cypress-io / cypress-io/github-action
Allow Renovate `lockFileMaintenance` also on repo root
- Dominant language
- JavaScript
- Stars
- 1.5k
- Forks
- 353
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 27
Description
## Current behavior
Currently [renovate.json](https://github.com/cypress-io/github-action/blob/master/renovate.json) applies `lockFileMaintenance` only to `examples/**` projects, not to the root of the repo. This was added by https://github.com/cypress-io/github-action/pull/1735
https://github.com/cypress-io/github-action/blob/47646e1836697bfbba7622f189e32efba1b3e7aa/renovate.json#L23-L35
The reason for excluding the root of the repo is that some lockfile updates can cause changes to the built version of the action, and this requires manual intervention, since currently there is no automated way to rebuild the action in a workflow.
The downside is that every vulnerability in the repo root requires a manually created PR in order to remediate, whether or not it would need an action rebuild.
## Desired behavior
Allow `lockFileMaintenance` also on the root of the repo. This may mean that some Renovate PRs will fail in CI if they make a change needing an action rebuild. Those PRs would need to be closed and replaced with a manual PR that includes an action rebuild.
In total this would result in less manual work, as `lockFileMaintenance` PRs that succeed in CI would only need to be approved, instead of needing to be created manually.
## Other
If there is no objection to this, I would submit a PR to make the change to the Renovate config. It would just remove the special handling:
https://github.com/cypress-io/github-action/blob/47646e1836697bfbba7622f189e32efba1b3e7aa/renovate.json#L27-L35
Contributor guide
Assessment
This issue has not been assessed yet.