webgrip/application-template

Fork 0

chore: Configure Renovate - autoclosed #29

Closed

renovate wants to merge 1 commit from renovate/configure into main

renovate commented

2026-07-18 07:03:21 +00:00

Member

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 Renovate will begin keeping your dependencies up-to-date only once you merge or close this Pull Request.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

Detected Package Files

docker-compose.yml (docker-compose)
ops/docker/application/Dockerfile (dockerfile)
ops/docker/mariadb/Dockerfile (dockerfile)
ops/docker/nginx/Dockerfile (dockerfile)
ops/docker/postgres/Dockerfile (dockerfile)
ops/docker/redis/Dockerfile (dockerfile)
.forgejo/workflows/on_docs_change.yml (github-actions)
.github/workflows/copilot-setup-steps.yml (github-actions)
.github/workflows/gatekeep-ready.agent.lock.yml (github-actions)
.github/workflows/issue-triage.agent.lock.yml (github-actions)
.github/workflows/on_docs_changed.yml (github-actions)
.github/workflows/on_release_published.yml (github-actions)
.github/workflows/on_source_changed.yml (github-actions)
ops/helm/application-application/values.yaml (helm-values)
package.json (npm)
renovate.json (renovate-config)

Configuration Summary

Based on the default config's presets, Renovate will:

Start dependency updates only once this onboarding PR is merged
Forgejo-platform overrides. Two things the platform gets wrong on its own. (1) Forgejo Actions don't populate the commit-status API that Renovate's prCreation:not-pending reads (GET /commits/{sha}/status is empty even on green CI), so not-pending never resolves and PRs hang the full prNotPendingHours. Force immediate PR creation on the Forgejo path. force: because consumers extend :default (not-pending) at the repo level, which only an admin-level force overrides. (2) The github-actions manager assigns datasource github-tags unconditionally, so a uses: pointing at a Forgejo-native repo is resolved against api.github.com. Where a github.com twin exists but carries no tags, that returns an empty list rather than an error — the pin freezes silently. The customManager below reads webgrip/* reusable-workflow pins from Forgejo instead.
Enable Renovate Dependency Dashboard creation.
Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
Group known monorepo packages together.
Use curated list of recommended non-monorepo package groupings.
Show only the Age and Confidence Merge Confidence badges for pull requests.
Apply crowd-sourced package replacement rules.
Apply crowd-sourced workarounds for known problems with packages.
Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
Correctly link to the source code for golang.org/x packages
Link to pkg.go.dev/... for golang.org/x packages' title
Provide a link to octochangelog's improved breakdown for Renovate's changelogs
Enable Renovate Dependency Dashboard creation.
Use semantic prefixes for commit messages and PR titles.
Separate each major version of dependencies into individual branches/PRs.
Raise PR when vulnerability alerts are detected.
Evaluate schedules according to timezone Europe/Amsterdam.
Recommended configuration for abandoned packages, treating packages without a release for 1 year as abandoned, while taking into account community-sourced overrides.
Show all Merge Confidence badges for pull requests.
Webgrip org default Renovate preset — strict, conservative defaults for all repositories. Graduated release soak times, per-type semantic commits and labels, OSV vulnerability alerts, and Merge Confidence badges included. Schedule is 'at any time' since 2026-09-18: with dashboard approval required for every update type, nothing opens unattended anyway, so a window only delayed work a human had already asked for — and Renovate does not persist an approval it cannot act on, so a tick made outside the window could be silently discarded (see rule 12). It also fought the move to hourly runs, which was made to cut exactly this kind of latency. A repo that wants quiet hours can set its own schedule.

