[rishitank]

Update, 25 Sep evening: main moved, and the auto-merge fence is tightened

Three things changed on main after this PR was opened:

• The Renovate app was installed.
• Its onboarding PR chore: Configure Renovate #34 added a renovate.json extending config:recommended.
• auto-merge.yml then auto-merged chore: Configure Renovate #34, chore(deps): update dependency pytest to v9.0.3 [security] #35 (pytest) and chore(deps): update dependency pillow to v12.3.0 [security] #38 (Pillow) with no review.
• A review-gate ruleset now requires 1 approval. A CodeRabbit approval counts.

What I did on this branch:

• Merged main (203fcca). renovate.json conflicted (add/add).
  • This branch's version is kept. It extends github>rishitank/.github:python, which chains to config:recommended, so the onboarding file adds nothing.
  • A temporary workflow did the merge. It resolved only that file, checked the result was byte-identical to this branch's version, then was deleted (50fdf18).
  • The rest of the merge is main's uv.lock changes from chore(deps): update dependency pytest to v9.0.3 [security] #35 and chore(deps): update dependency pillow to v12.3.0 [security] #38.
• Tightened the auto-merge fence (b6f56bd). It now also skips PRs opened by a user account (github.event.pull_request.user.type == 'Bot' is required).
  • Why: agent PRs are opened under your account. Under review-gate, CodeRabbit's approval is enough to satisfy the rule. With the old fence, marking fix(security): clear all open Dependabot and CodeQL alerts #33 or feat: improvements for PyPI publishing and testing #13 ready after this merged would have armed auto-merge, and they'd have squash-merged the moment CodeRabbit approved, with nobody else in the loop.
  • Still armed: bot PRs other than Renovate and Dependabot, e.g. the release PR. CodeRabbit skips bot PRs, so those still need your approval before they can merge.
  • Behaviour change for you: the section below says the workflow was kept because it auto-merges your own PRs. It no longer does, so you merge them by hand. A manual merge still fires push, so Release still runs. If you want your own PRs armed again, delete the user.type == 'Bot' line.

---

What

• Adds renovate.json. It extends the shared preset github>rishitank/.github:python. That preset chains to github>rishitank/.github (default.json), which sets:
  • config:recommended, semantic commits and the Dependency Dashboard;
  • helpers:pinGitHubActionDigests: GitHub Actions are SHA-pinned, and all Actions bumps come as one grouped PR;
  • vulnerability alerts become PRs immediately (no schedule, no minimum release age), labelled security;
  • majors are never automerged (major-upgrade label, 7-day minimum release age); ruff, mypy and pip-audit are never automerged (tooling-upgrade);
  • a Monday 00:00–06:00 Europe/London schedule, monthly uv.lock maintenance and rangeStrategy: bump.
• Removes .github/dependabot.yml, so Dependabot stops opening version-update PRs. Dependabot alerts stay on. They're a repository setting (Settings → Code security), not part of this file. Renovate reads those same alerts via vulnerabilityAlerts.
• Keeps .github/workflows/auto-merge.yml, but it no longer arms Renovate PRs, Dependabot PRs or user-account PRs.
  • Originally it enabled squash auto-merge, using PAT_AUTO_MERGE, on every non-draft, same-repo PR.
  • Left as it was, it would enable auto-merge on every Renovate PR, including majors and tooling bumps. That silently overrides the preset's "a major bump is a migration, always human-reviewed" rule.
  • Renovate enables GitHub auto-merge itself, as its own app identity, for the updates the preset allows (the Actions group, dev-dependency minor/patch).

Why

You decided to move from Dependabot to Renovate. This supersedes #29 (closed) and the stale Actions bumps #30 and #31 (closed). Those come back as one grouped, digest-pinned Renovate PR.

How it was verified

• npx renovate-config-validator renovate.json returns "Config validated successfully".
• The preset files python.json and default.json in rishitank/.github were read at 3978d59.
• auto-merge.yml: only the if: expression and its comment change.
• Merge with main: the temporary workflow's checks passed (two parents, renovate.json identical to this branch's, no conflict markers, valid JSON).

