Automate Dependency Updates with Renovate

1. Add a repository-level Renovate configuration with grouped updates, digest pinning, a weekly schedule, and conservative concurrency limits.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":dependencyDashboard", ":semanticCommits"],
  "timezone": "UTC",
  "schedule": ["before 6am on Monday"],
  "prConcurrentLimit": 4,
  "prHourlyLimit": 2,
  "rangeStrategy": "bump",
  "packageRules": [
    {
      "description": "Group non-major dev dependency updates",
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "dev dependencies (non-major)"
    },
    {
      "description": "Automerge patch updates for established packages after CI",
      "matchUpdateTypes": ["patch"],
      "matchCurrentVersion": ">=1.0.0",
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    },
    {
      "description": "Pin GitHub Actions to commit SHAs",
      "matchManagers": ["github-actions"],
      "pinDigests": true
    },
    {
      "description": "Require dashboard approval for major updates",
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"]
  },
  "osvVulnerabilityAlerts": true
}

Expected output: renovate.json exists at the repository root with a valid schema URL, four package rules, and a dependency dashboard preset.

2. Validate the configuration with the validator shipped in the Renovate package before opening a pull request.

npx --yes --package renovate renovate-config-validator renovate.json

Expected output: The validator prints Validating renovate.json followed by Config validated successfully and exits 0.

3. Commit the configuration on a branch and open a pull request against the protected default branch.

git checkout -b chore/renovate
git add renovate.json
git commit -m "chore: add renovate configuration"
git push -u origin chore/renovate
gh pr create \
  --title "chore: add renovate configuration" \
  --body "Enables grouped dependency updates, GitHub Actions SHA pinning, and CI-gated automerge." \
  --base "$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')"

Expected output: The branch is pushed, a pull request is created, and the required CI checks start against the new configuration.

4. After merging, confirm that Renovate created the Dependency Dashboard issue and is discovering dependencies.

gh issue list --search "Dependency Dashboard in:title" \
  --json number,title,state --limit 1

Expected output: One open issue titled Dependency Dashboard is returned, and its body lists pending updates and major-version approvals.

5. Inspect the first update pull requests, confirm that non-major dev updates are grouped, and check that an Actions update is pinned to a full SHA.

gh pr list --label dependencies \
  --json number,title,headRefName,isDraft --limit 10

pr=$(gh pr list --search "actions/checkout" --json number --jq '.[0].number')
gh pr diff "$pr" | grep 'uses: actions/checkout@'

Expected output: The PR list shows a grouped dev-dependencies update, while major updates appear on the dashboard as approval items rather than open PRs; the checkout diff shows a 40-character commit SHA instead of a mutable tag.

6. Inspect every open dependency pull request and confirm that at least one automerge candidate has native auto-merge enabled and all checks successful.

gh pr list --label dependencies --json number --jq '.[].number' | while read -r pr; do
  gh pr view "$pr" \
    --json number,title,autoMergeRequest,statusCheckRollup \
    --jq '{number, title, autoMerge: (.autoMergeRequest != null), checks: [.statusCheckRollup[]?.conclusion]}'
done

Expected output: At least one PR reports autoMerge true and a checks array containing SUCCESS; PRs waiting on checks report an empty or pending conclusion and do not merge.

Problem

Renovate never opens an onboarding pull request

Solution

Confirm the Renovate app is installed on this repository and has permission to read metadata and write pull requests. Check the app dashboard for a configuration error.

Problem

The repository receives too many pull requests

Solution

Lower prConcurrentLimit and prHourlyLimit, add groupName rules for related packages, and move minor updates to a weekly schedule.

Problem

Automerge is enabled but the pull request stays open

Solution

Branch protection is waiting on a required check, the native auto-merge feature is disabled for the repository, or the app lacks write permission. Read the PR checks and merge state.

Problem

GitHub Actions remain on mutable tags

Solution

pinDigests only applies to the github-actions manager. Verify matchManagers, and ensure workflows reference remote actions rather than local composite actions.