Renovate updated every go.mod and package.json in a repo, while the tests
cover one module and one Node project. An update outside them would merge
untested. Restrict the managers to the configured directories, and add go
and node switches for a repo that has no Go code or no frontend to test.
A Go major update changes the import path. Without rewriting imports the
PR only added the new module to go.mod, the tests passed, and Renovate
proposed it again. Rewrite the imports with gomodUpdateImportPaths so the
build tests the actual update, and cap indirect dependencies at their
current major, which the parent module decides.
The checkout used the triggering ref, so a run started from another
branch tested a stale tree and then hit conflicts. Check out the default
branch explicitly. When a passing PR conflicts, close it and skip, and
when the merge fails, close the PR and fail the job. Only a real test
failure goes to the issue.
Renovate skips a branch when a PR with the same title was closed, and
adds a comment to that PR. A PR closed after a merge or by hand must not
block the next update, so set recreateWhen to always.
A failing update has no PR, so its test output had nowhere to go. Capture
the output of the Go and Node steps. On failure, write it as a comment on
one sticky issue, one comment per branch, updated on every run. A final
job removes comments for branches that are gone and closes the issue when
no update fails. The step is best effort and also writes the run summary.
Renovate now prepares branches and opens no PR. Each branch is merged
into the default branch locally and tested, one at a time. Only a branch
that passes gets a PR, which merges at once, so a failing update never
shows up as a PR. Majors default to one branch each. The release is
dispatched once, after anything merged.
A repo with a backlog of majors got one PR per major on the first run.
Replace include-major with major-updates: ignore (default), separate or
batch. Ignore uses a version cap, because rules that disable by update
type have no effect.
The workflow runs inside the calling repository, so its own token is
enough and no PAT is needed. Drop the PAT fallbacks and make admin merge
opt-in, because the workflow token cannot bypass branch protection.
A merge made with that token does not trigger push workflows, so add a
release-workflow input that dispatches the release after the merge.
Renovate batches every minor and patch update in one PR. The workflow
tests that branch with go build and go test for Go and with the
package.json scripts for npm, pnpm and yarn. It squash-merges the PR only
when every test passes. Major updates get their own PR and never merge by
themselves. A renovate.json in the calling repo adds project rules.
lukaszraczylo