Copilot commented on code in PR #6848: URL: https://github.com/apache/texera/pull/6848#discussion_r3642930017
########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: Review Comment: The header comment says minor updates are individual PRs, but the packageRules below group minor updates per area (frontend/pyright-language-service/agent-service/amber). Update the comment so it matches the actual Renovate behavior (and the PR description). ########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, Review Comment: Patch updates are grouped per area for frontend/pyright-language-service/agent-service/amber, but bin/y-websocket-server is missing a corresponding patch grouping rule, so it will still open per-dependency patch PRs. If the intent is truly “one weekly PR per area”, add a patch group for y-websocket-server as well. ########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['minor'], + groupName: 'frontend minor updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyright-language-service minor updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'agent-service minor updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyamber minor updates', + }, Review Comment: Minor updates are grouped per area for frontend/pyright-language-service/agent-service/amber, but bin/y-websocket-server is missing a corresponding minor grouping rule. If minors are meant to be grouped per area (as stated earlier in this file/PR description), add a y-websocket-server minor group too. ########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['minor'], + groupName: 'frontend minor updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyright-language-service minor updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'agent-service minor updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyamber minor updates', + }, + + // GitHub Actions bumps in one group, scoped as chore(deps, ci). + { + matchManagers: ['github-actions'], + semanticCommitScope: 'deps, ci', + groupName: 'github-actions', + }, + + // pandas / numpy / pyarrow (and the JVM Arrow artifacts) sit on the + // Arrow IPC data path between the JVM engine and Python workers and + // must move in lockstep; upgrade them manually and deliberately. + { + matchPackageNames: ['pandas', 'numpy', 'pyarrow', '/^org\\.apache\\.arrow:/'], + enabled: false, + }, + + // Angular majors need a guided `ng update` migration and the + // framework/CLI lines must move together (see #6155). + { + matchFileNames: ['frontend/**'], + matchPackageNames: ['/^@angular/'], + matchUpdateTypes: ['major'], + enabled: false, Review Comment: The Angular-major exclusion rule only matches packages starting with "@angular". The frontend also depends on "@schematics/angular" (Angular CLI schematics), which can receive major bumps and likely needs the same guided `ng update` handling; currently Renovate would still propose major updates for it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
