[rishitank]

What

• renovate.json now extends the shared preset github>rishitank/.github:node, which in turn extends github>rishitank/.github (default.json). The old file used config:base and listed packages holocron no longer depends on (@orama/*, tree-sitter*), so it is replaced rather than edited.
• .github/dependabot.yml is removed. Renovate takes over version updates for npm and GitHub Actions.
• .github/workflows/auto-merge.yml is removed (reasoning below).
• release.yml gets workflow_dispatch:, so the release-please PR (currently chore: release 0.1.2 #13, 4 commits behind main) can be refreshed by hand without a push to main. The release-please job now has if: github.ref == 'refs/heads/main', so a dispatch from any other branch does nothing. build-release depends on it, so it is skipped too.

What the presets do (so nothing is a surprise)

From default.json:

• It extends config:recommended, :semanticCommits, :dependencyDashboard and helpers:pinGitHubActionDigests. Expect a first PR that pins actions/*@v7 and similar tags to SHAs.
• Schedule: Mondays 00:00–06:59 Europe/London. At most 5 open PRs, 2 per hour. rangeStrategy: bump.
• Lockfile maintenance runs on the 1st of each month.
• Automerged on green CI:
  • GitHub Actions updates, grouped into one PR.
  • devDependency minor, patch, pin and digest updates.
• Never automerged:
  • majors, which get the major-upgrade label and wait for a 7-day release age;
  • minor and patch updates wait for a 3-day release age.
• vulnerabilityAlerts: security PRs open immediately, with the security label and no schedule or release-age wait.

From node.json:

• Node (.nvmrc) and npm bumps are not automerged; they get the runtime-upgrade label.
• A typescript major waits 14 days and is not automerged.
• vitest and @vitest/** minor/patch updates are grouped as "test tooling" and automerged.

Repo-specific packageRules (only where the preset can't know):

1. Group vitest majors. @vitest/coverage-v8 must be on the same major as vitest. Dependabot had an ignore rule for exactly this.
2. typescript allowedVersions: "<6.1.0". typescript-eslint@8.70.x has the peer range typescript >=4.8.4 <6.1.0. A TypeScript 6.1+/7 PR would fail npm ci with ERESOLVE. Dependabot ignored TypeScript majors for the same reason. Remove the cap when typescript-eslint widens its range.

Dependabot ignore rules I intentionally did not carry over:

• zod 4. @modelcontextprotocol/sdk now declares zod: ^3.25 || ^4.0, so the stated reason no longer holds.
• eslint 10.

Both would be major PRs, and those are never automerged under the preset. They wait on the dependency dashboard for a human.

Why auto-merge.yml is removed rather than rewritten

It ran on every non-draft, same-repo pull_request and called gh pr merge --auto --squash. It had no actor check, so it enabled auto-merge on any PR opened from a branch in this repo, not only Dependabot's. Its actual jobs are now covered elsewhere:

• Renovate PRs: the preset's automerge: true / automergeType: "pr" uses GitHub platform automerge. Renovate enables auto-merge on its own PRs, gated by the same required checks.
• Release PR: release.yml already runs gh pr merge --squash --auto on it.
• Human and agent PRs: these should not be auto-merged. The owner merges them.

So a rewrite would have no remaining job. Behaviour change to note: Dependabot's production-dependency minor/patch PRs used to be auto-merged. Under the preset they are not (only devDependencies and Actions are). That is deliberate.

Dependabot alerts stay on

This PR removes only the Dependabot version-updates config. Dependabot alerts stay enabled. Renovate's vulnerabilityAlerts reads those alerts through the GitHub API to open its security PRs, so turning alerts off would blind Renovate.

Verification

• npx renovate-config-validator --strict → Config validated successfully.
• release.yml parses as YAML, and the diff is limited to the trigger and the job guard.
• CI (lint, typecheck, test, audit, CodeQL, build) runs on this PR. No source changes.

Risks

• Until the Renovate app is installed, nothing opens update PRs. Dependabot version updates stop as soon as this merges.
• The first Renovate run will open an onboarding/dashboard issue and an Actions digest-pinning PR.

What Rishi must do

1. Install the Renovate GitHub app on this repo.
2. In Settings → Code security, keep Dependabot alerts on. Consider turning Dependabot security updates off. That setting is separate from dependabot.yml, and if it stays on, Dependabot and Renovate will both open PRs for the same advisory.
3. Merge this PR before marking the security PRs ready for review. While auto-merge.yml exists on main, it enables auto-merge on any same-repo PR the moment it is marked ready.

