chore(renovate): close the Dependency Dashboard when nothing is pending

[tehw0lf]

Change

Sets dependencyDashboardAutoclose: true in renovate.json. Renovate then closes the Dependency Dashboard issue when there are no outstanding branches or pull requests and no deprecation or replacement notices, and reopens it when there are, instead of keeping the dashboard open permanently.

Entries that wait in the dashboard count as outstanding and keep it open: pending approval (the java major rule uses dependencyDashboardApproval), awaiting schedule, rate-limited, open and ignored pull requests.

Closing only changes the issue state; the closed issue keeps its last content. While it is closed that content is no longer updated and its checkboxes are not read. This affects the "Detected Dependencies" list, the "Repository problems" section, the manual re-run checkbox, the config-migration checkbox and abandoned-dependency notices. A repository problem that produces no update does not reopen the dashboard.

Verification

• renovate-config-validator --strict --no-global renovate.json accepts the config as a repository config.

Not covered

• The behaviour itself only shows on Renovate's next run.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: a1f31850-d1c4-44af-b02d-7cc6da4750f8

📥 Commits

Reviewing files that changed from the base of the PR and between f183c37 and c28e7cd.

📒 Files selected for processing (1)

• renovate.json

 ___________________________________________________________
< GPU shortage? The only thing I fear is a carrot shortage. >
 -----------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[tehw0lf]

Independent local review

Reviewed head: c28e7cd4ee46b54e410806be1a145ab7f8a42470

Verdict: safe to merge. No blocking findings. Two wording corrections to the PR description are listed under "Fix in PR"; neither changes the code.

What was checked

• Diff scope: one added line in renovate.json, "dependencyDashboardAutoclose": true. No other file is touched. The file parses as JSON and the option sits at the top level, not inside a packageRules entry.
• Option name and meaning: the Renovate configuration docs describe it as: "You can configure this to true if you prefer Renovate to close an existing Dependency Dashboard whenever there are no outstanding PRs left." It is a boolean, default false.
• Exact closing condition (read from Renovate's dashboard source): the issue is closed only when there are no branches at all and no deprecation/replacement notices. "Branches" includes updates pending approval, awaiting schedule, rate-limited by prConcurrentLimit, open PRs, and closed/ignored PRs. When any of these exists again, Renovate reopens the previously closed issue rather than creating a new one.
• dependencyDashboardApproval on the java major rule: a java major waiting for approval is a branch in the "pending approval" state, so it keeps the dashboard open (or reopens it) and the approval checkbox stays reachable. The expectation in "Not covered" is correct.
• schedule and prConcurrentLimit: updates held back by either one also count as branches, so they keep the dashboard open. Autoclose does not hide them.
• Disabled updates (node major, npm minor/patch): these produce no branch, so they never hold the dashboard open. This matches the intent.
• Config validation: renovate-config-validator --strict --no-global renovate.json accepts the config as a repository config. The validator could not load its RE2 module locally and fell back to the built-in regex engine, so regex checks of the custom managers are slightly weaker than in production.
• CI and comments: the workflow validation and secret-scan checks pass. There are no human review comments.

What is given up while the dashboard is closed

This is the expected trade-off of the option, not a defect:

• The "Detected Dependencies" list is not available. It is currently the only overview of what the custom regex managers actually match.
• The "Repository problems" section is not shown. A lookup or extraction failure that produces no update (for example a custom manager pattern that stops matching, or a datasource error) creates no branch, so it does not reopen the dashboard and would go unnoticed there.
• The manual "trigger Renovate to run again" checkbox is unavailable. Renovate only reads an open dashboard issue, so ticking a box in the closed issue has no effect.
• The same applies to a config-migration checkbox and to abandoned-dependency notices.

Blocking

none

Fix in PR

• Description, "Verification": renovate-config-validator renovate.json validates the file as a global config when a filename is passed. The repository-config check is renovate-config-validator --no-global renovate.json. That variant also passes, so the conclusion stands; only the quoted command should be corrected.
• Description, "Change": "closes the Dependency Dashboard issue while it has nothing to list" is imprecise. Renovate closes it when there are no branches and no deprecation/replacement notices, even though it would still list detected dependencies and repository problems. The description should name what is not visible while the issue is closed (see the section above).

Follow-up

none

Not covered

• The behaviour was not observed on a live Renovate run; the closing and reopening logic was verified by reading Renovate's documentation and source, not by execution.
• Whether the hosted Renovate app reacts to a checkbox ticked in a closed dashboard issue was not tested; the source indicates it does not.
• The automated CodeRabbit review was still in progress at review time and had posted no findings yet.

[tehw0lf]

Independent local review

Reviewed head: c28e7cd4ee46b54e410806be1a145ab7f8a42470

Verdict: safe to merge. No blocking findings. Both earlier findings are resolved. One new wording correction to the description is listed under "Fix in PR"; it does not change the code.

