chore(renovate): close the Dependency Dashboard when nothing is pending - #176

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

 ___________________________________________________________
< GPU shortage? The only thing I fear is a carrot shortage. >
 -----------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Independent local review

Reviewed head: c28e7cd4ee46b54e410806be1a145ab7f8a42470

Verdict: safe to merge. No blocking findings. Two wording corrections to the PR description are listed under "Fix in PR"; neither changes the code.

What was checked

• Diff scope: one added line in renovate.json, "dependencyDashboardAutoclose": true. No other file is touched. The file parses as JSON and the option sits at the top level, not inside a packageRules entry.
• Option name and meaning: the Renovate configuration docs describe it as: "You can configure this to true if you prefer Renovate to close an existing Dependency Dashboard whenever there are no outstanding PRs left." It is a boolean, default false.
• Exact closing condition (read from Renovate's dashboard source): the issue is closed only when there are no branches at all and no deprecation/replacement notices. "Branches" includes updates pending approval, awaiting schedule, rate-limited by prConcurrentLimit, open PRs, and closed/ignored PRs. When any of these exists again, Renovate reopens the previously closed issue rather than creating a new one.
• dependencyDashboardApproval on the java major rule: a java major waiting for approval is a branch in the "pending approval" state, so it keeps the dashboard open (or reopens it) and the approval checkbox stays reachable. The expectation in "Not covered" is correct.
• schedule and prConcurrentLimit: updates held back by either one also count as branches, so they keep the dashboard open. Autoclose does not hide them.
• Disabled updates (node major, npm minor/patch): these produce no branch, so they never hold the dashboard open. This matches the intent.
• Config validation: renovate-config-validator --strict --no-global renovate.json accepts the config as a repository config. The validator could not load its RE2 module locally and fell back to the built-in regex engine, so regex checks of the custom managers are slightly weaker than in production.
• CI and comments: the workflow validation and secret-scan checks pass. There are no human review comments.

What is given up while the dashboard is closed

This is the expected trade-off of the option, not a defect:

• The "Detected Dependencies" list is not available. It is currently the only overview of what the custom regex managers actually match.
• The "Repository problems" section is not shown. A lookup or extraction failure that produces no update (for example a custom manager pattern that stops matching, or a datasource error) creates no branch, so it does not reopen the dashboard and would go unnoticed there.
• The manual "trigger Renovate to run again" checkbox is unavailable. Renovate only reads an open dashboard issue, so ticking a box in the closed issue has no effect.
• The same applies to a config-migration checkbox and to abandoned-dependency notices.

Blocking

none

Fix in PR

• Description, "Verification": renovate-config-validator renovate.json validates the file as a global config when a filename is passed. The repository-config check is renovate-config-validator --no-global renovate.json. That variant also passes, so the conclusion stands; only the quoted command should be corrected.
• Description, "Change": "closes the Dependency Dashboard issue while it has nothing to list" is imprecise. Renovate closes it when there are no branches and no deprecation/replacement notices, even though it would still list detected dependencies and repository problems. The description should name what is not visible while the issue is closed (see the section above).

Follow-up

none

Not covered

• The behaviour was not observed on a live Renovate run; the closing and reopening logic was verified by reading Renovate's documentation and source, not by execution.
• Whether the hosted Renovate app reacts to a checkbox ticked in a closed dashboard issue was not tested; the source indicates it does not.
• The automated CodeRabbit review was still in progress at review time and had posted no findings yet.

Independent local review

Reviewed head: c28e7cd4ee46b54e410806be1a145ab7f8a42470

Verdict: safe to merge. No blocking findings. Both earlier findings are resolved. One new wording correction to the description is listed under "Fix in PR"; it does not change the code.

Earlier findings

• Description, "Verification" (fix in PR): resolved. The description now quotes renovate-config-validator --strict --no-global renovate.json, which validates the file as a repository config. Re-running that command accepts the config.
• Description, "Change" (fix in PR): resolved. The closing condition is now stated correctly: no outstanding branches or pull requests and no deprecation or replacement notices.

