julien/apf_portal
1
0
Fork 0
Code Issues 1 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

chore(ci): auto-merge low-risk renovate updates
CI / commits (pull_request) Successful in 1m13s
Details
CI / scan (pull_request) Successful in 1m21s
Details
CI / check (pull_request) Successful in 1m22s
Details
CI / a11y (pull_request) Successful in 1m28s
Details
CI / perf (pull_request) Successful in 2m55s
Details

Browse Source 
After ~10 days of clean track record on Renovate (~30 PRs merged
without regression beyond the TS/ESLint/webpack-cli majors that
the dashboard-approval rule now catches), enable auto-merge for
patch / pin / digest / lockFileMaintenance updates. CI is the
gate — `check` / `scan` / `a11y` going red leaves the PR open for
manual triage. Minors keep needing human review (might widen
surface), majors are still dashboard-approval-gated.

The dashboard triage header is updated so the "Open" row reflects
the new reality (mostly minors, with red patches surfacing
briefly when CI fails). docs/development.md "Reviewing Renovate
PRs" gains a bullet describing the auto-merge behaviour for
contributors landing on the project later.

`automergeStrategy: "squash"` matches our trunk-based squash-merge
convention. `automergeType: "pr"` keeps a PR + CI run as the
audit trail (vs branch-direct push), and Gitea automerges the PR
once green via the bot's existing `repo:write` permission.
This commit is contained in:
Julien Gautier
2026-05-10 03:55:57 +02:00
parent 02ac44e498
commit a800b9d28d
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/development.md
+2 -1
View File
@@ -339,7 +339,8 @@ Repo → Actions → "Renovate" workflow → Run workflow. Useful when you've ju
### Reviewing Renovate PRs
- Renovate PRs run a leaner CI pipeline than human PRs — `check`, `scan`, `a11y` only. The `perf` and `commits` gates are skipped (per [ADR-0017](decisions/0017-performance-budgets-lighthouse-ci.md) — Lighthouse signal on a dep bump is essentially zero, commitlint on bot-generated messages is tautological). The full `perf` gate still runs on `push` to `main` post-merge, so regressions are caught seconds after merge rather than before.
- Don't merge until the remaining gates are green.
- **Patch / pin / digest / lockfile-maintenance updates auto-merge** as soon as their CI is green. The bot opens the PR, CI runs, Renovate squashes it into `main` without waiting for a human. They appear briefly in the dashboard's "Open" section while CI runs, then disappear into the merged log. Failures stay open for triage. **Minor and major** updates remain manual.
- Don't merge minor PRs until the remaining gates are green.
- **Major bumps are gated behind the dependency dashboard.** Renovate does not auto-create PRs for major updates; instead, they appear in the "Renovate Dependency Dashboard" issue with a checkbox. Tick the box only after reading the upstream changelog and confirming the rest of our toolchain (Nx plugins, Angular CLI, NestJS, etc.) supports the new major. This guard exists because `nx affected` sees a deps-only change as not affecting any project — so a major that breaks the build can pass CI silently and only surface days later. Past offenders we caught the hard way: TypeScript 5→6 (deprecated `baseUrl`), ESLint 9→10 (Nx eslint plugin not yet compatible), webpack-cli 5→7 (removed `--node-env` flag).
- The "Renovate Dependency Dashboard" issue (auto-created on first run) lists every pending update grouped by status. Use it to triage which PRs to expedite.
- For a major bump that introduces breaking changes, **don't reflexively merge**: read the changelog, then either accept the work or close the PR with a "rejected" label. Renovate respects that label and won't keep re-opening the same major.