chore: set up Renovate for dependency updates [MEC-3447]#115
Open
contentful-renovate-rollout[bot] wants to merge 1 commit into
Open
chore: set up Renovate for dependency updates [MEC-3447]#115contentful-renovate-rollout[bot] wants to merge 1 commit into
contentful-renovate-rollout[bot] wants to merge 1 commit into
Conversation
contentful-renovate-rollout
Bot
force-pushed
the
renovate-rollout/dependabot-to-renovate
branch
from
July 8, 2026 14:30
3e3101e to
c616537
Compare
Tyler (tylerwashington888)
approved these changes
Jul 9, 2026
ryunsong-contentful
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets up Renovate as the dependency-update tool for this repository, part of an org-wide rollout.
Depending on this repo's starting state, this PR does some of the following:
renovate.jsonextending the Contentful shared presetpackageRuleswhere still needed, and removes Dependabot-only automation and secret policiesManual follow-up (not handled by this PR):
Migration Confidence: 🔴 Low
Summary
The migration deleted .github/dependabot.yml, removed the dependabot vault-secrets policy entry, and added renovate.json extending the correct shared preset (local>contentful/renovate-config). However, renovate.json includes additional packageRules that group production and dev dependencies by minor/patch updates — logic that appears to replicate the Dependabot grouping config but was not specified by the migration prompt and may duplicate or conflict with grouping already handled by the shared preset. Per the assessment rules, adding speculative Renovate tuning that nothing justified is a low-confidence trigger. The renovate.json should likely contain only the extends line; the extra packageRules block needs a human to confirm whether the shared preset already covers this behavior or whether these rules are intentionally additive.
Files requiring attention
The following files had edge cases or required judgment during migration and should be reviewed carefully:
renovate.json