fix: stop Renovate posting commit statuses - #10317
Merged
Merged
Conversation
Mrtenz
approved these changes
Sep 21, 2026
Mrtenz
left a comment
Mrtenz
left a comment
Member
There was a problem hiding this comment.
This is fine, but we can also ask TechOps to grant this permission to the app.
cryptodev-2s
enabled auto-merge
September 21, 2026 15:01
This was referenced Sep 21, 2026
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 21, 2026
## Explanation Renovate pull requests reach this workflow but the job skips. The gate matches `dependabot[bot]`, and Renovate pull requests are authored by `metamask-ci[bot]`, the identity of the token it runs with. Confirmed on the first batch: the workflow triggered on `renovate/execa-10.x`, `renovate/unzipper-0.x-lockfile` and `renovate/tstyche-7.x-lockfile` and skipped all three, while MetaMask#10320 sits red on `Check changelog`. So the gate also matches a `renovate/` branch prefix now. Everything else about the job already applies: Renovate leaves the same changelog gap, and `yarn dedupe` and the constraints fixer are harmless no ops when there is nothing to repair. The file name and `environment: dependabot` are both left alone on purpose, and now carry a comment saying why. The token exchange policy keys on the `environment` claim and globs on the workflow path, so renaming either one breaks the token request before the job starts. One behaviour worth noting: Renovate's default `rebaseWhen: auto` stops updating a branch once someone else pushes to it, so the repairs will not be clobbered the way Dependabot clobbers them. ## References Follows MetaMask#10317. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The workflow can push commits to dependency-update branches using elevated token permissions, but behavior matches the existing Dependabot path with a narrower trigger. > > **Overview** > Extends the existing **repair constraints, lockfile and changelogs** workflow so it runs on **Renovate** PRs, not only Dependabot. The job gate now also matches branches whose head ref starts with `renovate/`, because Renovate PRs are opened by `metamask-ci[bot]` rather than `dependabot[bot]`. > > Repair commits are authored as **`github-actions[bot]`** instead of `metamask-ci[bot]`, so Renovate’s auto-rebase stops overwriting the fixes after an “external” commit. The workflow display name is generalized; the file path and `environment: dependabot` are unchanged so OIDC token exchange keeps working. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit bcbce01. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 21, 2026
## Explanation By default Renovate leaves a manifest alone when the new version already satisfies the declared range, so MetaMask#10318 bumped `ts-jest` to 29.4.12 in `yarn.lock` and touched no `package.json` at all. That keeps the declared minimum at the old version and produces no changelog entry, since nothing published changed. We want a changelog entry for every dependency bump, so `rangeStrategy: bump` moves the range with the release: `^29.4.11` becomes `^29.4.12` across every workspace that declares it, the same as Dependabot does today. Out of range updates like MetaMask#10320 already behaved this way. `peerDependencies` are exempted back to `widen`. An explicit `rangeStrategy` overrides Renovate's peer handling ([`npm/range.ts`](https://github.com/renovatebot/renovate/blob/main/lib/modules/manager/npm/range.ts)), and 11 peer entries here have simple ranges that would be narrowed rather than broadened, `@babel/runtime ^7.0.0` most obviously. The other 11 are complex ranges like `^16.8.0 || ^17.0.0` and widen regardless. The cost is diff size. A single patch now rewrites the same line in every manifest that declares the dependency, and each of those packages needs an entry. MetaMask#10322 is what writes them. > [!IMPORTANT] > Depends on MetaMask#10322. Without it the repair workflow still skips Renovate pull requests, and every one of them lands red on `Check changelog`. ## References Depends on MetaMask#10322. Follows MetaMask#10317. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Tooling-only change to Renovate; it does not alter runtime code, but it will enlarge dependency PR diffs across workspaces. > > **Overview** > Renovate is configured to **raise semver ranges in `package.json`** when a newer release still satisfies the existing constraint (`rangeStrategy: bump`), matching Dependabot behavior so lockfile-only bumps no longer skip manifest updates and downstream changelog tooling can see a published change. > > A **peer-only override** sets `rangeStrategy: widen` for `peerDependencies`, undoing the global bump so wide peer ranges stay broadened instead of tightened. > > **Note:** This is meant to work with the changelog repair workflow in MetaMask#10322; without that, Renovate PRs may fail `Check changelog`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9ab221a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
#10316 broke the Renovate job outright. Asking the token exchange for
statuses: writenow fails before Renovate even starts:That is GitHub refusing to mint the token, not the policy rejecting it. consensys-vertical-apps/token-exchange-service#182 allows the permission, but the
metamask-ciApp installation does not hold Commit statuses, and a policy can only narrow what the App already has. Granting it means an org level App permission change that every installation has to accept, which is a lot of process for four informational checks.So this reverts the permission request and stops Renovate posting the statuses at all. With every entry in
statusCheckNamesset to null, Renovate skips the POST rather than 403ing on it (status-checks.ts:91), which was what aborted the run before the pull request got created.What we lose is the checks appearing on the pull request. Artifact and config errors still show up in the run log and on the dependency dashboard.
minimumReleaseAgeis unaffected, it is enforced internally whether or not the status is posted.References
Reverts #10316. Follows #10311. Part of WPC-1161.
Checklist
Note
Low Risk
CI-only changes to Renovate permissions and config with no runtime or application code impact.
Overview
Fixes the Renovate workflow failing at token exchange by removing
statuses: writefrom the MetaMask token-exchange permissions in.github/workflows/renovate.yml. Themetamask-ciapp installation does not have commit-status scope, so requesting it caused token minting to fail before Renovate could run.Disables Renovate’s GitHub commit statuses by adding
statusCheckNamesinrenovate.jsonwithartifactError,configValidation,mergeConfidence, andminimumReleaseAgeset tonull, so Renovate skips posting those checks instead of erroring. Dependency updates and internal rules likeminimumReleaseAgestill apply; only the PR-visible status checks are dropped.Reviewed by Cursor Bugbot for commit e5288f2. Bugbot is set up for automated code reviews on this repo. Configure here.