GitHub Actions) through config:recommended, and add the same ignorePaths eisop/checker-framework uses.
There was a problem hiding this comment.
🟢 Approval recommended
The changes are limited to dependency automation configuration and appear syntactically correct with no functional code impact.
Pull request overview
This PR consolidates dependency update automation by disabling Dependabot and relying solely on Renovate, reducing duplicate upgrade pull requests while keeping coverage for Gradle and GitHub Actions.
Changes:
- Remove
.github/dependabot.ymlto stop Dependabot from opening duplicate dependency PRs. - Add Renovate
ignorePathsentries to avoid scanning common vendor/dependency directories.
File summaries
| File | Description |
|---|---|
| renovate.json | Adds ignorePaths so Renovate ignores common dependency/vendor directories while continuing to use config:recommended. |
| .github/dependabot.yml | Removes Dependabot configuration to eliminate duplicate upgrade PRs alongside Renovate. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Carries over the settings from eisop/checker-framework#2005 that apply to this repository. minimumReleaseAge holds a new release for seven days, so a version that is yanked or quickly superseded never reaches a pull request. Both of the duplicated upgrades open last week would have collapsed into one under it: guava 33.7.0 then 33.7.1, and spotless 8.10.0 then 8.10.2. Security fixes are exempt. prConcurrentLimit caps the queue at five; thirteen were open at once before. Grouping non-major GitHub Actions updates puts checkout, setup-java and gradle/actions bumps in a single pull request rather than three. Not carried over: the docs/examples grouping, since this repository has no such directory, and the openjdk/jdk and adoptium/temurin cooldown exemptions, since it consumes neither -- "temurin" here is only a setup-java distribution name, which Renovate does not track. The dependency dashboard is already enabled, as this configuration never disabled it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renovate and Dependabot were both watching this repository and proposing the same
upgrades, so every dependency produced two pull requests. Six such pairs were open at
once and had to be compared and closed by hand:
Removes
.github/dependabot.yml. Renovate already covers both ecosystems Dependabot wasconfigured for — Gradle and GitHub Actions — through
config:recommended, and this addsthe same
ignorePathseisop/checker-framework uses, matching how that repositoryconsolidated onto Renovate.
🤖 Generated with Claude Code
https://claude.ai/code/session_019jLjeEW1F1aE2E3ax7EWqV
Also adopts the applicable settings from eisop/checker-framework#2005
minimumReleaseAge: 7 daysmatchCategories: ["security"]→0 daysprConcurrentLimit: 5Not carried over, having checked each against this repository:
docs/examplesgrouping — no such directory here;openjdk/jdkandadoptium/temurincooldown exemptions — neither is consumed.temurinappears only as asetup-javadistribution name, which Renovate does not track as a dependency;:disableDependencyDashboard.