cypress-io / cypress-io/github-action

Allow Renovate `lockFileMaintenance` also on repo root

Open
#1,801 2 comments 0 reactions 1 assignee Claimed by @MikeMcC399 View on GitHub
renovate
Dominant language
JavaScript
Stars
1.5k
Forks
353
Avg merge
1d 22h
Merged PRs (30d)
27

Description

## Current behavior

Currently [renovate.json](https://github.com/cypress-io/github-action/blob/master/renovate.json) applies `lockFileMaintenance` only to `examples/**` projects, not to the root of the repo. This was added by https://github.com/cypress-io/github-action/pull/1735

https://github.com/cypress-io/github-action/blob/47646e1836697bfbba7622f189e32efba1b3e7aa/renovate.json#L23-L35

The reason for excluding the root of the repo is that some lockfile updates can cause changes to the built version of the action, and this requires manual intervention, since currently there is no automated way to rebuild the action in a workflow.

The downside is that every vulnerability in the repo root requires a manually created PR in order to remediate, whether or not it would need an action rebuild.

## Desired behavior

Allow `lockFileMaintenance` also on the root of the repo. This may mean that some Renovate PRs will fail in CI if they make a change needing an action rebuild. Those PRs would need to be closed and replaced with a manual PR that includes an action rebuild.

In total this would result in less manual work, as `lockFileMaintenance` PRs that succeed in CI would only need to be approved, instead of needing to be created manually.

## Other

If there is no objection to this, I would submit a PR to make the change to the Renovate config. It would just remove the special handling:

https://github.com/cypress-io/github-action/blob/47646e1836697bfbba7622f189e32efba1b3e7aa/renovate.json#L27-L35

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.