You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@texera.apache.org by gi...@apache.org on 2026/07/24 21:09:05 UTC
(texera) branch gh-readonly-queue/main/pr-6848-f02dd2f1cd6fa2a7372971dba3f0b03fdd87a310 created (now eae4f218a6)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a change to branch gh-readonly-queue/main/pr-6848-f02dd2f1cd6fa2a7372971dba3f0b03fdd87a310
in repository https://gitbox.apache.org/repos/asf/texera.git
at eae4f218a6 ci: switch dependency update automation from Dependabot to Renovate (#6848)
This branch includes the following new commits:
new eae4f218a6 ci: switch dependency update automation from Dependabot to Renovate (#6848)
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(texera) 01/01: ci: switch dependency update automation from Dependabot to Renovate (#6848)
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-6848-f02dd2f1cd6fa2a7372971dba3f0b03fdd87a310
in repository https://gitbox.apache.org/repos/asf/texera.git
commit eae4f218a67978361496075da4cdbea07ee6cd74
Author: Yicong Huang <17...@users.noreply.github.com>
AuthorDate: Fri Jul 24 14:08:42 2026 -0700
ci: switch dependency update automation from Dependabot to Renovate (#6848)
### What changes were proposed in this PR?
Replace Dependabot version updates with Renovate (Mend "Forking
Renovate" app), as used by other ASF projects (Polaris, Fineract,
JMeter, Solr):
- Add `.github/renovate.json5` carrying over the `dependabot.yml`
semantics: weekly Monday cadence; patch and minor bumps grouped into
per-area PRs (except sbt minors, which stay individual so CI failures
remain attributable); majors as individual PRs; Angular majors excluded
(guided `ng update`, #6155), per-area conventional-commit scopes. Only
the previously covered ecosystems are enabled (`npm`, `bun`, `sbt`,
`pip_requirements`, `github-actions`).
- Pin `pandas` / `numpy` / `pyarrow` and the JVM `org.apache.arrow:*`
artifacts (Arrow IPC data path between the JVM engine and Python
workers; upgraded manually and in lockstep).
- Remove `.github/dependabot.yml`.
What Renovate adds that Dependabot cannot do:
1. PRs come from the bot's fork instead of `dependabot/...` branches in
this repo.
2. Security-fix PRs are typed `fix(...)` + `security` and `release/v1.2`
(backport marker) labels, while routine bumps are `chore(...)`
(Dependabot's `commit-message.prefix` cannot distinguish the two).
3. Vulnerability detection via OSV (`osvVulnerabilityAlerts`), so no
Dependabot-alerts read permission is needed.
4. Mature sbt support vs. Dependabot's beta.
Merge prerequisite: the Forking Renovate app must be enabled for this
repo (INFRA ticket, read-only app; no bot token or write access
involved). Until then this config is inert. Dependabot **alerts**
(detection in the Security tab; `.asf.yaml` `dependabot_alerts: true`)
are unaffected. Renovate takes over both version updates and
security-fix PRs (via OSV).
### Any related issues, documentation, discussions?
Closes #6847
INFRA ticket: https://issues.apache.org/jira/browse/INFRA-28167
### How was this PR tested?
- `renovate-config-validator` passes.
- Local dry-run (`renovate --platform=local`, debug log): all 5 managers
extract (675 deps, 52 files); patch/minor groups form per area while sbt
minors and majors stay individual; Angular majors filtered as disabled;
pinned Arrow-path packages produce no updates; OSV flags
torch/setuptools and keeps their fixes as separate vulnerability
branches.
- Final PR title/label rendering happens at branch-creation time, which
local mode skips; will be watched on the first real run after INFRA
enables the app.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (claude-fable-5)
---------
Signed-off-by: Yicong Huang <17...@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <no...@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <17...@users.noreply.github.com>
---
.github/dependabot.yml | 115 ----------------------------------
.github/renovate.json5 | 165 +++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 165 insertions(+), 115 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index d8709f4404..0000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,115 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-# Weekly Dependabot version updates. Patch bumps are grouped into one
-# PR per ecosystem (bug-fix only, low risk); minor and major bumps come
-# as individual PRs so each one passes or fails CI on its own. Security alerts are fed separately: npm/pip manifests
-# are parsed natively, sbt via .github/workflows/dependency-graph.yml.
