feat: enable automerge for digest, patch, and minor renovate updates - #14
Conversation
…ority Renovate 44.x rejects matchVulnerabilityAlerts (no vulnerability matcher exists in packageRules anymore) and prPriority inside vulnerabilityAlerts. Security PRs keep their behaviour via the vulnerabilityAlerts object (minimumReleaseAge: null, automerge: false, security label); those PRs already skip queues, so prPriority was redundant.
Plain "Makefile" only matched the repo root. Anchoring with /(^|/)Makefile$/ also matches Makefiles in subdirectories, matching the flake.nix pattern already used in go.json.
Adds an automerge label to exactly the update types that are safe to merge without a human. The reusable auto-approve workflow reacts to this label. Major and security updates never get it, so they stay human-gated.
Reusable workflow_call workflow that approves a Renovate PR carrying the automerge label (and not the security block label) using the gh CLI, no third-party action. Consuming repos call it from a pull_request trigger. The merge stays gated on required status checks; security PRs are never approved.
Adds an "Enabling automerge in a consuming repo" runbook (caller workflow + required GitHub settings) and a Workflows section. Also updates the security-window note, which referenced the removed matchVulnerabilityAlerts option, to describe the vulnerabilityAlerts object instead.
|
Warning Review limit reached
Next review available in: 47 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughChangesRenovate automerge
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/renovate-auto-approve.yml:
- Around line 38-42: Update .github/workflows/renovate-auto-approve.yml lines
38-42 to handle pull requests that gain the security label by dismissing
approvals created by this workflow’s github-actions[bot], while preserving the
existing Renovate auto-approval path. Align the documented behavior and claims
in README.md lines 33, 49, and 80 with this security-label revocation behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f43fd3a2-aaec-4df7-a3dd-36d36e070f67
📒 Files selected for processing (4)
.github/workflows/renovate-auto-approve.ymlREADME.mddefault.jsonk8s.json
|
This PR is just the mechanism, turning it on is something we should discuss in the team. i'm for it. Pro: kills noise, faster patch uptake, no reviewer bottleneck. Stability window + digest pinning + required CI still gate every merge. Con: CI becomes the only gate, so it has to be trustworthy. Plus supply-chain risk inside the 3-day window, semver might not always honest (depending on the project :D) Decide:
my personal suggestion: pilot |
A label change does not dismiss existing reviews, so a PR approved while labeled automerge could keep that approval after later gaining the security label, satisfying the review gate without a human. The workflow now also runs on the block label and, if it finds its own prior approval, supersedes it with a request-changes review. Uses request-changes rather than a dismissal because dismissing a review on a protected branch needs admin rights that github-actions[bot] does not have.
The reusable workflow moves to opendefensecloud/dev-kit, which already owns shared CI and repo-settings governance. This repo keeps the config (the automerge label + the automerge model docs) and points the caller at dev-kit.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
README.md (1)
80-80: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winDocument the reusable-workflow access policy.
If a repository or organization restricts allowed actions and reusable workflows, it must allow the referenced
opendefensecloud/dev-kitworkflow. Otherwise, the caller fails before it can approve Renovate pull requests. Add this prerequisite to the settings checklist. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 80, Update the README settings checklist near the existing workflow-permissions prerequisite to document that repository or organization action policies must allow the referenced opendefensecloud/dev-kit reusable workflow, linking to the relevant GitHub documentation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 71-76: Update the reusable workflow reference in the README to use
a full 40-character commit SHA instead of the mutable <sha-or-tag> placeholder
or tag. Preserve the corresponding released tag in an adjacent comment for
Renovate, and leave the pull-request event types and permissions unchanged.
---
Nitpick comments:
In `@README.md`:
- Line 80: Update the README settings checklist near the existing
workflow-permissions prerequisite to document that repository or organization
action policies must allow the referenced opendefensecloud/dev-kit reusable
workflow, linking to the relevant GitHub documentation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
For the record: we decided to host shared/reusable workflows in dev-kit for now (next to the CI + repo-settings governance), so the auto-approve workflow moved there -> opendefensecloud/dev-kit#25. This repo keeps the config/policy only. |
Keeps the documented caller in sync with dev-kit so removing the security label re-evaluates the PR.
olzemal
left a comment
olzemal
left a comment
There was a problem hiding this comment.
lgtm, let's adopt it in one of our repos for a while as you suggested.
