Yicong-Huang opened a new pull request, #6848: URL: https://github.com/apache/texera/pull/6848
### What changes were proposed in this PR? Replace Dependabot version updates with Renovate (Mend "Forking Renovate" app), as used by other ASF projects (Polaris, Fineract, JMeter, Solr): - Add `.github/renovate.json5` carrying over the `dependabot.yml` semantics: weekly Monday cadence, patch bumps grouped into one PR per area, minor/major bumps as individual PRs, Angular majors excluded (guided `ng update`, #6155), per-area conventional-commit scopes. Only the previously covered ecosystems are enabled (`npm`, `bun`, `sbt`, `pip_requirements`, `github-actions`). - Remove `.github/dependabot.yml`. What Renovate adds that Dependabot cannot do: 1. PRs come from the bot's fork instead of `dependabot/...` branches in this repo. 2. Security-fix PRs are typed `fix(...)` + `security` label, while routine bumps are `chore(...)` (Dependabot's `commit-message.prefix` cannot distinguish the two). 3. Vulnerability detection via OSV (`osvVulnerabilityAlerts`), so no Dependabot-alerts read permission is needed. 4. Mature sbt support vs. Dependabot's beta. Merge prerequisite: the Forking Renovate app must be enabled for this repo (INFRA ticket, read-only app; no bot token or write access involved). Until then this config is inert. GitHub-level Dependabot security alerts stay enabled; only version-update PRs move to Renovate. ### Any related issues, documentation, discussions? Closes #6847 ### How was this PR tested? - `renovate-config-validator .github/renovate.json5` passes. - Config semantics manually diffed against the removed `dependabot.yml` entry by entry. - End-to-end behavior verifiable only after INFRA enables the app; first onboarding run will be watched. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (claude-fable-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