What to Expect

With your current configuration, Renovate will create 17 Pull Requests:

ci(actions): Pin dependencies

Schedule: ["at any time"]
Branch name: renovate/pin-dependencies
Merge into: main
Pin actions/checkout to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
Pin actions/checkout to 11d5960a326750d5838078e36cf38b85af677262
Pin actions/github-script to ed597411d8f924073f98dfc5c65a23a2325f34cd
Pin actions/setup-node to 49933ea5288caeca8642d1e84afbd3f7d6820020
Pin actions/upload-artifact to ea165f8d65b6e75b540449e92b4886f43607fa02
Pin node to v26.9.0
Pin npm to 10.9.9

fix(deps): update dependency npm ( 10.9.4 ➔ 10.9.9 )

Schedule: ["at any time"]
Branch name: renovate/npm-10.9.x
Merge into: main
Upgrade npm to 10.9.9

fix(deps): update node.js ( v20.20.0 ➔ v20.20.2 )

Schedule: ["at any time"]
Branch name: renovate/node-20.20.x
Merge into: main
Upgrade node to 20.20.2

feat(deps): update mariadb docker tag ( 12.1.2 ➔ 12.3.3 )

Schedule: ["at any time"]
Branch name: renovate/mariadb-12.x
Merge into: main
Upgrade mariadb to sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1

ci(actions): Update actions/checkout action ( v4.4.0 ➔ v5.1.0 )

Schedule: ["at any time"]
Branch name: renovate/actions-checkout-5.x
Merge into: main
Upgrade actions/checkout to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09

ci(actions): Update actions/checkout action to v6.1.0

Schedule: ["at any time"]
Branch name: renovate/actions-checkout-6.x
Merge into: main
Upgrade actions/checkout to d23441a48e516b6c34aea4fa41551a30e30af803

ci(actions): Update actions/checkout action to v7.0.1

Schedule: ["at any time"]
Branch name: renovate/actions-checkout-7.x
Merge into: main
Upgrade actions/checkout to 3d3c42e5aac5ba805825da76410c181273ba90b1

ci(actions): Update actions/github-script action ( v8.0.0 ➔ v9.0.0 )

Schedule: ["at any time"]
Branch name: renovate/actions-github-script-9.x
Merge into: main
Upgrade actions/github-script to 3a2844b7e9c422d3c10d287c895573f7108da1b3

ci(actions): Update actions/setup-node action ( v4.4.0 ➔ v5.0.0 )

Schedule: ["at any time"]
Branch name: renovate/actions-setup-node-5.x
Merge into: main
Upgrade actions/setup-node to a0853c24544627f65ddf259abe73b1d18a591444

ci(actions): Update actions/setup-node action ( v4.4.0 ➔ v6.5.0 )

Schedule: ["at any time"]
Branch name: renovate/actions-setup-node-6.x
Merge into: main
Upgrade actions/setup-node to 249970729cb0ef3589644e2896645e5dc5ba9c38

ci(actions): Update actions/setup-node action ( v4.4.0 ➔ v7.0.0 )

Schedule: ["at any time"]
Branch name: renovate/actions-setup-node-7.x
Merge into: main
Upgrade actions/setup-node to 820762786026740c76f36085b0efc47a31fe5020

ci(actions): Update actions/upload-artifact action ( v4.6.2 ➔ v5.0.0 )

Schedule: ["at any time"]
Branch name: renovate/major-5-github-artifact-actions
Merge into: main
Upgrade actions/upload-artifact to 330a01c490aca151604b8cf639adc76d48f6c5d4

ci(actions): Update actions/upload-artifact action ( v4.6.2 ➔ v6.0.0 )

Schedule: ["at any time"]
Branch name: renovate/major-6-github-artifact-actions
Merge into: main
Upgrade actions/upload-artifact to b7c566a772e6b6bfb58ed0dc250532a479d7789f

ci(actions): Update actions/upload-artifact action ( v4.6.2 ➔ v7.0.1 )

Schedule: ["at any time"]
Branch name: renovate/major-7-github-artifact-actions
Merge into: main
Upgrade actions/upload-artifact to 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

feat(deps): update node.js ( v20.20.0 ➔ v22.23.2 )

