Renovate Configuration¶

Renovate is an automated dependency update tool that helps keep Tux's dependencies up-to-date, secure, and maintainable. This document explains Renovate's purpose and documents Tux's actual configuration.

What is Renovate?¶

Renovate automatically scans dependencies in pyproject.toml, uv.lock, Dockerfiles, GitHub Actions, and other files, monitors package registries for updates, and creates pull requests. It groups related updates together and can automatically merge PRs that pass CI checks.

Purpose in Tux¶

Renovate helps maintain Tux by:

• Security Updates: Automatically detects OSV vulnerabilities, labels security PRs, and shows unresolved vulnerabilities in the dependency dashboard
• Dependency Maintenance: Keeps dependencies current with weekly scheduled updates, grouped PRs to reduce noise, and automatic lock file maintenance
• Quality Assurance: All PRs must pass CI checks before auto-merge, waits 14 days after release for stability, uses semantic commits, and includes changelogs in PR descriptions

Configuration File¶

The Renovate configuration is located at .github/renovate.json5 and uses JSON5 format (allowing comments).

Base Configuration¶

Presets and Core Settings¶

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
        "config:best-practices",
        ":semanticCommits",
        ":separateMultipleMajorReleases"
    ],
    "schedule": ["before 4am on Monday"],
    "timezone": "America/New_York",
    "dependencyDashboard": true,
    "dependencyDashboardOSVVulnerabilitySummary": "unresolved"
}

Key Settings:

• Uses Renovate's best practices preset with semantic commits
• Separates multiple major releases into individual PRs
• Runs weekly on Monday mornings before 4am ET
• Dependency dashboard shows unresolved OSV vulnerabilities

Enabled Managers¶

Renovate monitors: github-actions, pep621 (Python dependencies), docker-compose, dockerfile, custom.regex, devcontainer, pre-commit, and nix files.

PR Limits and Behavior¶

Vulnerability Alerts¶

{
    "osvVulnerabilityAlerts": true,
    "vulnerabilityAlerts": {
        "enabled": true,
        "labels": ["deps: security"],
        "automerge": false
    }
}

Security updates are detected via OSV, labeled with deps: security, and require manual review (no auto-merge).

Update Strategy¶

Package Rules¶

Update Type Rules¶

Notes: Minor updates exclude 0.x.x versions (unstable). Major updates require manual review.

Dependency Group Rules¶

Specific Package Groups¶

Critical Runtime Dependencies¶

These packages are critical to Tux's core functionality. Major version updates require manual review to ensure compatibility and test breaking changes.

Special Cases¶

Lock File Maintenance¶

{
    "lockFileMaintenance": {
        "enabled": true,
        "automerge": true,
        "schedule": ["before 4am on Monday"]
    }
}

Automatically maintains uv.lock file weekly with auto-merge enabled.

PR Configuration¶

{
    "fetchChangeLogs": "pr",
    "commitBodyTable": true,
    "prBodyColumns": ["Package", "Update", "Type", "Change", "References"],
    "suppressNotifications": ["prIgnoreNotification"]
}

PRs include changelogs, commit body tables, custom columns, and suppressed ignore notifications.

Workflow¶

1. Weekly Schedule: Runs every Monday before 4am ET
2. PR Creation: Creates PRs after CI checks complete (24 hour wait)
3. Auto-merge: Automatically merges PRs that pass CI (for enabled rules)
4. Manual Review: Major updates and critical dependencies require manual review
5. Grouping: Related dependencies are grouped to reduce PR noise

PR Labels¶

Monitoring¶

The dependency dashboard issue provides an overview of all dependencies, unresolved OSV vulnerabilities, update status, and links to open PRs.

Related Documentation¶

• SBOM - Software Bill of Materials with all dependencies
• Versioning - Version management and semantic versioning

Resources¶

• Renovate Documentation - Official Renovate documentation
• Renovate Presets - Available configuration presets
• Renovate GitHub App - Install Renovate GitHub App