Skip to content

Phase 1 — Discovery #551

Open
Open
Phase 1 — Discovery#551
Assignees
farhan

Description

@farhan
farhan
opened on Jul 1, 2026

The output of this phase is a short design doc / decision record answering:

  • Host repo: does the shared config live in a new openedx/renovate-config, under openedx/.github, or somewhere else?
  • Preset shape: one preset, or a base + frontend + backend split? What goes in each, given the FE/BE divergence above?
  • Policy reconciliation: for places where current configs disagree (automerge breadth, schedules, semantic commits, vulnerability alerts), what's the org default? Where do we honor existing per-repo overrides vs. unify?
  • Override pattern: how does a repo opt out or extend (e.g. team reviewers, custom grouping) without forking the whole config?
  • Repo inventory: the ~40 repos with existing configs, plus repos that should have Renovate but don't today.
  • POC scope: pick 1–2 FE repos and 1–2 BE repos to migrate first.

Activity

  1. farhan
    added this to Aximprovements Teamon Jul 1, 2026
  2. farhan
    added a parent issue on Jul 1, 2026

  3. farhan commented on Jul 1, 2026

    @farhan
    farhan
    on Jul 1, 2026
    Author

    Discovery Notes (from initial research)

    1. Audit existing renovate.json versions across repos

    • There are 58 repos in openedx with a renovate.json (excluding test fixtures and cookiecutter templates)
    • Most use "extends": ["config:base"]; a few (e.g. xblocks-core) have migrated to "config:recommended"
    • File locations are inconsistent: some repos use root-level renovate.json, others use .github/renovate.json
    • openedx-platform uses .github/renovate.json5 (JSON5 format — allows comments)
    • The shared preset should standardize on the latest recommended base (config:recommended over the deprecated config:base)

    2. Python packages — Renovate does NOT handle them

    • openedx manages Python dependency updates via a separate GitHub Actions workflow: .github/workflows/upgrade-python-requirements.yml
    • Runs every Tuesday via cron, uses a dedicated REQUIREMENTS_BOT_GITHUB_TOKEN
    • Calls a shared reusable workflow from openedx/.github
    • The shared Renovate preset should not add any Python package manager config — this is intentionally handled elsewhere

    3. GitHub Actions updates — defer to Dependabot

    • openedx uses Dependabot (not Renovate) for GitHub Actions updates
    • Every dependabot.yml checked is GitHub Actions-only: 
      updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    • 30 repos currently have both renovate.json and dependabot.yml — since config:base enables GitHub Actions updates in Renovate by default, these repos risk getting duplicate PRs for the same Action update
    • The shared preset should explicitly disable the github-actions manager in Renovate to avoid conflicts with Dependabot

    Summary of what the shared preset should cover

    Dependency type Tool Notes
    npm / JS packages ✅ Renovate Primary use case
    GitHub Actions ❌ Renovate (disable) Handled by Dependabot
    Python packages ❌ Renovate Handled by upgrade-python-requirements workflow

    🤖 Written with the assistance of Claude Code

  4. FuaadZam
    moved this to 📋 Backlog in Aximprovements Teamon Jul 6, 2026
  5. FuaadZam
    moved this from 📋 Backlog to 🔖 Ready in Aximprovements Teamon Jul 6, 2026
  6. FuaadZam
    assigned
    farhan
    on Sep 2, 2026

  7. Hammadahmad2 commented on Oct 30, 2026

    @Hammadahmad2
    Hammadahmad2
    on Oct 30, 2026

    @farhan , please see to it as well and park it in appropriate state

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions