From c3fb18dce2bc6a5ac34e14af8a0702301b700ec1 Mon Sep 17 00:00:00 2001 From: narutiga <100295602+narutiga@users.noreply.github.com> Date: Tue, 9 Jun 2026 10:41:41 +0900 Subject: [PATCH 1/5] chore: add Renovate configuration for automated dependency updates - Configure Renovate with best-practices and js-app presets - Auto-merge minor updates, linters, testers, and type definitions - Enable vulnerability alerts with automatic merging (security label) - Set timezone to Asia/Tokyo for predictable update timing - Allow unlimited concurrent PR creation for responsive updates Co-Authored-By: Claude Haiku 4.5 --- renovate.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..1114caa --- /dev/null +++ b/renovate.json @@ -0,0 +1,19 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "timezone": "Asia/Tokyo", + "prConcurrentLimit": 0, + "extends": [ + "config:best-practices", + "config:js-app", + ":automergeMinor", + ":automergeLinters", + ":automergeTesters", + ":automergeTypes" + ], + "vulnerabilityAlerts": { + "enabled": true, + "automerge": true, + "labels": ["security"], + "schedule": ["at any time"] + } +} From 140f84342f68441680955e8d6c213d4dccbb38be Mon Sep 17 00:00:00 2001 From: narutiga <100295602+narutiga@users.noreply.github.com> Date: Tue, 9 Jun 2026 17:20:51 +0900 Subject: [PATCH 2/5] ci: add PR status checks and improve Renovate safety Add TypeScript type checking workflow for pull requests: - Runs on PR to main and merge_group - Validates TypeScript compilation with tsc --noEmit - Uses pnpm with frozen lockfile for reproducibility - Caches dependencies for faster CI execution Update Renovate configuration for safe automerge: - Set platformAutomerge: false to delegate merge control to Renovate - Renovate will now wait for CI status checks before automerging - Prevents merging before tests complete or after failures IMPORTANT: Branch protection rule must be configured on GitHub: - Require status checks to pass before merging - Select "TypeScript Type Check" as required check See: https://docs.renovatebot.com/key-concepts/automerge/#platform-automerge Co-Authored-By: Claude Haiku 4.5 --- .github/workflows/ci.yml | 31 +++++++++++++++++++++++++++++++ renovate.json | 1 + 2 files changed, 32 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..68795ae --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,31 @@ +name: CI + +on: + pull_request: + branches: + - main + merge_group: + +jobs: + typecheck: + name: TypeScript Type Check + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'pnpm' + + - name: Install pnpm + uses: pnpm/action-setup@v2 + with: + version: 9 + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Type check + run: pnpm exec tsc --noEmit diff --git a/renovate.json b/renovate.json index 1114caa..e0ece73 100644 --- a/renovate.json +++ b/renovate.json @@ -2,6 +2,7 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "timezone": "Asia/Tokyo", "prConcurrentLimit": 0, + "platformAutomerge": false, "extends": [ "config:best-practices", "config:js-app", From 8a14a4d4792dba1f2b47d3aa1da8989a12f55116 Mon Sep 17 00:00:00 2001 From: narutiga <100295602+narutiga@users.noreply.github.com> Date: Tue, 9 Jun 2026 17:20:51 +0900 Subject: [PATCH 3/5] ci: add PR status checks and improve Renovate safety Add TypeScript type checking workflow for pull requests: - Runs on PR to main and merge_group - Validates TypeScript compilation with tsc --noEmit - Uses pnpm with frozen lockfile for reproducibility - Caches dependencies for faster CI execution Update Renovate configuration for safe automerge: - Set platformAutomerge: false to delegate merge control to Renovate - Renovate will now wait for CI status checks before automerging - Prevents merging before tests complete or after failures IMPORTANT: Branch protection rule must be configured on GitHub: - Require status checks to pass before merging - Select "TypeScript Type Check" as required check See: https://docs.renovatebot.com/key-concepts/automerge/#platform-automerge Co-Authored-By: Claude Haiku 4.5 --- .github/workflows/ci.yml | 31 +++++++++++++++++++++++++++++++ renovate.json | 1 + 2 files changed, 32 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..6503ee6 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,31 @@ +name: CI + +on: + pull_request: + branches: + - main + merge_group: + +jobs: + typecheck: + name: TypeScript Type Check + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install pnpm + uses: pnpm/action-setup@v2 + with: + version: 9 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'pnpm' + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Type check + run: pnpm exec tsc --noEmit diff --git a/renovate.json b/renovate.json index 1114caa..e0ece73 100644 --- a/renovate.json +++ b/renovate.json @@ -2,6 +2,7 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "timezone": "Asia/Tokyo", "prConcurrentLimit": 0, + "platformAutomerge": false, "extends": [ "config:best-practices", "config:js-app", From 426665e9511c2868c991366ec4fc47e46eb8a3cb Mon Sep 17 00:00:00 2001 From: narutiga <100295602+narutiga@users.noreply.github.com> Date: Tue, 9 Jun 2026 21:01:37 +0900 Subject: [PATCH 4/5] ci: upgrade pnpm/action-setup to v4 for Node.js compatibility pnpm/action-setup@v2 is no longer compatible with newer Node.js versions used by GitHub-hosted runners. Upgrade to v4 to ensure CI passes. This prevents CI from blocking Renovate PRs and merge-queue entries at the pnpm install step. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6503ee6..d95a949 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v4 - name: Install pnpm - uses: pnpm/action-setup@v2 + uses: pnpm/action-setup@v4 with: version: 9 From 6d4db050d97dd5a7adefed4c2600b8e40f62e2a2 Mon Sep 17 00:00:00 2001 From: narutiga <100295602+narutiga@users.noreply.github.com> Date: Wed, 10 Jun 2026 12:15:19 +0900 Subject: [PATCH 5/5] ci: add Renovate rule to prevent 0.x automerge of minor updates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Disable automerge for 0.x versions (@libsql/client, drizzle-orm) where minor updates can legally contain breaking API/runtime changes. Since CI only runs tsc --noEmit (no runtime tests), a 0.x minor update like 0.17→0.18 or 0.45→0.46 could introduce breaking database/client changes that pass type checking but fail at runtime. This rule requires manual review for 0.x updates before merging, while keeping automerge enabled for stable 1.0.0+ dependencies and tooling. See: https://docs.renovatebot.com/config-presets/#prevent-0x-dependency-minors-from-automerging --- renovate.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index e0ece73..5954265 100644 --- a/renovate.json +++ b/renovate.json @@ -16,5 +16,12 @@ "automerge": true, "labels": ["security"], "schedule": ["at any time"] - } + }, + "packageRules": [ + { + "description": "Disable automerge for 0.x versions (breaking changes possible in minor updates)", + "matchCurrentVersion": "/^0/", + "automerge": false + } + ] }