8000 ci: configure grouped Dependabot security updates and fix Renovate config by DylanVolz · Pull Request #4421 · googleapis/mcp-toolbox · GitHub
[go: up one dir, main page]
Skip to content

ci: configure grouped Dependabot security updates and fix Renovate config - #4421

Open
DylanVolz wants to merge 3 commits into
mainfrom
ci/configure-dependabot-renovate
Open

ci: configure grouped Dependabot security updates and fix Renovate config#4421
DylanVolz wants to merge 3 commits into
mainfrom
ci/configure-dependabot-renovate

Conversation

@DylanVolz
@DylanVolz DylanVolz commented Nov 5, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Description

Cleans up dependency update automation across GitHub Dependabot and Mend Renovate to stop ungrouped per-sample PR floods and eliminate duplicate security PRs:

- **Grouped Dependabot Security Updates (`.github/dependabot.yml`):**
-- Adds an explicit Dependabot configuration covering root, `.hugo`, `/pypi`, `Dockerfile`, GitHub Actions, and all `/docs/**/*` samples with `open-pull-requests-limit: 0` (disabling routine Dependabot version updates) and `applies-to: security-updates` groups. Sample CVEs now consolidate into a single PR per language (`go-samples-security`, `js-samples-security`, `python-samples-security`) instead of opening 6+ separate PRs per advisory, and root `go.mod` `minor`/`patch` security fixes group together while keeping `major` bumps isolated.
- **Renovate Schema & Scope Fixes (`.github/renovate.json5`):**
-- Replaces invalid `ignorePaths` keys inside `packageRules` with negated `matchFileNames` globs, ignores `release-please`-managed `npm/**` wrapper packages, adds `pep621` coverage for `pypi/pyproject.toml`, applies the repo's `type: process` label, and sets `vulnerabilityAlerts.enabled = false` so Renovate handles routine cooldown-gated version updates without duplicating Dependabot security PRs.
- **Presubmit Bot Alignment (`.github/trusted-contribution.yml`):**
-- Adds `renovate[bot]` so Mend Renovate GitHub App PRs automatically receive `/gcbrun` and `tests: run`.

with these changes dependabot manages security updates (they do not wait on the cool down or the weekly interval) and renovate manages dependency upgrades but no longer manages security updates to remove the race between the two systems PRs.

PR Checklist

Thank you for opening a Pull Request! Before submitting your PR, there are a
few things you can do to make sure it goes smoothly:

  • Make sure you reviewed
    CONTRIBUTING.md
  • Make sure to open an issue as a
    bug/issue
    before writing your code! That way we can discuss the change, evaluate
    designs, and agree on the general idea
  • Ensure you have manually reviewed the entire diff before requesting a
    review
  • Ensure the tests and linter pass
  • Code coverage does not decrease (if any source code was changed)
  • Appropriate docs were updated (if necessary)
  • Make sure to add ! if this involve a breaking change

🛠️ Fixes #<issue_number_goes_here>

@DylanVolz
DylanVolz requested a review from a team as a code owner November 5, 2026 02:09
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Nov 5, 2026
View reviewed changes
@gemini-code-assist gemini-code-assist Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a Dependabot configuration, updates the Renovate configuration, and adds the Renovate bot to the trusted contributors list. The review feedback correctly identifies that Dependabot does not support the directories key or glob patterns (such as /docs/**/*), which will cause configuration parsing errors in several update blocks.

Comment thread .github/dependabot.yml Resolved
Comment thread .github/dependabot.yml Resolved
Comment thread .github/dependabot.yml Resolved
@DylanVolz
DylanVolz force-pushed the ci/configure-dependabot-renovate branch from fd1cf51 to 85860f7 Compare November 5, 2026 16:18
@DylanVolz
DylanVolz commented Nov 5, 2026
Copy link
Copy Markdown
Contributor Author

/gcbrun

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

@duwenxin99 duwenxin99

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@DylanVolz @duwenxin99
0