Earlier findings

• Description, "Verification" (fix in PR): resolved. The description now quotes renovate-config-validator --strict --no-global renovate.json, which validates the file as a repository config. Re-running that command accepts the config.
• Description, "Change" (fix in PR): resolved. The closing condition is now stated correctly: no outstanding branches or pull requests and no deprecation or replacement notices.

What was checked

• Head and diff: the head commit is unchanged since the first review. The diff is still one added line in renovate.json, "dependencyDashboardAutoclose": true, at the top level.
• Closing and reopening: matches Renovate's dashboard source. The docs describe the option as: "You can configure this to true if you prefer Renovate to close an existing Dependency Dashboard whenever there are no outstanding PRs left." When something is outstanding again, Renovate reopens the previously closed issue.
• "Keeps it open" list: accurate. Pending approval (including the java major rule with dependencyDashboardApproval), awaiting schedule, rate-limited, open pull requests and closed/ignored pull requests are all branches in Renovate's sense, and any branch keeps the dashboard open.
• "A repository problem that produces no update does not reopen the dashboard": accurate. Repository problems are not part of the closing condition.
• List of affected dashboard parts: the five parts named (detected dependencies, repository problems, manual re-run checkbox, config-migration checkbox, abandoned-dependency notices) are all written only after the point where Renovate closes the issue and stops, so the list itself is complete for this configuration.
• "Not covered": accurate.
• CI and comments: the workflow validation and secret-scan checks pass. There are no human review comments and no inline review comments.

Blocking

none

Fix in PR

• Description, "While the dashboard is closed, these parts of it are not visible": "not visible" is inaccurate. Closing only changes the issue state; Renovate does not edit or clear the body. The closed issue therefore still shows the content from the last run before it was closed, including the "Detected Dependencies" list. What actually changes is that these parts are no longer updated (they go stale), and that checkboxes ticked in the closed issue are not acted on, because Renovate only reads an open dashboard issue. Suggested wording: "While the dashboard is closed, these parts are no longer updated and its checkboxes are not acted on: …". The first review's own wording ("not available", "not shown") was loose in the same way.

Follow-up

none

Not covered

• The behaviour was not observed on a live Renovate run; closing, reopening and the stale-body behaviour were verified by reading Renovate's documentation and source, not by execution.
• Whether the hosted Renovate app reacts to a checkbox ticked in a closed dashboard issue was not tested; the source indicates it does not.
• The automated CodeRabbit review was still in progress at review time and had posted no findings.

[tehw0lf]

Independent local review

Reviewed head: c28e7cd4ee46b54e410806be1a145ab7f8a42470

Verdict: no open findings. The change was safe to merge and the description is now accurate. Note: this pull request had already been merged when this third pass ran, so this comment confirms the final state rather than gating the merge.

Earlier findings

• Description, "Verification" command (fix in PR): resolved in the previous pass.
• Description, closing condition (fix in PR): resolved in the previous pass.
• Description, "not visible while closed" (fix in PR): resolved. The description now says that closing only changes the issue state, that the closed issue keeps its last content, and that while closed the content is no longer updated and its checkboxes are not read. This matches Renovate's behaviour: closing sets the issue state only and leaves the body untouched, and Renovate looks up only an open dashboard issue when reading checkboxes.

What was checked

• Head and diff: the head commit is unchanged across all three passes. The change is one added line in renovate.json, "dependencyDashboardAutoclose": true, at the top level. The squash commit on main contains exactly that line and nothing else.
• Every statement in the current description, against Renovate's documentation and source:
  • Closing condition and reopening: accurate. The docs describe the option as: "You can configure this to true if you prefer Renovate to close an existing Dependency Dashboard whenever there are no outstanding PRs left."
  • What keeps the dashboard open (pending approval including the java major rule, awaiting schedule, rate-limited, open and ignored pull requests): accurate.
  • Closed issue keeps its content, is not updated, checkboxes not read: accurate.
  • Affected parts (detected dependencies, repository problems, manual re-run checkbox, config-migration checkbox, abandoned-dependency notices): accurate.
  • "A repository problem that produces no update does not reopen the dashboard": accurate.
  • "Verification" and "Not covered": accurate.
• CI and comments: the workflow validation and secret-scan checks passed. There are no human review comments and no inline review comments.

Blocking

none

Fix in PR

none

Follow-up

none

Not covered

• The behaviour was not observed on a live Renovate run; it was verified by reading Renovate's documentation and source, not by execution.
• Whether the hosted Renovate app reacts to a checkbox ticked in a closed dashboard issue was not tested; the source indicates it does not.
• The automated CodeRabbit review was still in progress at merge time and at review time, and had posted no findings.