docs(renovate): record why the portal does not automerge dependency prs #206

Sammanfogat

supernaut sammanfogade 1 incheckning från chore/renovate-no-automerge-rationale in i main

2026-08-09 19:57:45 +00:00

supernaut kommenterad

2026-08-09 19:35:19 +00:00

Ägare

Companion to bitborg-docs #81, which adds an opt-in automerge-safe Renovate preset.

This repo deliberately does not extend it, and this records why so it does not have to be re-derived later.

A merge to main here is a production deploy: deploy.yml fires on push to main, builds the image, pushes it to the registry, and the services host pulls it via podman auto-update (ADR 0019) with no operator present. CI is a genuinely strong gate — gitleaks over full history, pnpm audit, astro check, eslint, stylelint, prettier, markdownlint, lang-check, drizzle-kit check, build, and vitest with coverage — and a failed healthcheck rolls the container back. But neither proves a bumped dependency left the served portal behaving the same, only that it builds and passes.

So every dependency PR here stays human-reviewed. The note also states the constraint on any future change of mind: scope automerge to devDependencies only, never to runtime dependencies, since those ship into what visitors execute.

Comment only — no behaviour change in this repo. The volume reduction (weekly batching, toolchain grouping) reaches this repo through the shared preset regardless.

Companion to bitborg-docs #81, which adds an opt-in `automerge-safe` Renovate preset. This repo deliberately does **not** extend it, and this records why so it does not have to be re-derived later. A merge to `main` here *is* a production deploy: `deploy.yml` fires on push to `main`, builds the image, pushes it to the registry, and the services host pulls it via `podman auto-update` (ADR 0019) with no operator present. CI is a genuinely strong gate — gitleaks over full history, `pnpm audit`, astro check, eslint, stylelint, prettier, markdownlint, lang-check, `drizzle-kit check`, build, and vitest with coverage — and a failed healthcheck rolls the container back. But neither proves a bumped dependency left the served portal *behaving* the same, only that it builds and passes. So every dependency PR here stays human-reviewed. The note also states the constraint on any future change of mind: scope automerge to devDependencies only, never to runtime `dependencies`, since those ship into what visitors execute. Comment only — no behaviour change in this repo. The volume reduction (weekly batching, toolchain grouping) reaches this repo through the shared preset regardless.

supernaut lade till 1 incheckning

2026-08-09 19:35:19 +00:00

docs(renovate): record why the portal does not automerge dependency prs

ci / ci (pull_request) Failing after 29s

Detaljer

df34d83ca6