Skip to content

Update renovate config #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexSkrypnyk merged 1 commit into from
Mar 17, 2026
Merged

Update renovate config #61

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,20 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended"],
"automerge": true,
"rangeStrategy": "bump",
"dependencyDashboard": true,
"extends": [
"config:base"
"pinDigests": true,
"branchPrefix": "deps/",
"packageRules": [
{
"matchManagers": ["composer"],
"matchUpdateTypes": ["major"],
"enabled": false
},
{
"matchPackageNames": ["*"],
"groupName": "all dependencies",
"groupSlug": "all"
Comment on lines +15 to +17
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

In Renovate, if top-level "automerge": true and a packageRule groups all dependencies (matchPackageNames ["*"]), does Renovate automerge the grouped PR as one bundle, and what is the recommended way to avoid grouping major updates into that automerge path?

💡 Result:

Yes—if a grouped PR is created and automerge: true applies to that PR, Renovate will automerge the whole grouped PR as a single bundle once its required checks pass. (docs.renovatebot.com)

However, by default Renovate will not put major updates into the same group PR as minor/patch updates: its default behavior is to create separate PRs when both major and minor updates exist, and this “separate major/minor” behavior takes priority over package grouping (unless you explicitly override it in a packageRule). (docs.renovatebot.com)

Recommended way to avoid major updates entering the automerge path: scope your “group + automerge” rule to non-major updates only, and add an explicit “no automerge” rule for majors, e.g.:

{
  "automerge": true,
  "packageRules": [
    {
      "matchPackageNames": ["*"],
      "matchUpdateTypes": ["patch", "minor"],
      "groupName": "all non-major",
      "automerge": true
    },
    {
      "matchPackageNames": ["*"],
      "matchUpdateTypes": ["major"],
      "automerge": false
    }
  ]
}

This keeps the big grouped PR on a safer “patch/minor automerge” track while forcing major upgrades to stay manual. (docs.renovatebot.com)

Citations:

🏁 Script executed:

cat renovate.json

Repository: drevops/behat-format-progress-fail

Length of output: 558

Limit catch-all grouping to prevent auto-merging major updates alongside minor/patch changes.

At Lines 15–17, grouping all packages without filtering by update type while top-level automerge: true (Line 3) can bundle major updates with minor/patch changes into a single PR and auto-merge them together, increasing the risk of cascading failures and limiting rollback granularity.

🔧 Suggested adjustment 
         {
             "matchPackageNames": ["*"],
+            "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
             "groupName": "all dependencies",
             "groupSlug": "all"
-        }
+        },
+        {
+            "matchPackageNames": ["*"],
+            "matchUpdateTypes": ["major"],
+            "automerge": false
+        }

This filters the grouped rule to non-major updates (while inheriting automerge: true) and explicitly prevents major updates from being auto-merged, protecting against large blast radius incidents.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@renovate.json` around lines 15 - 17, The catch-all group ("groupName": "all",
"groupSlug": "all", "matchPackageNames": ["*"]) must be limited to non-major
updates: update the rule to include a "matchUpdateTypes" filter (e.g.,
["minor","patch","pin","digest"]) so only non-major changes are grouped and can
inherit the top-level "automerge": true, and add a separate rule that matches
major updates (matchUpdateTypes: ["major"]) that explicitly sets "automerge":
false to prevent auto-merging major bumps.

}
]
}