Schedule: ["at any time"]
Branch name: renovate/node-22.x
Merge into: main
Upgrade node to 22.23.2

feat(deps): update node.js ( v20.20.0 ➔ v24.21.0 )

Schedule: ["at any time"]
Branch name: renovate/node-24.x
Merge into: main
Upgrade node to 24.21.0

chore(deps): lock file maintenance

Schedule: ["* 0-3 1 * *"]
Branch name: renovate/lock-file-maintenance
Merge into: main
Regenerate lock files to use latest dependency versions

⚠️ Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

Could not determine new digest for update (docker package alpine)

Could not determine new digest for update (docker package nginx)

Failed to look up docker package postgres: no-result

Failed to look up docker package redis: no-result

Failed to look up docker package nginxinc/nginx-unprivileged: no-result

Failed to look up docker package bitnamilegacy/redis: no-result

Failed to look up docker package bitnamilegacy/mariadb: no-result

Files affected: ops/docker/application/Dockerfile, ops/docker/nginx/Dockerfile, ops/docker/postgres/Dockerfile, ops/docker/redis/Dockerfile, ops/helm/application-application/values.yaml

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

This PR has been generated by Mend Renovate.

Welcome to [Renovate](https://github.com/renovatebot/renovate)! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin. 🚦 Renovate will begin keeping your dependencies up-to-date only once you merge or close this Pull Request. 📚 See our [Reading List](https://docs.renovatebot.com/reading-list/) for relevant documentation you may be interested in reading. 🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to `renovate.json` in this branch. Renovate will update the Pull Request description the next time it runs. --- ### Detected Package Files * `docker-compose.yml` (docker-compose) * `ops/docker/application/Dockerfile` (dockerfile) * `ops/docker/mariadb/Dockerfile` (dockerfile) * `ops/docker/nginx/Dockerfile` (dockerfile) * `ops/docker/postgres/Dockerfile` (dockerfile) * `ops/docker/redis/Dockerfile` (dockerfile) * `.forgejo/workflows/on_docs_change.yml` (github-actions) * `.github/workflows/copilot-setup-steps.yml` (github-actions) * `.github/workflows/gatekeep-ready.agent.lock.yml` (github-actions) * `.github/workflows/issue-triage.agent.lock.yml` (github-actions) * `.github/workflows/on_docs_changed.yml` (github-actions) * `.github/workflows/on_release_published.yml` (github-actions) * `.github/workflows/on_source_changed.yml` (github-actions) * `ops/helm/application-application/values.yaml` (helm-values) * `package.json` (npm) * `renovate.json` (renovate-config) ### Configuration Summary Based on the default config's presets, Renovate will: - Start dependency updates only once this onboarding PR is merged - Forgejo-platform overrides. Two things the platform gets wrong on its own. (1) Forgejo Actions don't populate the commit-status API that Renovate's prCreation:not-pending reads (GET /commits/{sha}/status is empty even on green CI), so not-pending never resolves and PRs hang the full prNotPendingHours. Force immediate PR creation on the Forgejo path. force: because consumers extend :default (not-pending) at the repo level, which only an admin-level force overrides. (2) The github-actions manager assigns datasource github-tags unconditionally, so a `uses:` pointing at a Forgejo-native repo is resolved against api.github.com. Where a github.com twin exists but carries no tags, that returns an empty list rather than an error — the pin freezes silently. The customManager below reads webgrip/* reusable-workflow pins from Forgejo instead. - Enable Renovate Dependency Dashboard creation. - Use semantic commit type `fix` for dependencies and `chore` for all others if semantic commits are in use. - Ignore `node_modules`, `bower_components`, `vendor` and various test/tests (except for nuget) directories. - Group known monorepo packages together. - Use curated list of recommended non-monorepo package groupings. - Show only the Age and Confidence Merge Confidence badges for pull requests. - Apply crowd-sourced package replacement rules. - Apply crowd-sourced workarounds for known problems with packages. - Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff - Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff - Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff - Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff - Correctly link to the source code for golang.org/x packages - Link to pkg.go.dev/... for golang.org/x packages' title - Provide a link to octochangelog's improved breakdown for Renovate's changelogs - Enable Renovate Dependency Dashboard creation. - Use semantic prefixes for commit messages and PR titles. - Separate each `major` version of dependencies into individual branches/PRs. - Raise PR when vulnerability alerts are detected. - Evaluate schedules according to timezone `Europe/Amsterdam`. - Recommended configuration for abandoned packages, treating packages without a release for 1 year as abandoned, while taking into account community-sourced overrides. - Show all Merge Confidence badges for pull requests. - Webgrip org default Renovate preset — strict, conservative defaults for all repositories. Graduated release soak times, per-type semantic commits and labels, OSV vulnerability alerts, and Merge Confidence badges included. Schedule is 'at any time' since 2026-09-18: with dashboard approval required for every update type, nothing opens unattended anyway, so a window only delayed work a human had already asked for — and Renovate does not persist an approval it cannot act on, so a tick made outside the window could be silently discarded (see rule 12). It also fought the move to hourly runs, which was made to cut exactly this kind of latency. A repo that wants quiet hours can set its own schedule. --- ### What to Expect With your current configuration, Renovate will create 17 Pull Requests: <details> <summary>ci(actions): Pin dependencies</summary> - Schedule: ["at any time"] - Branch name: `renovate/pin-dependencies` - Merge into: `main` - Pin [actions/checkout](https://github.com/actions/checkout) to `fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` - Pin [actions/checkout](https://github.com/actions/checkout) to `11d5960a326750d5838078e36cf38b85af677262` - Pin [actions/github-script](https://github.com/actions/github-script) to `ed597411d8f924073f98dfc5c65a23a2325f34cd` - Pin [actions/setup-node](https://github.com/actions/setup-node) to `49933ea5288caeca8642d1e84afbd3f7d6820020` - Pin [actions/upload-artifact](https://github.com/actions/upload-artifact) to `ea165f8d65b6e75b540449e92b4886f43607fa02` - Pin [node](https://github.com/nodejs/node) to `v26.9.0` - Pin [npm](https://github.com/npm/cli) to `10.9.9` </details> <details> <summary>fix(deps): update dependency npm ( 10.9.4 ➔ 10.9.9 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/npm-10.9.x` - Merge into: `main` - Upgrade [npm](https://github.com/npm/cli) to `10.9.9` </details> <details> <summary>fix(deps): update node.js ( v20.20.0 ➔ v20.20.2 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/node-20.20.x` - Merge into: `main` - Upgrade [node](https://github.com/nodejs/node) to `20.20.2` </details> <details> <summary>feat(deps): update mariadb docker tag ( 12.1.2 ➔ 12.3.3 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/mariadb-12.x` - Merge into: `main` - Upgrade mariadb to `sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1` </details> <details> <summary>ci(actions): Update actions/checkout action ( v4.4.0 ➔ v5.1.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-checkout-5.x` - Merge into: `main` - Upgrade [actions/checkout](https://github.com/actions/checkout) to `fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` </details> <details> <summary>ci(actions): Update actions/checkout action to v6.1.0</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-checkout-6.x` - Merge into: `main` - Upgrade [actions/checkout](https://github.com/actions/checkout) to `d23441a48e516b6c34aea4fa41551a30e30af803` </details> <details> <summary>ci(actions): Update actions/checkout action to v7.0.1</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-checkout-7.x` - Merge into: `main` - Upgrade [actions/checkout](https://github.com/actions/checkout) to `3d3c42e5aac5ba805825da76410c181273ba90b1` </details> <details> <summary>ci(actions): Update actions/github-script action ( v8.0.0 ➔ v9.0.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-github-script-9.x` - Merge into: `main` - Upgrade [actions/github-script](https://github.com/actions/github-script) to `3a2844b7e9c422d3c10d287c895573f7108da1b3` </details> <details> <summary>ci(actions): Update actions/setup-node action ( v4.4.0 ➔ v5.0.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-setup-node-5.x` - Merge into: `main` - Upgrade [actions/setup-node](https://github.com/actions/setup-node) to `a0853c24544627f65ddf259abe73b1d18a591444` </details> <details> <summary>ci(actions): Update actions/setup-node action ( v4.4.0 ➔ v6.5.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-setup-node-6.x` - Merge into: `main` - Upgrade [actions/setup-node](https://github.com/actions/setup-node) to `249970729cb0ef3589644e2896645e5dc5ba9c38` </details> <details> <summary>ci(actions): Update actions/setup-node action ( v4.4.0 ➔ v7.0.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/actions-setup-node-7.x` - Merge into: `main` - Upgrade [actions/setup-node](https://github.com/actions/setup-node) to `820762786026740c76f36085b0efc47a31fe5020` </details> <details> <summary>ci(actions): Update actions/upload-artifact action ( v4.6.2 ➔ v5.0.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/major-5-github-artifact-actions` - Merge into: `main` - Upgrade [actions/upload-artifact](https://github.com/actions/upload-artifact) to `330a01c490aca151604b8cf639adc76d48f6c5d4` </details> <details> <summary>ci(actions): Update actions/upload-artifact action ( v4.6.2 ➔ v6.0.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/major-6-github-artifact-actions` - Merge into: `main` - Upgrade [actions/upload-artifact](https://github.com/actions/upload-artifact) to `b7c566a772e6b6bfb58ed0dc250532a479d7789f` </details> <details> <summary>ci(actions): Update actions/upload-artifact action ( v4.6.2 ➔ v7.0.1 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/major-7-github-artifact-actions` - Merge into: `main` - Upgrade [actions/upload-artifact](https://github.com/actions/upload-artifact) to `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` </details> <details> <summary>feat(deps): update node.js ( v20.20.0 ➔ v22.23.2 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/node-22.x` - Merge into: `main` - Upgrade [node](https://github.com/nodejs/node) to `22.23.2` </details> <details> <summary>feat(deps): update node.js ( v20.20.0 ➔ v24.21.0 )</summary> - Schedule: ["at any time"] - Branch name: `renovate/node-24.x` - Merge into: `main` - Upgrade [node](https://github.com/nodejs/node) to `24.21.0` </details> <details> <summary>chore(deps): lock file maintenance</summary> - Schedule: ["* 0-3 1 * *"] - Branch name: `renovate/lock-file-maintenance` - Merge into: `main` - Regenerate lock files to use latest dependency versions </details> --- > > ⚠️ **Warning** > > Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR. > > - `Could not determine new digest for update (docker package alpine)` > - `Could not determine new digest for update (docker package nginx)` > - `Failed to look up docker package postgres: no-result` > - `Failed to look up docker package redis: no-result` > - `Failed to look up docker package nginxinc/nginx-unprivileged: no-result` > - `Failed to look up docker package bitnamilegacy/redis: no-result` > - `Failed to look up docker package bitnamilegacy/mariadb: no-result` > > Files affected: `ops/docker/application/Dockerfile`, `ops/docker/nginx/Dockerfile`, `ops/docker/postgres/Dockerfile`, `ops/docker/redis/Dockerfile`, `ops/helm/application-application/values.yaml` --- ❓ Got questions? Check out Renovate's [Docs](https://docs.renovatebot.com/), particularly the Getting Started section. If you need any further assistance then you can also [request help here](https://github.com/renovatebot/renovate/discussions). --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-07-18 07:03:23 +00:00

chore(deps): add renovate.json b78bdab9c8

renovate changed title from ~~chore: Configure Renovate~~ to chore: Configure Renovate - autoclosed

2026-09-22 06:35:34 +00:00

renovate closed this pull request

2026-09-22 06:35:34 +00:00