remove dependabot, add renovatebot config and gha - #1110
Conversation
| name: renovatebot | ||
|
|
||
| on: | ||
| schedule: |
There was a problem hiding this comment.
Increase this frequency as needed @rekmarks. We use 2 weeks per our ISO27k1 policy in protocols.
| "packageRules": [ | ||
| { | ||
| "matchManagers": ["npm"], | ||
| "enabled": false |
There was a problem hiding this comment.
Disable the automagic ones to use the rules below
| { | ||
| "description": "Pin and group GitHub Actions updates for actions/* and MetaMask/*", | ||
| "matchManagers": ["github-actions"], | ||
| "matchPackagePrefixes": ["actions/", "MetaMask/"], |
There was a problem hiding this comment.
Used the same rules in dependabot here too
| "matchPackagePrefixes": ["actions/", "MetaMask/"], | ||
| "enabled": true, | ||
| "pinDigests": true, | ||
| "minimumReleaseAge": "7 days", |
There was a problem hiding this comment.
This guarantees stability. A new version has to be in the wild at least 1 week without anyone yelling and we don't have zero day vulns but updating blindly
| "matchPackagePrefixes": ["Consensys-Incorporated/github-actions"], | ||
| "enabled": true, | ||
| "pinDigests": true, | ||
| "minimumReleaseAge": "0 days" |
There was a problem hiding this comment.
0 days here because we follow the 7 day rule in github-actions
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
f3ca144 to
0408965
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0408965. Configure here.
| "enabled": true, | ||
| "rangeStrategy": "bump", | ||
| "minimumReleaseAge": "7 days", | ||
| "schedule": ["before 7am"], |
There was a problem hiding this comment.
npm schedule blocks manual Renovate runs
Medium Severity
The npm rule sets schedule to before 7am, and Renovate still enforces that window when the workflow is started by workflow_dispatch or a delayed cron. Manual runs after 07:00 UTC silently skip every @metamask/, @agoric/, @endo/, and ses update, so the dispatch escape hatch does not actually refresh npm dependencies.
Reviewed by Cursor Bugbot for commit 0408965. Configure here.
| "minimumReleaseAge": "7 days", | ||
| "schedule": ["before 7am"], | ||
| "groupName": "npm dependencies" | ||
| } |
There was a problem hiding this comment.
Renovate skips yarn lockfile dedupe
Medium Severity
Renovate npm updates do not run yarn dedupe, and the existing dedupe workflow only runs for dependabot[bot]. This repo's lint job fails when yarn.lock can still be deduplicated, so grouped npm PRs can fail CI and stay unmergeable.
Reviewed by Cursor Bugbot for commit 0408965. Configure here.
1 participant
Moving to using sha's on every action until we do a formal review in CI. This will unblock ocap devs for the immediate future
Note
Low Risk
CI-only dependency automation swap; requires the security environment secrets and app to be configured for Renovate to run successfully.
Overview
Replaces Dependabot with Renovate for automated dependency updates by deleting
.github/dependabot.ymland addingrenovate.jsonplus a scheduled GitHub Actions workflow.The new
renovatebotworkflow runs twice monthly (and on manual dispatch) in thesecurityenvironment, using a Consensys GitHub App (GH_APP_ID,GH_PRIVATE_KEY) to execute Renovate via a pinned composite action.renovate.jsonmirrors the old Dependabot scope: grouped npm bumps for@metamask/*,@agoric/*,@endo/*, andses(7-day minimum release age, daily-before-7am schedule), and grouped GitHub Actions updates foractions/*andMetaMask/*with digest pinning and a 7-day delay. Updates forConsensys-Incorporated/github-actionsare allowed immediately with digest pinning.Reviewed by Cursor Bugbot for commit 0408965. Bugbot is set up for automated code reviews on this repo. Configure here.