Skip to content

chore(deps): drop the Dependabot actions fallback now Renovate runs - #10

Merged
ExtraToast merged 2 commits into
mainfrom
chore/drop-dependabot-actions-fallback
Aug 21, 2026
Merged

chore(deps): drop the Dependabot actions fallback now Renovate runs#10
ExtraToast merged 2 commits into
mainfrom
chore/drop-dependabot-actions-fallback

Conversation

@ExtraToast

Copy link
Copy Markdown
Contributor

Why

.github/dependabot.yml stated its own exit condition:

# Renovate (renovate.json) is the primary dependency manager for JorisJonkers-dev
# repos. Dependabot is enabled only for GitHub Actions security updates as a
# belt-and-braces fallback; disable this file if Renovate covers actions in a
# given repo.

That condition is now met. Renovate is installed and enabled on the organization, and the shared preset at JorisJonkers-dev/renovate-config covers the actions manager twice over:

{ "matchManagers": ["github-actions"], "groupName": "github actions dependencies" }
{ "matchManagers": ["github-actions"], "pinDigests": true }

Keeping both means every action bump arrives as two PRs against the same file — one grouped and digest-pinned from Renovate, one single-dependency from Dependabot.

Scope

The Dependabot config declared exactly one ecosystem, github-actions, so nothing else is lost. Renovate additionally pins digests, which this config did not.

The same change already merged in github-workflows, gradle-conventions and kotlin-spring-commons. This repository and .github were missed in that pass; repo-template also carries the fallback but removing it there is a template-policy decision, since scripts/validate-templates.sh asserts the file exists.

Also in this branch

docs/REPO_SETUP.md listed dependabot.yml in the repository layout table. That row would have pointed at a file that no longer exists, so it now names only renovate.json. A grep for dependabot across the repository returns nothing after both commits.

.github/dependabot.yml covered only the github-actions ecosystem and
documented its own exit condition: "disable this file if Renovate covers
actions in a given repo". The Renovate app is now installed and enabled
on the organization, and the shared preset both groups
`matchManagers: ["github-actions"]` and pins their digests, so keeping
the fallback means a second PR for every actions bump.
The file is removed in this branch, so the setup table would point at
something that no longer exists.
@ExtraToast ExtraToast added type: chore Maintenance work without intended behavior change. component: dependencies Dependency update or dependency policy. labels Aug 21, 2026
@ExtraToast ExtraToast self-assigned this Aug 21, 2026
@ExtraToast
ExtraToast merged commit 29c3b30 into main Aug 21, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component: dependencies Dependency update or dependency policy. type: chore Maintenance work without intended behavior change.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant