This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-6848-f02dd2f1cd6fa2a7372971dba3f0b03fdd87a310 in repository https://gitbox.apache.org/repos/asf/texera.git
commit eae4f218a67978361496075da4cdbea07ee6cd74 Author: Yicong Huang <[email protected]> AuthorDate: Fri Jul 24 14:08:42 2026 -0700 ci: switch dependency update automation from Dependabot to Renovate (#6848) ### What changes were proposed in this PR? Replace Dependabot version updates with Renovate (Mend "Forking Renovate" app), as used by other ASF projects (Polaris, Fineract, JMeter, Solr): - Add `.github/renovate.json5` carrying over the `dependabot.yml` semantics: weekly Monday cadence; patch and minor bumps grouped into per-area PRs (except sbt minors, which stay individual so CI failures remain attributable); majors as individual PRs; Angular majors excluded (guided `ng update`, #6155), per-area conventional-commit scopes. Only the previously covered ecosystems are enabled (`npm`, `bun`, `sbt`, `pip_requirements`, `github-actions`). - Pin `pandas` / `numpy` / `pyarrow` and the JVM `org.apache.arrow:*` artifacts (Arrow IPC data path between the JVM engine and Python workers; upgraded manually and in lockstep). - Remove `.github/dependabot.yml`. What Renovate adds that Dependabot cannot do: 1. PRs come from the bot's fork instead of `dependabot/...` branches in this repo. 2. Security-fix PRs are typed `fix(...)` + `security` and `release/v1.2` (backport marker) labels, while routine bumps are `chore(...)` (Dependabot's `commit-message.prefix` cannot distinguish the two). 3. Vulnerability detection via OSV (`osvVulnerabilityAlerts`), so no Dependabot-alerts read permission is needed. 4. Mature sbt support vs. Dependabot's beta. Merge prerequisite: the Forking Renovate app must be enabled for this repo (INFRA ticket, read-only app; no bot token or write access involved). Until then this config is inert. Dependabot **alerts** (detection in the Security tab; `.asf.yaml` `dependabot_alerts: true`) are unaffected. Renovate takes over both version updates and security-fix PRs (via OSV). ### Any related issues, documentation, discussions? Closes #6847 INFRA ticket: https://issues.apache.org/jira/browse/INFRA-28167 ### How was this PR tested? - `renovate-config-validator` passes. - Local dry-run (`renovate --platform=local`, debug log): all 5 managers extract (675 deps, 52 files); patch/minor groups form per area while sbt minors and majors stay individual; Angular majors filtered as disabled; pinned Arrow-path packages produce no updates; OSV flags torch/setuptools and keeps their fixes as separate vulnerability branches. - Final PR title/label rendering happens at branch-creation time, which local mode skips; will be watched on the first real run after INFRA enables the app. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (claude-fable-5) --------- Signed-off-by: Yicong Huang <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> --- .github/dependabot.yml | 115 ---------------------------------- .github/renovate.json5 | 165 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 165 insertions(+), 115 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index d8709f4404..0000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,115 +0,0 @@ -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. - -# Weekly Dependabot version updates. Patch bumps are grouped into one -# PR per ecosystem (bug-fix only, low risk); minor and major bumps come -# as individual PRs so each one passes or fails CI on its own. Security alerts are fed separately: npm/pip manifests -# are parsed natively, sbt via .github/workflows/dependency-graph.yml. -version: 2 -updates: - # Scala backend (root sbt build, all modules). Dependabot sbt support - # is in beta (2026-05); it cannot follow every build.sbt pattern yet, - # so treat missed updates as expected rather than misconfiguration. - - package-ecosystem: "sbt" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "fix(deps)" - groups: - sbt-patch: - update-types: - - "patch" - - - package-ecosystem: "npm" - directory: "/frontend" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "fix(deps, frontend)" - prefix-development: "chore(deps, frontend)" - groups: - frontend-patch: - update-types: - - "patch" - ignore: - # Angular majors need a guided `ng update` migration, and the - # framework/CLI lines must move together (see #6155). - - dependency-name: "@angular*/*" - update-types: ["version-update:semver-major"] - - - package-ecosystem: "npm" - directory: "/pyright-language-service" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "fix(deps, pyright-language-service)" - prefix-development: "chore(deps, pyright-language-service)" - groups: - pyright-patch: - update-types: - - "patch" - - - package-ecosystem: "bun" - directory: "/agent-service" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "fix(deps, agent-service)" - prefix-development: "chore(deps, agent-service)" - groups: - agent-service-patch: - update-types: - - "patch" - - - package-ecosystem: "npm" - directory: "/bin/y-websocket-server" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "fix(deps, y-websocket-server)" - prefix-development: "chore(deps, y-websocket-server)" - - - package-ecosystem: "pip" - directory: "/amber" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "fix(deps, pyamber)" - prefix-development: "chore(deps, pyamber)" - groups: - python-patch: - update-types: - - "patch" - - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "ci" - groups: - github-actions: - patterns: - - "*" diff --git a/.github/renovate.json5 b/.github/renovate.json5 new file mode 100644 index 0000000000..40b7c16f14 --- /dev/null +++ b/.github/renovate.json5 @@ -0,0 +1,165 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics: weekly cadence; patch and minor +// bumps grouped into one PR per area, except sbt minors, which stay +// individual so CI failures remain attributable; majors as individual +// PRs; Angular majors excluded (guided `ng update` migration, see +// #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + matchUpdateTypes: ['patch'], + groupName: 'y-websocket-server patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['minor'], + groupName: 'frontend minor updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyright-language-service minor updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'agent-service minor updates', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + matchUpdateTypes: ['minor'], + groupName: 'y-websocket-server minor updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyamber minor updates', + }, + + // GitHub Actions bumps in one group, scoped as chore(deps, ci). + { + matchManagers: ['github-actions'], + semanticCommitScope: 'deps, ci', + groupName: 'github-actions', + }, + + // pandas / numpy / pyarrow (and the JVM Arrow artifacts) sit on the + // Arrow IPC data path between the JVM engine and Python workers and + // must move in lockstep; upgrade them manually and deliberately. + { + matchPackageNames: ['pandas', 'numpy', 'pyarrow', '/^org\\.apache\\.arrow:/'], + enabled: false, + }, + + // Angular majors need a guided `ng update` migration and the + // framework/CLI lines must move together (see #6155). The regex + // also covers @angular-devkit/@angular-builders/@angular-eslint; + // @schematics/angular is the CLI's schematics package and must + // move with the same migration despite the different scope. + { + matchFileNames: ['frontend/**'], + matchPackageNames: ['/^@angular/', '@schematics/angular'], + matchUpdateTypes: ['major'], + enabled: false, + }, + ], +}
