Adjusted Renovate config

[awanlin]

Updated the Renovate config to match changes suggested by backstage/backstage#22479

[awanlin]

Hi @secustor, just applied the changes you suggested in the main Backstage repo to the Demo site. When you have time could you give these a quick look? Code base here is much smaller so I didn't change the default PR limit but I did disable :pinDigest as I worry about getting a lot of PRs from that much like the upstream Backstage repo. Trying to strike a balance between keeping things up to date but having a limited amount of time to do so.

[secustor]

Instead of dropping pinning I suggest to use automerge.
With automergeType: branch you can only surface PRs if the pipeline is failing.
From a noise level it does not make difference as you will still get updates for each of your dependencies.

The noise reduction guide is also a good read to reduce your mental load of keeping up to date.

Your packageRule can also be simplified using templating:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:best-practices", ":gitSignOff"],
  "ignorePresets": [":pinDevDependencies", ":pinDigest"],
  "postUpdateOptions": ["yarnDedupeHighest"],
  "rangeStrategy": "update-lockfile",
  "labels": ["dependencies"],
  "packageRules": [
    {
      "matchUpdateTypes": ["major", "minor", "patch"],
      "addLabels": ["{{ updateType }}"]
    },
    {
      "matchSourceUrls": ["https://github.com/yarnpkg/berry"],
      "enabled": false
    },
    {
      "matchPackagePatterns": ["@backstage"],
      "matchManagers": ["npm"],
      "enabled": false
    }
  ],
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "addLabels": ["security"],
    "enabled": true
  }
}

[awanlin]

Thanks for the feedback and links @secustor! I'm not sure I'm at the place where auto merge makes sense, perhaps in the future. I did make the changes to use templating, that's nice, and I'm going to keep pinDigest so we can see what the results are like.

[freben]

let's try!

[freben]

@secustor i tried disabling pinning in https://github.com/backstage/backstage/blob/645e1cbda55800e28d574a0f1823dce8073611ee/.github/renovate.json5#L12 but seems it still insists on pinning at least docker things backstage/backstage#23026

[awanlin]

Thanks @freben 🚀