-version: 2
-updates:
- # Scala backend (root sbt build, all modules). Dependabot sbt support
- # is in beta (2026-05); it cannot follow every build.sbt pattern yet,
- # so treat missed updates as expected rather than misconfiguration.
- - package-ecosystem: "sbt"
- directory: "/"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "fix(deps)"
- groups:
- sbt-patch:
- update-types:
- - "patch"
-
- - package-ecosystem: "npm"
- directory: "/frontend"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "fix(deps, frontend)"
- prefix-development: "chore(deps, frontend)"
- groups:
- frontend-patch:
- update-types:
- - "patch"
- ignore:
- # Angular majors need a guided `ng update` migration, and the
- # framework/CLI lines must move together (see #6155).
- - dependency-name: "@angular*/*"
- update-types: ["version-update:semver-major"]
-
- - package-ecosystem: "npm"
- directory: "/pyright-language-service"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "fix(deps, pyright-language-service)"
- prefix-development: "chore(deps, pyright-language-service)"
- groups:
- pyright-patch:
- update-types:
- - "patch"
-
- - package-ecosystem: "bun"
- directory: "/agent-service"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "fix(deps, agent-service)"
- prefix-development: "chore(deps, agent-service)"
- groups:
- agent-service-patch:
- update-types:
- - "patch"
-
- - package-ecosystem: "npm"
- directory: "/bin/y-websocket-server"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "fix(deps, y-websocket-server)"
- prefix-development: "chore(deps, y-websocket-server)"
-
- - package-ecosystem: "pip"
- directory: "/amber"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "fix(deps, pyamber)"
- prefix-development: "chore(deps, pyamber)"
- groups:
- python-patch:
- update-types:
- - "patch"
-
- - package-ecosystem: "github-actions"
- directory: "/"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 5
- commit-message:
- prefix: "ci"
- groups:
- github-actions:
- patterns:
- - "*"
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000000..40b7c16f14
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,165 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+// Renovate (Mend "Forking Renovate" app) configuration, replacing
+// .github/dependabot.yml. Semantics: weekly cadence; patch and minor
+// bumps grouped into one PR per area, except sbt minors, which stay
+// individual so CI failures remain attributable; majors as individual
+// PRs; Angular majors excluded (guided `ng update` migration, see
+// #6155). New behavior Dependabot could not provide:
+// PRs come from the bot's fork, and security fixes use a `fix(...)`
+// commit prefix while routine bumps use `chore(...)`.
+{
+ $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+ extends: ['config:recommended'],
+
+ // Only the ecosystems dependabot.yml covered; enable more (docker,
+ // gradle, etc.) deliberately in follow-ups rather than by default.
+ enabledManagers: ['npm', 'bun', 'sbt', 'pip_requirements', 'github-actions'],
+
+ timezone: 'Etc/UTC',
+ schedule: ['before 8am on monday'],
+ prConcurrentLimit: 10,
+ labels: ['dependencies'],
+
+ semanticCommits: 'enabled',
+ semanticCommitType: 'chore',
+ semanticCommitScope: 'deps',
+
+ // Vulnerability fixes: opened immediately (schedule does not apply),
+ // one PR per advisory, typed as a fix instead of a chore. OSV keeps
+ // this working without GitHub Dependabot-alerts read permission.
+ osvVulnerabilityAlerts: true,
+ vulnerabilityAlerts: {
+ semanticCommitType: 'fix',
+ // release/v1.2 flags the fix for backporting to the current release
+ // line; bump it when a new release branch is cut.
+ labels: ['dependencies', 'security', 'release/v1.2'],
+ groupName: null,
+ },
+
+ packageRules: [
+ // Commit scopes mirroring the old per-directory Dependabot prefixes.
