Repository navigation
Configure Renovate - #11
Merged
Merged
Conversation
Every module moves to its latest compatible release except openfga/openfga and the two modules it pins, openfga/api/proto and openfga/language/pkg/go. Those three are the conformance target: decision 1 bumps the module, the oracle image, the corpus and every Ref: permalink together or not at all, and decision 2 runs the DSL conversion through the language package at the pinned version. Moving them is a retarget, not a dependency update. The updated otel, x/*, grpc and k8s modules declare go 1.26, and Go 1.25 left support when 1.27 shipped. The directive goes straight to 1.27, matching cel4postgres, so the directive, CI (setup-go reads it and resolves the latest 1.27 patch) and the containerised suite all build on the current release. go.work moves with it, since a workspace cannot declare an older go than its modules.
postgres:18-alpine gets the current digest (still PostgreSQL 18.6; the rebuild carries newer Alpine packages). pg_tle moves to v1.5.3. The compose test runner moves to Go 1.27 and gains a digest like every other image here. The runner also loses GOFLAGS=-mod=mod. go.work is committed, so the go command runs in workspace mode, which accepts only readonly or vendor and refused to start: `docker compose run --rm test` had been failing before compiling anything.
harden-runner v2.20.0 to v2.22.3 and upload-artifact v7.0.1 to v7.0.2, still pinned by commit SHA. checkout and setup-go are already at their latest releases.
Dependency updates have been manual so far, and the only automated PRs came from Dependabot security updates and Renovate's onboarding PR. This config replaces the onboarding defaults with the house style used in tsfga: Bump-style commit headers without conventional prefixes, a weekly early-Monday schedule, digest pinning from config:best-practices, and grouped PRs for GitHub Actions and image digests. Nothing automerges. The openfga module, the two modules it pins and the oracle image form one group: they are the conformance target, which decision 1 moves only together with the corpus and permalinks, so a PR that bumps one without the others would be a trap. vendor/ holds the cel4postgres SQL bundle, not Go modules, so it is ignored and no vendoring post-update step runs; go mod vendor would overwrite it. Regex managers cover what no built-in manager sees: the go directive in go.work, which must move with go.mod's, and the pg_tle version in the validation Dockerfile.
lemuelroberto
force-pushed
the
deps/renovate
branch
from
October 29, 2026 23:24
aad3a98 to
ffacb92
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #10. Adds
renovate.json, replacing the defaults the onboarding PR (#2)would install. Validated with
renovate-config-validator(renovate 44.198.0).
What it does
config:best-practices(digest pinning, dependencydashboard),
:pinAllExceptPeerDependencies,:docker,:enableVulnerabilityAlerts(labelledsecurity),:rebaseStalePrs,:disableRateLimiting,security:openssf-scorecard,schedule:earlyMondaysinAmerica/Sao_Paulo.
Bump <dep> to <version>, capitalised,semanticCommitsdisabled, matching the repo's no-conventional-commits rule. Long Go module paths can still push a header past 50
characters.
go.mod), docker-compose(
compose.yaml,compose.bench.yaml), dockerfile(
docker/pg_tle.Dockerfile), github-actions.postUpdateOptions: gomodTidy, gomodUpdateImportPaths. NogomodVendor/goWorkVendor:vendor/holds the cel4postgres SQLbundle, not Go modules, and vendoring would overwrite it.
vendor/,.claude/,bench-results/,dist/.refreshes in one PR; the
godirective ingo.modandgo.worktogether.
github.com/openfga/openfga,github.com/openfga/api/proto,github.com/openfga/language/pkg/goand the
openfga/openfgaimage are grouped, because decision 1moves them only together with the corpus and permalinks. Such a PR
is a retarget: expect the conformance suite to need work before it
can merge.
major on the
postgresimage arrives as an ordinary PR; 18 is thefloor, so treat one as a decision, not a routine bump.
goline ingo.work, andARG PG_TLE_VERSIONindocker/pg_tle.Dockerfile(GitHub releases of aws/pg_tle).Not covered
vendor/cel4postgres--X.Y.Z.sqlis a release artifact file, not aversion string. A bump means fetching a new file, so it stays
manual.
Overlap with Dependabot
There is no
.github/dependabot.yml; #5 came from Dependabotsecurity updates enabled in the repository settings. With Renovate's
vulnerability alerts on, both will open PRs for the same advisory.
Turning off Dependabot security updates (Settings → Code security)
avoids the duplicates; Dependabot alerts can stay on, since Renovate
reads them.
Once this merges, #2 (onboarding) can be closed.