Repository navigation
Replace Dependabot with Renovate auto-merge; pin cyclopts - #43
Merged
Merged
Conversation
- dependabot-auto-merge: drop the `workflows: write` permission. It is not a valid GITHUB_TOKEN scope, so GitHub rejected the whole workflow file and logged a failed "push" run on every commit to main; auto-merge never ran. - renovate: keep cyclopts below 4, matching the pin in pyproject.toml (cyclopts>=4 always sys.exit()s from App.__call__; cyclopts>=5 needs Python>=3.11 while we support >=3.9). Stops Renovate reopening #22. Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d
Dependabot and Renovate were both proposing the same updates, producing duplicate PRs. Keep Renovate only: - delete .github/dependabot.yml (version updates for github-actions and uv) - delete .github/workflows/dependabot-auto-merge.yaml, which only served Dependabot PRs (this supersedes the permission fix in the previous commit) Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d
woutervh
changed the title
- auto-merge minor/patch/digest/pin updates and monthly lock file maintenance; majors stay manual - minimumReleaseAge 7 days, so freshly published (possibly yanked) releases are never auto-merged - platformAutomerge=false: main has no required status checks, so GitHub native auto-merge would merge without waiting for CI. Renovate merges itself only once every check on the branch has passed. Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d
woutervh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/dependabot.yml.github/workflows/dependabot-auto-merge.yaml. It only served Dependabot PRs, and it was broken anyway:permissions: workflows: writeis not a validGITHUB_TOKENscope, so GitHub rejected the file and logged a failed "push" run on every commit tomain.minimumReleaseAge: 7 days, so brand-new (possibly yanked) releases are never auto-mergedplatformAutomerge: false:mainhas no branch protection or required status checks, so GitHub native auto-merge would merge without waiting for CI. Renovate merges itself, and only once every check on the branch has passed.dependencieslabelcycloptsbelow 4, matching the pin inpyproject.toml. cyclopts>=4 alwayssys.exit()s fromApp.__call__(breaks CLI tests), and cyclopts 5 needs Python>=3.11 while we support >=3.9. This stops Renovate reopening Update dependency cyclopts to v5 #22.Not changed
Validation
renovate-config-validator(renovate 41): config validated successfullyhttps://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d