Yicong-Huang commented on code in PR #6848: URL: https://github.com/apache/texera/pull/6848#discussion_r3648025644
########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: Review Comment: Fixed in e67b959f3 — the header now describes the actual behavior: patch and minor bumps grouped per area, sbt minors individual, majors individual. ########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, Review Comment: Added in b3d4505db (`y-websocket-server patch updates`). Note this directory has exactly one dependency today, so the group is for consistency rather than noise reduction. ########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['minor'], + groupName: 'frontend minor updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyright-language-service minor updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'agent-service minor updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyamber minor updates', + }, Review Comment: Addressed in e9d7c6e18 (`y-websocket-server minor updates`). ########## .github/renovate.json5: ########## @@ -0,0 +1,151 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Renovate (Mend "Forking Renovate" app) configuration, replacing +// .github/dependabot.yml. Semantics carried over: weekly cadence, +// patch bumps grouped into one PR per area, minor/major bumps as +// individual PRs, Angular majors excluded (guided `ng update` +// migration, see #6155). New behavior Dependabot could not provide: +// PRs come from the bot's fork, and security fixes use a `fix(...)` +// commit prefix while routine bumps use `chore(...)`. +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: ['config:recommended'], + + // Only the ecosystems dependabot.yml covered; enable more (docker, + // gradle, etc.) deliberately in follow-ups rather than by default. + enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'], + + timezone: 'Etc/UTC', + schedule: ['before 8am on monday'], + prConcurrentLimit: 10, + labels: ['dependencies'], + + semanticCommits: 'enabled', + semanticCommitType: 'chore', + semanticCommitScope: 'deps', + + // Vulnerability fixes: opened immediately (schedule does not apply), + // one PR per advisory, typed as a fix instead of a chore. OSV keeps + // this working without GitHub Dependabot-alerts read permission. + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + semanticCommitType: 'fix', + // release/v1.2 flags the fix for backporting to the current release + // line; bump it when a new release branch is cut. + labels: ['dependencies', 'security', 'release/v1.2'], + groupName: null, + }, + + packageRules: [ + // Commit scopes mirroring the old per-directory Dependabot prefixes. + { + matchFileNames: ['frontend/**'], + semanticCommitScope: 'deps, frontend', + }, + { + matchFileNames: ['pyright-language-service/**'], + semanticCommitScope: 'deps, pyright-language-service', + }, + { + matchFileNames: ['agent-service/**'], + semanticCommitScope: 'deps, agent-service', + }, + { + matchFileNames: ['bin/y-websocket-server/**'], + semanticCommitScope: 'deps, y-websocket-server', + }, + { + matchFileNames: ['amber/**'], + semanticCommitScope: 'deps, pyamber', + }, + + // Patch bumps grouped into one weekly PR per area. Minor bumps are + // also grouped per area — except sbt, where minors ship behavior + // changes often enough that per-package PRs keep CI failures + // attributable. Majors are always individual PRs. + { + matchManagers: ['sbt'], + matchUpdateTypes: ['patch'], + groupName: 'sbt patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['patch'], + groupName: 'frontend patch updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyright-language-service patch updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['patch'], + groupName: 'agent-service patch updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['patch'], + groupName: 'pyamber patch updates', + }, + { + matchFileNames: ['frontend/**'], + matchUpdateTypes: ['minor'], + groupName: 'frontend minor updates', + }, + { + matchFileNames: ['pyright-language-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyright-language-service minor updates', + }, + { + matchFileNames: ['agent-service/**'], + matchUpdateTypes: ['minor'], + groupName: 'agent-service minor updates', + }, + { + matchFileNames: ['amber/**'], + matchUpdateTypes: ['minor'], + groupName: 'pyamber minor updates', + }, + + // GitHub Actions bumps in one group, scoped as chore(deps, ci). + { + matchManagers: ['github-actions'], + semanticCommitScope: 'deps, ci', + groupName: 'github-actions', + }, + + // pandas / numpy / pyarrow (and the JVM Arrow artifacts) sit on the + // Arrow IPC data path between the JVM engine and Python workers and + // must move in lockstep; upgrade them manually and deliberately. + { + matchPackageNames: ['pandas', 'numpy', 'pyarrow', '/^org\\.apache\\.arrow:/'], + enabled: false, + }, + + // Angular majors need a guided `ng update` migration and the + // framework/CLI lines must move together (see #6155). + { + matchFileNames: ['frontend/**'], + matchPackageNames: ['/^@angular/'], + matchUpdateTypes: ['major'], + enabled: false, Review Comment: Good catch — fixed in e67b959f3 by adding `@schematics/angular` to the disabled-majors rule (`@angular-devkit`/`@angular-builders`/`@angular-eslint` were already covered by the `/^@angular/` regex). Verified with a local `renovate --platform=local` dry-run: the angular-cli major group no longer forms (disabled updates 19→20, branches 97→96). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
