Renovate

[danilupion]

In my experience having a tool such as renovate https://docs.renovatebot.com/ helps keep versions updated, if the team sees value in it, I could volunteer at onboarding it into https://developer.mend.io/ (which nicely integrates in github).

Requirements (as i see them, feel free to change):

• Generate renovate.json file with renovate's configuration
• Produce a short walkthrough for a repo admin to configure mend https://github.com/apps/renovate

[anthonybailey]

Our testing isn't great, but in principle the pull requests get reviewed.

Automatic trying new major versions of key dependencies seems same to me.

[Wituareard]

We should probably start with minor versions only and do major version upgrades manually (sticking to the version descriptors in the package.json)

[danilupion]

If we have concerns, my suggestions would be not to auto merge anything, while we gain confidence patch then possibly minor (if we spot dependencies that we are not confident in auto merging, we can exclude them.

For mayor... I do not think anyone is doing automerges in the industry as by definition... Backguards compatibility is not guaranteed.

But (just in case it is not obvious) even for the semver levels that we decide not to have automerges, we will receive PR (that we can use in the manual validation process that we seem to have in place).

Hope this gives a little more clarity on the options at hand.

[Wituareard]

Is it possible to have it respect the individual version descriptors? Because for some dependencies we use internals and unstable pre-1.0 releases also shouldn't be updated automatically

[danilupion]

Two things come to mind...

1. We can completely exclude them (i think instead of doing that i would create a dedicated "pipeline" so that we receive the pr's
2. Renovate is semver aware so even though i do not know for sure, i assume it will understand the nuances of 0.X versions

I have the feeling most of the concernts are about automatically merging bump PRs, we can completely opt out (that would be my recomendation) automerging. Here you can see the kind of PRs that i am receiving in a repo i maintain (currently you will see a lot of failed builds because of a very rigid changeset configuration) https://github.com/danilupion/slango/pulls?q=is%3Apr+is%3Aclosed+author%3Aapp%2Frenovate.

Leaving here another more complex renovate config where packages by pattern and alloweed version are configured: https://github.com/danilupion/homelab/blob/main/renovate.json5

[Wituareard]

Did some research and rangeStrategy actually does seem to allow configuring how range prefixes are handled, so I'd say let's try it. Can you join the meeting tonight?

[danilupion]

Thanks for the comment @Wituareard, regarding the meeting I think I could but I do not have an invite or anything... Tried searching in the software team channel but could not find it (apologies) would be out be so kind as to pont me in the right direction?

[Wituareard]

@danilupion There should be an event with a link in the Discord calendar, it's in half an hour though so sorry for the late reply