Risks

• The first Renovate runs have already happened: chore: Configure Renovate #34 through chore(deps): update dependency pydantic-settings to v2.14.2 [security] - autoclosed #39. chore(deps): update dependency python-dotenv to v1.2.2 [security] - autoclosed #36, chore(deps): update dependency mcp to v1.28.1 [security] - autoclosed #37 and chore(deps): update dependency pydantic-settings to v2.14.2 [security] - autoclosed #39 are drafts and superseded by fix(security): clear all open Dependabot and CodeQL alerts #33. See the comments on them. chore(deps): update dependency mcp to v1.28.1 [security] - autoclosed #37 would move mcp to 2.2.0.
• pyproject.toml uses >= ranges. With rangeStrategy: bump, Renovate will raise those lower bounds as it updates.
• Your own PRs are no longer auto-merge-armed (see the update above).

What Rishi must do

1. The Renovate app is already installed.
2. Optional: if "Dependabot security updates" is on in Settings → Code security, turn it off so both bots don't open security PRs for the same alert. Keep Dependabot alerts on.
3. Draft on purpose. Leave this PR as a draft until you're ready to merge it.
   • On pull_request events, GitHub runs the workflow from the PR's merge commit, so this PR is governed by its own fenced copy, which skips user-account PRs.
   • fix(security): clear all open Dependabot and CodeQL alerts #33 and feat: improvements for PyPI publishing and testing #13 still carry main's unfenced copy until this PR merges, so keep them as drafts until then.

🤖 Generated with Claude Code

https://claude.ai/code/session_0171XyyqTUH64gAi1AcerwjN

[rishitank]

@coderabbitai review

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: rishitank/animawatch/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 650ccaad-b9c2-4c1f-8c6c-e91609304faf

📥 Commits

Reviewing files that changed from the base of the PR and between 6ce01be and b6f56bd.

📒 Files selected for processing (2)

• .github/workflows/auto-merge.yml
• renovate.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Summary by CodeRabbit

• Chores
  • Updated automated dependency management to use a shared Python update policy in Renovate.
  • Automatic merging is limited to non-draft pull requests from the same repository opened by bots other than Renovate or Dependabot. Human-opened pull requests are not automatically merged; other eligible bot pull requests still require owner approval.
  • Removed Dependabot’s scheduled update configuration, including its weekly pip and GitHub Actions updates.

Walkthrough

The pull request removes Dependabot configuration, changes the Renovate preset and restricts the auto-merge job to eligible bot-authored pull requests.

Changes

Dependency update automation

Layer / File(s)	Summary
Update configuration and auto-merge condition .github/dependabot.yml, renovate.json, .github/workflows/auto-merge.yml	The Dependabot configuration was removed. Renovate now uses the github>rishitank/.github:python preset. The auto-merge job excludes human-opened pull requests and pull requests opened by Renovate or Dependabot. Draft and fork pull requests remain excluded.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b6f56

No confirmed merge-blocking behavior is established. The effective Renovate Actions coverage and GitHub approval settings were not verified, so those remain operational uncertainties.

Architecture Summary

Architecture risk: 🔵 Low · up to b6f56

The change affects 1 system.

Changed systems: renovate.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — renovate.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in renovate.json: Replaces the config:recommended preset with github>rishitank/.github:python.
• observed — Modified behavior in .github/dependabot.yml: The entire Dependabot configuration was removed, including its pip and GitHub Actions update schedules, pull-request limits, labels, commit-message prefixes and pip dependency grouping rules.
• observed — Modified behavior in .github/workflows/auto-merge.yml: The comments now describe exclusions for dependency bots and human-opened pull requests, including the stated review and merge policies. The condition adds a bot-account requirement and excludes renovate[bot] and dependabot[bot]; draft and fork pull requests remain excluded, while other same-repository bot pull requests can run the job.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely summarises the main change: moving dependency updates from Dependabot to Renovate.
Description check	✅ Passed	The description directly explains the Renovate migration, Dependabot configuration removal, auto-merge changes, validation, risks, and required follow-up actions. The power of the Dark Side is clear.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{The old update schedule fades away.
A Python preset marks the path.
Human-opened changes wait for owners.
Renovate and Dependabot stand apart.
Other eligible bots may proceed.
The Dark Side keeps the rules in place.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[rishitank]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[rishitank]

This PR is now ready for review; it had been left as a draft by mistake. Until it merges, .github/dependabot.yml stays on main, and Dependabot keeps opening version-update PRs alongside Renovate's.

• Code is unchanged. CodeRabbit already approved the head commit b6f56bd.
• Marking it ready doesn't arm auto-merge. On pull_request events this PR runs its own fenced auto-merge.yml, which skips PRs opened by user accounts.

@rishitank: this is ready for you to merge. Also turn off Dependabot security updates in Settings → Code security, and keep Dependabot alerts on.