🤖 Generated with Claude Code

https://claude.ai/code/session_0171XyyqTUH64gAi1AcerwjN

Summary by CodeRabbit

• Release
  • Added the option to start the release process manually from the main branch.
• Chores
  • Changed dependency update settings, including grouping major Vitest updates and limiting TypeScript updates to versions below 6.1.0.
  • Removed automated dependency update and pull request auto-merge workflows.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 800cdf07-2c5e-4175-b36a-6696e0310cd7

📥 Commits

Reviewing files that changed from the base of the PR and between f6c93ea and 73504c5.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b83fd1d7-adfa-4158-b5c7-29be338ab81b

📥 Commits

Reviewing files that changed from the base of the PR and between 78b6b9a and f6c93ea.

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/auto-merge.yml
• .github/workflows/release.yml
• renovate.json

💤 Files with no reviewable changes (2)

• .github/dependabot.yml
• .github/workflows/auto-merge.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request removes the Dependabot configuration and auto-merge workflow, updates Renovate settings, and adds a manual trigger to the release workflow with a main-branch guard.

Changes

Dependency update configuration

Layer / File(s)	Summary
Dependency update settings .github/dependabot.yml, renovate.json	The Dependabot configuration was removed. Renovate now uses a different preset, groups major updates for Vitest packages, and limits TypeScript versions to below 6.1.0. It also removes selected auto-merge and scheduled-review rules.

Pull-request auto-merge

Layer / File(s)	Summary
Auto-merge workflow removal .github/workflows/auto-merge.yml	The workflow that enabled squash auto-merge for eligible pull requests was removed.

Release workflow

Layer / File(s)	Summary
Manual release trigger and branch guard .github/workflows/release.yml	The workflow can be started manually. The release-please job runs only for refs/heads/main.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to f6c93

The automation changes are bounded: release processing remains limited to main, while dependency update behavior moves to Renovate. No actionable merge risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to f6c93

The main-branch gate and existing release-job dependency limit the new manual trigger. The change nevertheless makes privileged release automation manually reachable, and the effective dispatch, publishing, and shared update-policy controls have not been confirmed.

Retained concerns

• Low · security · inferred: Manual dispatch newly reaches the privileged main-branch release path. The workflow checks the ref, but effective caller authorization and npm publisher restrictions are external and unverified; this is a control-dependency concern, not an established bypass.
• Low · security · inferred: Dependency-update policy moves to a shared Renovate preset rather than rules visible in this repository. Its effective merge rules and change controls were not available, leaving the governance of updates to privileged workflows unverified.

Security review details

Security Blast Radius

• inferred — A permitted main-branch dispatch can reach repository-writing release automation and, if a release is created, the existing npm publication and GitHub Release path. The evidence does not show a new route from a non-main ref.

Security Findings and Attack Paths

• inferred — No unauthorized release or publication path is established. The deferred authorization candidate cannot be resolved without effective dispatch permissions and npm trusted-publisher subject and ref restrictions.

Trust Boundaries and Controls

• inferred — The main-ref condition and release-created dependency constrain workflow execution, but neither proves who may dispatch it or which workflow identities npm accepts. Those controls cross repository-settings and publisher boundaries not visible in the supplied source.

Hardening Proposals

• proposed — Before relying on manual releases, verify dispatch authorization, main-branch protections, and npm trusted-publisher bindings; check recovery after a publish succeeds but asset upload fails.
• proposed — Resolve and review the effective shared Renovate preset, particularly merge rules for GitHub Actions updates, before retiring the prior update controls.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing Dependabot dependency updates with Renovate. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the release gate,
Then watches Vitest updates wait.
Dependabot hops out of sight,
Auto-merge leaves the workflow night.
The main branch holds the release light.}

_{Comment @coderabbitai help to get the list of available commands.}

[rishitank]

This answers the two "retained concerns" in the Security Architecture Review of f6c93ea, point by point. Neither needs a code change.

1. Manual dispatch reaches the release path.

• Who can dispatch: GitHub only lets users with write access to the repo run workflow_dispatch, which is the same set of people who can push to main. The dispatch is also a no-op off main, because the release-please job has if: github.ref == 'refs/heads/main' and build-release depends on it. So a dispatch can only do what a push to main already does. On an up-to-date main, that means refreshing the release PR.
• npm publishing: npm publish only runs when release-please has actually created a release, i.e. after the release PR has been merged. That condition is unchanged. The npm trusted-publisher binding (repo + release.yml) is configured on npmjs.com and is unchanged by this PR.
• Rishi, optional: on npmjs.com you can pin the trusted publisher to the release.yml workflow and, if you want, a GitHub environment.

2. Update policy lives in a shared preset. The preset is public, rishitank/.github → default.json and node.json, and the PR body summarises what it does.

• GitHub Actions updates: the preset groups them and automerges them on green CI, and helpers:pinGitHubActionDigests pins every action to a SHA.
• Required checks: the main ruleset still requires Lint, Type Check, Test, Security Audit, CodeQL and Build before any automerge can land.
• Majors are never automerged.

No change made.