fix: repair Renovate pull requests too - #10322
Merged
Merged
Conversation
4 tasks
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ee5d480. Configure here.
4 tasks
cryptodev-2s
commented
Sep 21, 2026
| run: | | ||
| git config user.name 'metamask-ci[bot]' | ||
| git config user.email '271559518+metamask-ci[bot]@users.noreply.github.com' | ||
| git config user.name 'github-actions[bot]' |
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 21, 2026
## Explanation By default Renovate leaves a manifest alone when the new version already satisfies the declared range, so MetaMask#10318 bumped `ts-jest` to 29.4.12 in `yarn.lock` and touched no `package.json` at all. That keeps the declared minimum at the old version and produces no changelog entry, since nothing published changed. We want a changelog entry for every dependency bump, so `rangeStrategy: bump` moves the range with the release: `^29.4.11` becomes `^29.4.12` across every workspace that declares it, the same as Dependabot does today. Out of range updates like MetaMask#10320 already behaved this way. `peerDependencies` are exempted back to `widen`. An explicit `rangeStrategy` overrides Renovate's peer handling ([`npm/range.ts`](https://github.com/renovatebot/renovate/blob/main/lib/modules/manager/npm/range.ts)), and 11 peer entries here have simple ranges that would be narrowed rather than broadened, `@babel/runtime ^7.0.0` most obviously. The other 11 are complex ranges like `^16.8.0 || ^17.0.0` and widen regardless. The cost is diff size. A single patch now rewrites the same line in every manifest that declares the dependency, and each of those packages needs an entry. MetaMask#10322 is what writes them. > [!IMPORTANT] > Depends on MetaMask#10322. Without it the repair workflow still skips Renovate pull requests, and every one of them lands red on `Check changelog`. ## References Depends on MetaMask#10322. Follows MetaMask#10317. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Tooling-only change to Renovate; it does not alter runtime code, but it will enlarge dependency PR diffs across workspaces. > > **Overview** > Renovate is configured to **raise semver ranges in `package.json`** when a newer release still satisfies the existing constraint (`rangeStrategy: bump`), matching Dependabot behavior so lockfile-only bumps no longer skip manifest updates and downstream changelog tooling can see a published change. > > A **peer-only override** sets `rangeStrategy: widen` for `peerDependencies`, undoing the global bump so wide peer ranges stay broadened instead of tightened. > > **Note:** This is meant to work with the changelog repair workflow in MetaMask#10322; without that, Renovate PRs may fail `Check changelog`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9ab221a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 21, 2026
## Explanation Renames the workflow file and its `name` to `repair-dependency-upgrade-pull-requests.yml` and **Repair dependency upgrade pull requests**. Once MetaMask#10322 lands it repairs Renovate pull requests too, so `repair-dependabot-pull-requests.yml` is misleading. > [!IMPORTANT] > Depends on consensys-vertical-apps/token-exchange-service#184. The token exchange policy globs on the workflow path, so renaming the file before that merges makes the token request fail and the job never starts. #184 matches both names, so after it merges the two can land in any order. Merge after MetaMask#10322, which edits the same file. MetaMask#10322 is already queued with the interim name **Repair dependency update pull requests**, so this rebases onto that. ## References Depends on consensys-vertical-apps/token-exchange-service#184. Follows MetaMask#10322. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Cosmetic workflow metadata only; behavior is unchanged in this diff. > > **Overview** > Renames the GitHub Actions workflow’s **`name`** from *Repair dependency update pull requests* to **Repair dependency upgrade pull requests**, matching the renamed workflow file and the fact that the job will repair Renovate PRs as well as Dependabot (not just “update” wording). > > No job steps, triggers, or permissions change in this diff—only the workflow title shown in the Actions UI. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f0d7829. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Renovate pull requests reach this workflow but the job skips. The gate matches
dependabot[bot], and Renovate pull requests are authored bymetamask-ci[bot], the identity of the token it runs with. Confirmed on the first batch: the workflow triggered onrenovate/execa-10.x,renovate/unzipper-0.x-lockfileandrenovate/tstyche-7.x-lockfileand skipped all three, while #10320 sits red onCheck changelog.So the gate also matches a
renovate/branch prefix now. Everything else about the job already applies: Renovate leaves the same changelog gap, andyarn dedupeand the constraints fixer are harmless no ops when there is nothing to repair.The file name and
environment: dependabotare both left alone on purpose, and now carry a comment saying why. The token exchange policy keys on theenvironmentclaim and globs on the workflow path, so renaming either one breaks the token request before the job starts.One behaviour worth noting: Renovate's default
rebaseWhen: autostops updating a branch once someone else pushes to it, so the repairs will not be clobbered the way Dependabot clobbers them.References
Follows #10317. Part of WPC-1161.
Checklist
Note
Medium Risk
The workflow can push commits to dependency-update branches using elevated token permissions, but behavior matches the existing Dependabot path with a narrower trigger.
Overview
Extends the existing repair constraints, lockfile and changelogs workflow so it runs on Renovate PRs, not only Dependabot. The job gate now also matches branches whose head ref starts with
renovate/, because Renovate PRs are opened bymetamask-ci[bot]rather thandependabot[bot].Repair commits are authored as
github-actions[bot]instead ofmetamask-ci[bot], so Renovate’s auto-rebase stops overwriting the fixes after an “external” commit. The workflow display name is generalized; the file path andenvironment: dependabotare unchanged so OIDC token exchange keeps working.Reviewed by Cursor Bugbot for commit bcbce01. Bugbot is set up for automated code reviews on this repo. Configure here.