ci(renovate): label deps, lint config, group by Maven groupId - #416
Merged
Conversation
Add a `dependencies` label so Renovate PRs land in a dedicated release-drafter category instead of falling through uncategorised. Add a Validate Renovate Config workflow that runs renovate-config-validator on changes to renovate.json, catching schema typos before merge. Group every Maven update by its groupId via a catch-all packageRule, and apply the same grouping to security updates through vulnerabilityAlerts (Renovate otherwise resets their groupName and opens one PR per artifact). Drop the now-redundant ch.qos.logback rule, which the catch-all covers. Migrate the deprecated config:base preset to config:recommended to clear the validator warning the new workflow surfaces. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vlsi
enabled auto-merge (rebase)
June 22, 2026 13:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Renovate PRs currently land uncategorised in the draft release notes, and the config has no automated validation. Security advisories also open one PR per artifact: a single advisory that bumps several artifacts of the same project produces several separate PRs, because Renovate resets the
groupNamefor security updates.What
dependencieslabel. Addlabels: ["dependencies"]torenovate.jsonand a matching⬆️ Dependenciescategory (collapse-after: 8) inrelease-drafter.yml, so dependency updates land in their own collapsible section..github/workflows/renovate-config-lint.yml, which runsrenovate-config-validatoron changes torenovate.jsonor the workflow itself. Mirrors apache/jmeter#6704, adapted to this repo's CI conventions (version-tag actions, read-only permissions).packageRule(matchDatasources: ["maven"]) that setsgroupNameto the dependency's groupId, and avulnerabilityAlertsblock with the same template so security updates group the same way. Drop the now-redundantch.qos.logbackrule, which the catch-all covers. Mirrors apache/jmeter#6710.config:basetoconfig:recommended, clearing the warning the new lint workflow surfaces.How to verify
docker run --rm -v "$PWD":/work -w /work renovate/renovate:latest renovate-config-validator renovate.jsonexits 0 with no warnings.renovate.jsonand the workflow file.Note
Grouping is by exact groupId, so a project split across several groupIds forms one group per groupId. Where several groupIds should move together (or a dependency later adds a sub-groupId such as
ch.qos.logback.contrib), add an explicit rule after the catch-all.🤖 Generated with Claude Code