## What Adds a reusable `renovate-auto-approve.yml` workflow to dev-kit, plus an example caller and an onboarding note. ## Why We want Renovate to auto-merge digest/patch/minor PRs without a manual approval. The renovate-config presets already set `automerge: true` and add an `automerge` label to those update types, but Renovate cant approve its own PRs, so the required-review gate never clears. This workflow provides the approval for labeled PRs and revokes it if a PR later turns out to be a `security` one. Originally i put this in renovate-config (opendefensecloud/renovate-config#14), but dev-kit is the better home: it already owns the shared CI workflows and the `repo-settings` governance (labels, merge strategy, the `protect-main` ruleset). renovate-config keeps the *policy* (which update types are eligible), dev-kit hosts the *workflow* that acts on it. So renovate-config#14 now just points its caller at dev-kit. Context: opendefensecloud/solution-arsenal#580. ## Testing Linted the reusable workflow (the one that actually runs in this repo): ``` $ actionlint .github/workflows/renovate-auto-approve.yml (no findings) ``` The `example/` copy is a template (GitHub only runs workflows under `.github/workflows/`, not `example/...`), so it never executes here. The `@<sha-or-tag>` ref is an intentional placeholder consumers pin when they copy it. End-to-end automerge can only be exercised on a real Renovate PR in a consuming repo with the GitHub settings applied. ## Notes for reviewers - Follow-up worth considering: teach `make repo-settings` to also flip "Allow GitHub Actions to create and approve pull requests" so it isnt a manual step. Left out here to keep this PR focused. Can open an issue if we want it. - Pairs with opendefensecloud/renovate-config#14 (repoints the caller to dev-kit). Merge order doesnt matter, nothing runs until a consuming repo adds the caller. ## Checklist - [x] Tests added/updated (workflow linted with `actionlint`; no runtime harness for a reusable workflow in this repo) - [x] No breaking changes (new opt-in workflow; nothing runs until a repo copies the caller) - [x] Readable commit history - [x] AI code review considered and comments resolved <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated approval for eligible Renovate update pull requests labeled for auto-merge. * Automatically withdraws approval when a security-related label is applied. * Keeps merging subject to required status checks and configurable workflow settings. * Added an example configuration for enabling the automation in a repository. * **Documentation** * Added setup guidance, permission requirements, status-check configuration, and update eligibility details to the repository checklist. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What - adds the renovate auto-approve caller workflow -> calls dev-kit's reusable `renovate-auto-approve.yml` (opendefensecloud/dev-kit#25), pinned to `8cb6197` (post-v1.0.13 re-pin to the next release tag once cut, noted in the file) - created the missing `automerge` label ## Why The renovate-config presets set `automerge: true` + the `automerge` label on digest/patch/minor PRs, but Renovate cant approve its own PRs, so the required-review gate never clears. This workflow provides that approval for labeled PRs; anything labeled `security` is skipped and an earlier approval revoked Everything else was already in place, verified via API: "Allow GitHub Actions to approve PRs" enabled, `protect-main` requires 1 approval + `check`/`lint`/`test`/`CodeQL`, `allow_auto_merge` on -> merges stay gated on CI, majors and security updates stay human-gated. Related: automerge policy (labels, update types, stability window) -> opendefensecloud/renovate-config#14, reusable workflow -> opendefensecloud/dev-kit#25. ## Testing CI config only, no runnable behavior change YAML parses clean, `uses:` ref resolves to the merged dev-kit workflow. ## Checklist - [x] Tests added/updated (not applicable, CI config only) - [x] No breaking changes - [x] Readable commit history (squashed and cleaned up as desired) - [ ] AI code review considered and comments resolved
3 participants
What
Enables Renovate automerge for digest, patch, and minor updates, and brings the presets up to date with current Renovate (44.x).
automergelabel to the digest/patch/minor rules indefault.jsonmatchVulnerabilityAlerts,prPriorityinsidevulnerabilityAlerts)Makefilecustom-manager patterns so nested Makefiles matchThe reusable auto-approve workflow itself lives in dev-kit (opendefensecloud/dev-kit#25); this PR just points the caller at it. Part of opendefensecloud/solution-arsenal#580 (config side). The GitHub-side settings land in the consuming repo, see "Whats left" below.
Why
The story wants digest/patch/minor Renovate PRs to merge without us approving them by hand. The presets already set
automerge: truefor those, so the real blocker is the required-review gate: Renovate cant approve its own PRs, so automerge never fires. The fix is a label plus a small auto-approve workflow: the update-type logic stays in Renovate (single source of truth) via anautomergelabel, and the workflow just reacts to it.automergelabel -> only on digest/patch/minor. Major and security never get it, so they stay human-gated.repo-settingsgovernance. This repo owns the policy (which update types are eligible), dev-kit hosts the workflow that acts on it.While validating against current Renovate i found the presets fail validation on two removed options, so i fixed those too (they were live errors, not just style):
matchVulnerabilityAlertsis gone. Theres no vulnerability matcher inpackageRulesanymore, so security PRs are configured purely through thevulnerabilityAlertsobject, which Renovate applies on top of the normal rules for vulnerability-fix PRs. Behaviour is unchanged:minimumReleaseAge: null(no stability window),automerge: false(no automerge),securitylabel. Ref: https://docs.renovatebot.com/configuration-options/#vulnerabilityalertsprPriorityis only allowed inpackageRulesnow, not insidevulnerabilityAlerts. Dropped it, its redundant anyway: vulnerability PRs already "skip the line" (Renovate ignores concurrency/schedule limits for them). Ref: https://docs.renovatebot.com/configuration-options/#prpriorityrenovate-config-validator(see Testing).Anchoring
["Makefile"]->["/(^|/)Makefile$/"]: the plain form only matches a root-level Makefile, so nested Makefiles in a monorepo would be missed. The regex form matches at any depth and mirrors whatgo.jsonalready does forflake.nix. Ref: https://docs.renovatebot.com/configuration-options/#managerfilepatternsTesting
Validated all three presets against current Renovate:
For reference, before the fix the same validator reported the removed options:
The workflow (and its
actionlintrun) lives in the dev-kit PR. End-to-end automerge cant be exercised from this repo, it needs a live Renovate PR + the GitHub settings, which happens in the consuming repo.Notes for reviewers
Whats left, to be done in the consuming repo (e.g.
solution-arsenal) and documented in the new README section:example/.github/workflows/renovate-auto-approve.yml), pinned to a dev-kit tag/SHAPairs with opendefensecloud/dev-kit#25 (hosts the reusable workflow). Merge order doesnt matter, nothing runs until a consuming repo adds the caller.
Checklist
renovate-config-validator; no unit-test harness in this repo)vulnerabilityAlertsobject; automerge only fires once required checks pass)