From e827376b7aab6410092d2851a95164d84b32650b Mon Sep 17 00:00:00 2001 From: MK Date: Sun, 16 Aug 2026 17:58:44 +0800 Subject: [PATCH 1/2] feat: ship a Renovate preset and dependency-bot docs for lockstep updates Every vp create / vp migrate project carries vite-plus plus the vite alias (npm:@voidzero-dev/vite-plus-core@), and vp test projects a pinned vitest override. Dependency bots update each package in its own PR, splitting the lockstep set. The root default.json is a shared Renovate preset, consumed as "extends": ["github>voidzero-dev/vite-plus"]. It groups vite-plus, @voidzero-dev/vite-plus-*, vitest, and @vitest/* into one PR and sets minimumReleaseAge and schedule on the group so no other rule can split member eligibility. The CI guide documents the preset and an equivalent Dependabot groups config, and the migration guide points at it from the overrides section. Refs #2356 --- default.json | 13 +++++++++++++ docs/guide/ci.md | 41 +++++++++++++++++++++++++++++++++++++++++ docs/guide/migrate.md | 2 ++ 3 files changed, 56 insertions(+) create mode 100644 default.json diff --git a/default.json b/default.json new file mode 100644 index 0000000000..8c932011d0 --- /dev/null +++ b/default.json @@ -0,0 +1,13 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "description": "Shared Renovate preset for Vite+ projects: keeps vite-plus, the vite catalog alias (@voidzero-dev/vite-plus-core), and the pinned vitest family in one grouped update. Consume with \"extends\": [\"github>voidzero-dev/vite-plus\"].", + "packageRules": [ + { + "description": "vite-plus and @voidzero-dev/vite-plus-* are published together at one version, and vp pins vitest (plus aligned @vitest/* providers) to the version bundled in vite-plus. One grouped PR keeps the set in lockstep. Explicit minimumReleaseAge and schedule give every member one eligibility policy, so another preset cannot hold one member back and split the group.", + "groupName": "vite+", + "matchPackageNames": ["vite-plus", "@voidzero-dev/vite-plus-*", "vitest", "@vitest/*"], + "minimumReleaseAge": "1 day", + "schedule": ["at any time"] + } + ] +} diff --git a/docs/guide/ci.md b/docs/guide/ci.md index c64fe477ff..4afdbe53f7 100644 --- a/docs/guide/ci.md +++ b/docs/guide/ci.md @@ -37,6 +37,47 @@ When you use a commit SHA, add the exact release tag in a comment. Renovate uses These settings apply only to GitHub Actions workflows. For GitLab CI/CD and Azure Pipelines, update both version values together. +## Dependency Update Bots + +`vp create` and `vp migrate` write two npm entries that must stay on one version: the `vite-plus` dependency and the `vite` alias (`npm:@voidzero-dev/vite-plus-core@`). Projects that use `vp test` also carry a `vitest` override pinned to the version bundled in Vite+. A dependency bot sees unrelated packages and updates each one in its own PR. Either PR leaves the project on a Vite+ pairing that was never published together, and `vp build` and `vp test` fail on the mismatch. + +Configure your bot to update these packages in one grouped PR. + +### Renovate + +Extend the official preset from the Vite+ repository: + +```json [renovate.json] +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:recommended", "github>voidzero-dev/vite-plus"] +} +``` + +The preset groups `vite-plus`, `@voidzero-dev/vite-plus-*`, `vitest`, and `@vitest/*` into one `vite+` PR. It also sets `minimumReleaseAge` and `schedule` on the group, so every member becomes eligible at the same time even when another preset sets a different age gate or schedule for some of them. Rules later in your configuration override these values. + +### Dependabot + +Add a `groups` entry for the npm ecosystem in `.github/dependabot.yml`: + +```yaml [.github/dependabot.yml] +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + groups: + vite-plus: + patterns: + - vite-plus + - '@voidzero-dev/vite-plus-*' + - vitest + - '@vitest/*' +``` + +Grouping combines updates that