chore(renovate): low-noise config — group weekly, automerge non-major#821
Merged
Conversation
Best-practice pass: keep exact PyPI pins (Renovate's documented stance for apps) and the supply-chain age gate (3d -> 7d, per docs' automerge guidance and Astral's uv guide), and add what was missing: all-non-major updates grouped into one weekly PR that automerges on green CI, majors individually for review, lockFileMaintenance for transitives. Drop internalChecksFilter=strict (hides PRs during cooldown for no benefit once grouped). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ggNiT4bp685KyB4RraQBE
Renovate's rangeStrategy=pin packageRule failed to take effect against the Mend org config even after 3fe9d3e (verified on the 2026-07-13 23:19 rebase of #816: no pins written, artifacts still failing on renovatebot/renovate#41624). Stop depending on config-merge semantics: write the pins directly into pyproject.toml at the currently-locked versions and relock. Renovate now just bumps pins. Also guard python: Renovate classifies 3.12 -> 3.14 as 'minor', which would ride the non-major automerge group. A Python upgrade of the science stack gets human review. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ggNiT4bp685KyB4RraQBE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Steps back from the earlier config-wrangling and asks what we actually want: minimal noise, mild supply-chain hygiene. Checked against Renovate's own docs and Astral's uv guide.
Config (
renovate.json):group:allNonMajor+schedule:weekly+ automerge on green CI → one weekly deps PR that merges itself; majors surface individually.lockFileMaintenancerefreshes transitives.internalChecksFilter: strict(hid PRs during cooldown; opacity for no benefit once grouped).pythonnever automerges — Renovate classifies the base-image bump 3.12 → 3.14 as minor (it's riding in chore(deps): update all non-major #816's non-major group right now), and a Python upgrade of the science stack deserves human eyes.Pins written directly in
pyproject.toml(== at the currently-locked versions, lock regenerated): therangeStrategy=pinpackageRule demonstrably never took effect against the Mend org config — verified on the 2026-07-13 23:19 rebase of #816, which still wrote no pins and still failed its artifacts step on renovatebot/renovate#41624. With literal pins, nothing depends on config-merge semantics: Renovate just bumps pins, and the age gate is honored by construction. Per the dependency-pinning doc, pinning is the recommended strategy for apps — ShapePipe ships as a container, not a PyPI library. Git-sourced deps (ngmix, cs_util) stay ranged.Expected steady state: ~1 self-merging deps PR per week; human review only for majors and Python.
— Fable on behalf of Cail.
🤖 Generated with Claude Code
https://claude.ai/code/session_013ggNiT4bp685KyB4RraQBE