+ {
+ matchFileNames: ['frontend/**'],
+ semanticCommitScope: 'deps, frontend',
+ },
+ {
+ matchFileNames: ['pyright-language-service/**'],
+ semanticCommitScope: 'deps, pyright-language-service',
+ },
+ {
+ matchFileNames: ['agent-service/**'],
+ semanticCommitScope: 'deps, agent-service',
+ },
+ {
+ matchFileNames: ['bin/y-websocket-server/**'],
+ semanticCommitScope: 'deps, y-websocket-server',
+ },
+ {
+ matchFileNames: ['amber/**'],
+ semanticCommitScope: 'deps, pyamber',
+ },
+
+ // Patch bumps grouped into one weekly PR per area. Minor bumps are
+ // also grouped per area — except sbt, where minors ship behavior
+ // changes often enough that per-package PRs keep CI failures
+ // attributable. Majors are always individual PRs.
+ {
+ matchManagers: ['sbt'],
+ matchUpdateTypes: ['patch'],
+ groupName: 'sbt patch updates',
+ },
+ {
+ matchFileNames: ['frontend/**'],
+ matchUpdateTypes: ['patch'],
+ groupName: 'frontend patch updates',
+ },
+ {
+ matchFileNames: ['pyright-language-service/**'],
+ matchUpdateTypes: ['patch'],
+ groupName: 'pyright-language-service patch updates',
+ },
+ {
+ matchFileNames: ['agent-service/**'],
+ matchUpdateTypes: ['patch'],
+ groupName: 'agent-service patch updates',
+ },
+ {
+ matchFileNames: ['amber/**'],
+ matchUpdateTypes: ['patch'],
+ groupName: 'pyamber patch updates',
+ },
+ {
+ matchFileNames: ['bin/y-websocket-server/**'],
+ matchUpdateTypes: ['patch'],
+ groupName: 'y-websocket-server patch updates',
+ },
+ {
+ matchFileNames: ['frontend/**'],
+ matchUpdateTypes: ['minor'],
+ groupName: 'frontend minor updates',
+ },
+ {
+ matchFileNames: ['pyright-language-service/**'],
+ matchUpdateTypes: ['minor'],
+ groupName: 'pyright-language-service minor updates',
+ },
+ {
+ matchFileNames: ['agent-service/**'],
+ matchUpdateTypes: ['minor'],
+ groupName: 'agent-service minor updates',
+ },
+ {
+ matchFileNames: ['bin/y-websocket-server/**'],
+ matchUpdateTypes: ['minor'],
+ groupName: 'y-websocket-server minor updates',
+ },
+ {
+ matchFileNames: ['amber/**'],
+ matchUpdateTypes: ['minor'],
+ groupName: 'pyamber minor updates',
+ },
+
+ // GitHub Actions bumps in one group, scoped as chore(deps, ci).
+ {
+ matchManagers: ['github-actions'],
+ semanticCommitScope: 'deps, ci',
+ groupName: 'github-actions',
+ },
+
+ // pandas / numpy / pyarrow (and the JVM Arrow artifacts) sit on the
+ // Arrow IPC data path between the JVM engine and Python workers and
+ // must move in lockstep; upgrade them manually and deliberately.
+ {
+ matchPackageNames: ['pandas', 'numpy', 'pyarrow', '/^org\\.apache\\.arrow:/'],
+ enabled: false,
+ },
+
+ // Angular majors need a guided `ng update` migration and the
+ // framework/CLI lines must move together (see #6155). The regex
+ // also covers @angular-devkit/@angular-builders/@angular-eslint;
+ // @schematics/angular is the CLI's schematics package and must
+ // move with the same migration despite the different scope.
+ {
+ matchFileNames: ['frontend/**'],
+ matchPackageNames: ['/^@angular/', '@schematics/angular'],
+ matchUpdateTypes: ['major'],
+ enabled: false,
+ },
+ ],
+}