arrive together. A `vitest` release with no Vite+ release still produces a separate `vitest` PR ahead of the bundled version. Run `vp migrate` to realign the `vitest` pin with the bundled version. + ## GitHub Actions The GitHub Action sets up Vite+, the required Node.js version, and the package manager. This means you usually do not need separate `setup-node`, package-manager setup, or manual dependency caching steps in your workflow. diff --git a/docs/guide/migrate.md b/docs/guide/migrate.md index a4640170c0..70c96229a3 100644 --- a/docs/guide/migrate.md +++ b/docs/guide/migrate.md @@ -106,6 +106,8 @@ Or, if you are using Yarn: } ``` +These entries and the `vite-plus` dependency must stay on one version. If Renovate or Dependabot updates the project, configure grouped updates so a bot bumps them together; see [Dependency Update Bots](/guide/ci#dependency-update-bots). + ## Migration Prompt If you want to hand this work to a coding agent (or the reader is a coding agent!), use this migration prompt: From 202149039d2be22856e94c3ecb6d8f74a4eb8d4f Mon Sep 17 00:00:00 2001 From: MK Date: Sun, 16 Aug 2026 18:49:31 +0800 Subject: [PATCH 2/2] refactor: trim duplicated rationale in the Renovate preset and docs The rule-level description restated the preset's top-level description; keep only the fact stated nowhere else (why minimumReleaseAge and schedule are pinned on the group). The CI guide now names all four commands the skew guard fails, not just build and test. --- default.json | 2 +- docs/guide/ci.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/default.json b/default.json index 8c932011d0..a951dbbbdf 100644 --- a/default.json +++ b/default.json @@ -3,7 +3,7 @@ "description": "Shared Renovate preset for Vite+ projects: keeps vite-plus, the vite catalog alias (@voidzero-dev/vite-plus-core), and the pinned vitest family in one grouped update. Consume with \"extends\": [\"github>voidzero-dev/vite-plus\"].", "packageRules": [ { - "description": "vite-plus and @voidzero-dev/vite-plus-* are published together at one version, and vp pins vitest (plus aligned @vitest/* providers) to the version bundled in vite-plus. One grouped PR keeps the set in lockstep. Explicit minimumReleaseAge and schedule give every member one eligibility policy, so another preset cannot hold one member back and split the group.", + "description": "Explicit minimumReleaseAge and schedule give every member one eligibility policy, so another preset cannot hold one member back and split the group.", "groupName": "vite+", "matchPackageNames": ["vite-plus", "@voidzero-dev/vite-plus-*", "vitest", "@vitest/*"], "minimumReleaseAge": "1 day", diff --git a/docs/guide/ci.md b/docs/guide/ci.md index 4afdbe53f7..86b8b8608c 100644 --- a/docs/guide/ci.md +++ b/docs/guide/ci.md @@ -39,7 +39,7 @@ These settings apply only to GitHub Actions workflows. For GitLab CI/CD and Azur ## Dependency Update Bots -`vp create` and `vp migrate` write two npm entries that must stay on one version: the `vite-plus` dependency and the `vite` alias (`npm:@voidzero-dev/vite-plus-core@`). Projects that use `vp test` also carry a `vitest` override pinned to the version bundled in Vite+. A dependency bot sees unrelated packages and updates each one in its own PR. Either PR leaves the project on a Vite+ pairing that was never published together, and `vp build` and `vp test` fail on the mismatch. +`vp create` and `vp migrate` write two npm entries that must stay on one version: the `vite-plus` dependency and the `vite` alias (`npm:@voidzero-dev/vite-plus-core@`). Projects that use `vp test` also carry a `vitest` override pinned to the version bundled in Vite+. A dependency bot sees unrelated packages and updates each one in its own PR. Either PR leaves the project on a Vite+ pairing that was never published together, and `vp dev`, `vp build`, `vp preview`, and `vp test` fail on the mismatch. Configure your bot to update these packages in one grouped PR.