Table of Contents
🌏 中文版
Renovate scans package manifests, lockfiles, container images, GitHub Actions, Terraform, and other declarations. Managers extract current dependencies, datasources discover releases, and configuration controls branches and pull requests. Its value is policy for cadence, risk, and ownership—not a queue of bot PRs.
packageRules is an update-governance language
Rules match packages, datasources, managers, dependency types, SemVer update types, release age, and vulnerability signals and then set groups, schedules, labels, reviewers, range strategies, and automerge. Runtime majors, dev-tool patches, container digests, and GitHub Action SHAs deserve different policies.
{
"extends": ["config:recommended"],
"packageRules": [{
"matchDepTypes": ["devDependencies"],
"matchUpdateTypes": ["patch"],
"automerge": true
}]
}Grouping reduces noise but makes failures harder to isolate, and one package can block a whole group. Monorepo presets synchronize related packages. Security updates should bypass ordinary monthly schedules. The Dependency Dashboard exposes pending, blocked, errored, and approval-gated work, useful for manually approving majors.
Tests and branch protection bound automerge trust
Automerge means rules and required checks passed, not that a release is benign or semantically compatible. Begin with lockfile maintenance and low-risk dev patches. Production dependencies need reliable unit, integration, and end-to-end tests, artifact scanning, rollout, and rollback. Give bot tokens minimal permissions and keep secrets away from forked or untrusted code.
minimumReleaseAge leaves time for unpublishing and malware detection, but may delay security fixes, so vulnerability updates need exceptions. SHA-pinned Actions and digest-pinned images improve reproducibility; PRs should retain readable versions and verify upstream identity.
Renovate orchestrates updates across ecosystems. Dependabot offers tighter GitHub integration; Socket.dev analyzes behavior; Snyk and OSV supply vulnerability intelligence; Sigstore and SLSA verify provenance. Update automation accelerates remediation but is not a security verdict.
References
Loading...