Add Renovate config (Gradle + Docker)#358
Open
jonbartels wants to merge 3 commits into
Open
Conversation
Configure Renovate for dependency updates instead of Dependabot: monthly schedule, 2-day minimumReleaseAge, coherent-project grouping (keyed deep so unrelated org.apache.* projects stay separate), ecosystem labels, PR limit, and OSV vulnerability alerts. Because this repo enforces Gradle dependency verification and the metadata file cannot always be regenerated by the bot, add a split-privilege workflow that regenerates gradle/verification-metadata.xml on renovate/** branches: an untrusted build job with a read-only token and no secrets produces the file, and a separate trusted job that runs no dependency code commits it. This isolates the writable token from untrusted execution. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
jonbartels
marked this pull request as ready for review
July 21, 2026 23:03
jonbartels
requested review from
a team,
NicoPiel,
gibson9583,
kayyagari,
kpalang,
mgaffigan,
ssrowe and
tonygermano
July 21, 2026 23:03
jonbartels
marked this pull request as draft
July 21, 2026 23:03
Contributor
Author
|
Here is an example of what we get out of renovate. https://github.com/jonbartels/oie-engine/pulls/app%2Frenovate This doesn't do the grouping like dependa does I'll work on configuring it. |
jonbartels
marked this pull request as ready for review
July 22, 2026 13:22
Add prHourlyLimit to avoid PR bursts, require Dependency Dashboard approval before major-version PRs open, and set the schedule timezone. Explicitly set automerge=false; we never want automerge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
mgaffigan
requested changes
Jul 22, 2026
Verified empirically on a live Mend-hosted fork: when its PR branch is not externally modified, Renovate runs ./gradlew --write-verification-metadata and commits the refreshed gradle/verification-metadata.xml itself (jetty-http 10.0.0: jar+pom+parent checksums authored by renovate[bot], no workflow present). The custom workflow only appeared necessary because its commit raced Renovate's on push; removing it lets Renovate self-maintain. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
mgaffigan
approved these changes
Jul 22, 2026
kpalang
approved these changes
Jul 22, 2026
kpalang
left a comment
kpalang
left a comment
Contributor
There was a problem hiding this comment.
Looks alright, lets see what we get.
jonbartels
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
renovate.jsonto configure Renovate for dependency updates. No custom workflow is needed — Renovate maintains the Gradle dependency-verification metadata itself (see below).renovate.jsonconfig:recommendedAmerica/New_YorkminimumReleaseAge: "2 days"— waits before opening a PR (skips yanked/broken releases)org.apache.*projects stay separate (org.apache.commons,org.apache.logging.log4j, …):aws-sdk,jetty,jersey,jackson,netty,log4j,apache-commons,test-tooling, plus a catch-allall-minor-and-patch. Rule order accounts for Renovate's last-match-wins merge so family groups aren't swallowed by the catch-all.prConcurrentLimit: 10,prHourlyLimit: 2, ecosystem labels (java/docker), semantic commits,dependencyDashboard,osvVulnerabilityAlertsmajor.dependencyDashboardApproval: true)automerge: false— never automergeDockerfilehandled automatically by Renovate'sdockerfilemanagerGradle dependency verification — handled by Renovate, no workflow
This repo enforces
gradle/verification-metadata.xml(verify-metadata=true). Renovate's Gradle manager detects that and runs./gradlew --write-verification-metadata sha256 dependencies, committing the refreshed checksums in its own PR.This was verified empirically on a live Mend-hosted fork: on a genuinely-needed update (
org.eclipse.jetty:jetty-http→ 10.0.0), Renovate committed the catalog bump and the new jar/pom/parent-POM checksums in a singlerenovate[bot]commit (origin="Generated by Gradle"), with no helper workflow present. An earlier draft of this PR carried a split-privilege regen workflow; it turned out to be unnecessary (it only looked required because itspush-triggered commit raced Renovate's own artifact update). That workflow has been removed.dependencies/java/dockeralready exist — no action.dependabot.ymlexists onmain; ensure no org-level Dependabot config double-runs updates.🤖 Generated with Claude Code