Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(Renovate): improve security posture of setup and other general improvements #22479

Merged
merged 5 commits into from
Feb 3, 2024
Merged

chore(Renovate): improve security posture of setup and other general improvements #22479

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
233045d
chore(Renovate): add schema for intellisense in editors
secustor Jan 23, 2024
c2dcfe4
chore(Renovate): use config:recommended to get community groupings an…
secustor Jan 23, 2024
ac08102
chore(Renovate): double concurrent PR limit to 20
secustor Jan 23, 2024
0c120f4
chore(Renovate): use-bestpractices like pinning docker images
secustor Jan 23, 2024
d766570
prettier
secustor Jan 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 10 additions & 1 deletion .github/renovate.json5
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
{
$schema: 'https://docs.renovatebot.com/renovate-schema.json',

labels: ['dependencies'],
extends: ['config:base', ':disableDependencyDashboard', ':gitSignOff'],
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is just more curiosity on my part but why do you recommend enabling the dependency dashboard? If you have some documentation on this I'm fine with you just pointing me that way 👍

Some background, I help support the Backstage Demo site (https://github.com/backstage/demo) and often help people on the Backstage Discord server. I'm slowly working on a tutorial with some guidance on using Renovate with Backstage.

Copy link
Contributor Author

@secustor secustor Jan 27, 2024 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dashboard is our main way to communicate with users. We show there ignored ( manually closed ) updates, rate limited ones ( because the concurrency limit has been reached ) and error. From there you can also can force a recreation of PRs.
https://docs.renovatebot.com/key-concepts/dashboard/

Looking forward to it! I'm working on a blog regarding Backstage and Renovate too.

See renovatebot/renovate#2958 as an example.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the links! Do you have insights on using the Dependency Dashboard (which is basically a public issue) versus using the this - https://developer.mend.io/github/backstage/backstage - which does the same things but isn't public as best as I can tell. Also, for larger projects how do you handle that the issue can get lost in all the other issues? Do you just recommend pinning it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The developer portal is as far as I know also public, an exception are the logs of Renovate runs. Be aware that I have no insight how it functions in the background as this is part of Mends setup and not of the OSS project. Therefore could be that the portal does not show everything from the issue or vice versa.

Yes, we recommend pinning the issue, but it is also possible to give it a better searchable name or specific labels for better discovery.
https://docs.renovatebot.com/configuration-options/#dependencydashboardtitle
https://docs.renovatebot.com/configuration-options/#dependencydashboardlabels

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks again for the reply, appreciate it! 🚀


extends: ['config:best-practices', ':gitSignOff'],
// do not pin dev dependencies, which are part of the best-practices preset
ignorePresets: [':pinDevDependencies'],

// the default limit are 10 PRs
prConcurrentLimit: 20,

postUpdateOptions: ['yarnDedupeHighest'],
rangeStrategy: 'update-lockfile',
// @elastic/elasticsearch is ignored due to licensing issues. See #10992
Expand Down