ci: Replace Dependabot with Renovate by matthewelwell · Pull Request #7645 · Flagsmith/flagsmith

matthewelwell · 2026-05-29T16:04:30Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Replaces Dependabot with the Renovate GitHub App:

Removes .github/dependabot.yml
Adds renovate.json configured for security-only updates, with per-area reviewers and labels matching the previous Dependabot config (uv/api → back-end team, frontend npm → front-end team, docs npm → docs team)

Motivation: Dependabot stopped recognising this as a Python repo after the migration to uv, reporting "not a Python repo" on security alerts. Renovate has more robust uv support.

The Renovate GitHub App is already installed on the org, so no additional workflow is needed.

Note: Once merged, I'll need to:

Add this repository to the renovate app here
Disable dependabot from running on this repository here

How did you test this code?

Renovate will self-verify on merge by picking up renovate.json and running its first scan.

vercel · 2026-05-29T16:04:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	May 29, 2026 4:08pm
flagsmith-frontend-preview	Ignored	Preview	May 29, 2026 4:08pm
flagsmith-frontend-staging	Ignored	Preview	May 29, 2026 4:08pm

github-actions · 2026-05-29T16:05:52Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-api-test:pr-7645`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-e2e:pr-7645`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-frontend:pr-7645`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api:pr-7645`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-7645`	Finished ✅	Results ✅

gemini-code-assist

Code Review

This pull request deletes the Dependabot configuration file, which previously managed dependency updates for the Python API (using uv) and frontend/docs (using npm). There are no review comments, and we have no feedback to provide.

CODEOWNERS already maps each directory to the correct team. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-05-29T16:11:34Z

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
38.5 seconds
cd1852f
🔄 Run: #17113 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
43.7 seconds
cd1852f
🔄 Run: #17113 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
30.1 seconds
cd1852f
🔄 Run: #17113 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
19.3 seconds
cd1852f
🔄 Run: #17113 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
39 seconds
ad16b58
🔄 Run: #17114 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
43.9 seconds
ad16b58
🔄 Run: #17114 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
42 seconds
ad16b58
🔄 Run: #17114 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
37.4 seconds
ad16b58
🔄 Run: #17114 (attempt 1)

github-actions · 2026-05-29T16:12:40Z

Visual Regression

19 screenshots compared. See report for details.
View full report

codecov · 2026-05-29T16:22:57Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.52%. Comparing base (482f0ff) to head (ad16b58).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #7645    +/-   ##
========================================
  Coverage   98.51%   98.52%            
========================================
  Files        1439     1441     +2     
  Lines       54690    54971   +281     
========================================
+ Hits        53880    54161   +281     
  Misses        810      810

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

emyller

Lezz go!!!

(one question)

emyller · 2026-05-29T16:22:29Z

+      "matchManagers": ["uv"],
+      "addLabels": ["api", "dependencies"]


question: Does the lacking matchFileNames mean we need a default runtime, which includes api/**?

khvn26 · 2026-05-29T16:07:02Z

+  "packageRules": [
+    {
+      "matchManagers": ["uv"],
+      "reviewers": ["team:flagsmith-back-end"],


should be covered by CODEOWNERS

khvn26 · 2026-05-29T16:07:08Z

+    {
+      "matchManagers": ["npm"],
+      "matchFileNames": ["frontend/**"],
+      "reviewers": ["team:flagsmith-front-end"],


should be covered by CODEOWNERS

khvn26 · 2026-05-29T16:07:12Z

+    {
+      "matchManagers": ["npm"],
+      "matchFileNames": ["docs/**"],
+      "reviewers": ["team:flagsmith-docs"],


should be covered by CODEOWNERS

khvn26 · 2026-05-29T16:25:08Z

+  "extends": ["config:base"],
+  "enabled": false,
+  "dependencyDashboard": false,
+  "osvVulnerabilityAlerts": true,
+  "semanticCommits": "enabled",
+  "semanticCommitType": "deps",
+  "semanticCommitScope": null,
+  "vulnerabilityAlerts": {
+    "enabled": true
+  },
+  "packageRules": [


Looks like this is a better expression of what we're looking for?

Suggested change

"extends": ["config:base"],

"enabled": false,

"dependencyDashboard": false,

"osvVulnerabilityAlerts": true,

"semanticCommits": "enabled",

"semanticCommitType": "deps",

"semanticCommitScope": null,

"vulnerabilityAlerts": {

"enabled": true

},

"packageRules": [

"extends": [":disableDependencyDashboard", "security:only-security-updates", "semanticCommitType(deps)"],

"packageRules": [

khvn26 · 2026-05-29T16:26:08Z

+    {
+      "matchManagers": ["uv"],
+      "reviewers": ["team:flagsmith-back-end"],
+      "addLabels": ["api", "dependencies"]


nit

Suggested change

"addLabels": ["api", "dependencies"]

"addLabels": ["api", "dependencies"],

"semanticCommitScope": "API"

khvn26 · 2026-05-29T16:26:32Z

+      "matchManagers": ["npm"],
+      "matchFileNames": ["frontend/**"],
+      "reviewers": ["team:flagsmith-front-end"],
+      "addLabels": ["front-end", "dependencies"]


nit

Suggested change

"addLabels": ["front-end", "dependencies"]

"addLabels": ["front-end", "dependencies"],

"semanticCommitScope": "Frontend"

khvn26 · 2026-05-29T16:26:42Z

+      "matchManagers": ["npm"],
+      "matchFileNames": ["docs/**"],
+      "reviewers": ["team:flagsmith-docs"],
+      "addLabels": ["docs", "dependencies"]


nit

Suggested change

"addLabels": ["docs", "dependencies"]

"addLabels": ["docs", "dependencies"],

"semanticCommitScope": "Docs"

Dependabot -> Renovate

cd1852f

matthewelwell requested a review from a team as a code owner May 29, 2026 16:04

matthewelwell requested review from Zaimwa9 and removed request for a team May 29, 2026 16:04

matthewelwell requested review from khvn26 and removed request for Zaimwa9 May 29, 2026 16:05

github-actions Bot added the ci-cd Build, test and deployment related label May 29, 2026

gemini-code-assist Bot reviewed May 29, 2026

View reviewed changes

ci: Remove redundant reviewers from renovate.json

ad16b58

CODEOWNERS already maps each directory to the correct team. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot added ci-cd Build, test and deployment related and removed ci-cd Build, test and deployment related labels May 29, 2026

emyller approved these changes May 29, 2026

View reviewed changes

khvn26 reviewed May 29, 2026

View reviewed changes

		"matchManagers": ["uv"],
		"addLabels": ["api", "dependencies"]

	"addLabels": ["api", "dependencies"]
	"addLabels": ["api", "dependencies"],
	"semanticCommitScope": "API"

	"addLabels": ["front-end", "dependencies"]
	"addLabels": ["front-end", "dependencies"],
	"semanticCommitScope": "Frontend"

	"addLabels": ["docs", "dependencies"]
	"addLabels": ["docs", "dependencies"],
	"semanticCommitScope": "Docs"

Conversation

matthewelwell commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

How did you test this code?

Uh oh!

vercel Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

github-actions Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Uh oh!

github-actions Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual Regression

Uh oh!

codecov Bot commented May 29, 2026

Codecov Report

Uh oh!

emyller left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

matthewelwell commented May 29, 2026 •

edited

Loading

vercel Bot commented May 29, 2026 •

edited

Loading

github-actions Bot commented May 29, 2026 •

edited

Loading

github-actions Bot commented May 29, 2026 •

edited

Loading

github-actions Bot commented May 29, 2026 •

edited

Loading