What was checked

• Head and diff: the head commit is unchanged since the first review. The diff is still one added line in renovate.json, "dependencyDashboardAutoclose": true, at the top level.
• Closing and reopening: matches Renovate's dashboard source. The docs describe the option as: "You can configure this to true if you prefer Renovate to close an existing Dependency Dashboard whenever there are no outstanding PRs left." When something is outstanding again, Renovate reopens the previously closed issue.
• "Keeps it open" list: accurate. Pending approval (including the java major rule with dependencyDashboardApproval), awaiting schedule, rate-limited, open pull requests and closed/ignored pull requests are all branches in Renovate's sense, and any branch keeps the dashboard open.
• "A repository problem that produces no update does not reopen the dashboard": accurate. Repository problems are not part of the closing condition.
• List of affected dashboard parts: the five parts named (detected dependencies, repository problems, manual re-run checkbox, config-migration checkbox, abandoned-dependency notices) are all written only after the point where Renovate closes the issue and stops, so the list itself is complete for this configuration.
• "Not covered": accurate.
• CI and comments: the workflow validation and secret-scan checks pass. There are no human review comments and no inline review comments.

Blocking

none

Fix in PR

• Description, "While the dashboard is closed, these parts of it are not visible": "not visible" is inaccurate. Closing only changes the issue state; Renovate does not edit or clear the body. The closed issue therefore still shows the content from the last run before it was closed, including the "Detected Dependencies" list. What actually changes is that these parts are no longer updated (they go stale), and that checkboxes ticked in the closed issue are not acted on, because Renovate only reads an open dashboard issue. Suggested wording: "While the dashboard is closed, these parts are no longer updated and its checkboxes are not acted on: …". The first review's own wording ("not available", "not shown") was loose in the same way.

Follow-up

none

Not covered

• The behaviour was not observed on a live Renovate run; closing, reopening and the stale-body behaviour were verified by reading Renovate's documentation and source, not by execution.
• Whether the hosted Renovate app reacts to a checkbox ticked in a closed dashboard issue was not tested; the source indicates it does not.
• The automated CodeRabbit review was still in progress at review time and had posted no findings.

Independent local review

Reviewed head: c28e7cd4ee46b54e410806be1a145ab7f8a42470

Verdict: no open findings. The change was safe to merge and the description is now accurate. Note: this pull request had already been merged when this third pass ran, so this comment confirms the final state rather than gating the merge.

Earlier findings

• Description, "Verification" command (fix in PR): resolved in the previous pass.
• Description, closing condition (fix in PR): resolved in the previous pass.
• Description, "not visible while closed" (fix in PR): resolved. The description now says that closing only changes the issue state, that the closed issue keeps its last content, and that while closed the content is no longer updated and its checkboxes are not read. This matches Renovate's behaviour: closing sets the issue state only and leaves the body untouched, and Renovate looks up only an open dashboard issue when reading checkboxes.

What was checked

• Head and diff: the head commit is unchanged across all three passes. The change is one added line in renovate.json, "dependencyDashboardAutoclose": true, at the top level. The squash commit on main contains exactly that line and nothing else.
• Every statement in the current description, against Renovate's documentation and source:
  • Closing condition and reopening: accurate. The docs describe the option as: "You can configure this to true if you prefer Renovate to close an existing Dependency Dashboard whenever there are no outstanding PRs left."
  • What keeps the dashboard open (pending approval including the java major rule, awaiting schedule, rate-limited, open and ignored pull requests): accurate.
  • Closed issue keeps its content, is not updated, checkboxes not read: accurate.
  • Affected parts (detected dependencies, repository problems, manual re-run checkbox, config-migration checkbox, abandoned-dependency notices): accurate.
  • "A repository problem that produces no update does not reopen the dashboard": accurate.
  • "Verification" and "Not covered": accurate.
• CI and comments: the workflow validation and secret-scan checks passed. There are no human review comments and no inline review comments.

Blocking

none

Fix in PR

none

Follow-up

none

Not covered

• The behaviour was not observed on a live Renovate run; it was verified by reading Renovate's documentation and source, not by execution.
• Whether the hosted Renovate app reacts to a checkbox ticked in a closed dashboard issue was not tested; the source indicates it does not.
• The automated CodeRabbit review was still in progress at merge time and at review time, and had posted no findings.