From e0937b6da5a087c7f74c9d371c2abc468e101c32 Mon Sep 17 00:00:00 2001 From: Matthew Elwell Date: Mon, 14 Sep 2026 10:39:07 +0100 Subject: [PATCH 1/3] ci(renovate): fix gitAuthor and widen lock file maintenance window Renovate commits as the flagsmith-engineering GitHub App (216534828+flagsmith-engineering[bot]@users.noreply.github.com), but RENOVATE_GIT_AUTHOR was set to a noreply address carrying user ID 1414362, which belongs to an unrelated account. isBranchModified() strips gitAuthorEmail from the set of authors seen on a branch and treats anything left over as a human edit, so every branch Renovate created looked externally modified on the next run. That silently blocked all rebases and left PR-less branches permanently stuck. The variable itself is fixed in repo settings. This adds gitIgnoredAuthors so the docs-artefacts workflow, which pushes to Renovate branches under a third address, does not reintroduce the same false positive. Also widens the lock file maintenance window. GitHub delays the 03:00 UTC cron by 18-22 minutes, leaving under 40 minutes of headroom against a 4am cutoff, and a miss costs a full week. Co-Authored-By: Claude Opus 5 --- renovate.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 330f05c06836..4a182d4b0e9e 100644 --- a/renovate.json +++ b/renovate.json @@ -4,9 +4,10 @@ "security:only-security-updates", ":semanticCommitTypeAll(deps)" ], + "gitIgnoredAuthors": ["flagsmith-engineering[bot]@users.noreply.github.com"], "lockFileMaintenance": { "enabled": true, - "schedule": ["before 4am on monday"] + "schedule": ["before 9am on monday"] }, "packageRules": [ { From f6354ff01383c63eacb3910af6ddc9cc2c7455a3 Mon Sep 17 00:00:00 2001 From: Matthew Elwell Date: Mon, 14 Sep 2026 17:33:51 +0100 Subject: [PATCH 2/3] ci(renovate): stop lock file maintenance PRs picking an arbitrary scope One lock file maintenance branch covers api, docs, frontend and mcp, but semanticCommitScope is a scalar taken from whichever upgrade sorts first, so the PR came out titled deps(mcp) while touching all four. Moving the rule last and clearing the scope gives "deps: Lock file maintenance". It has to be last because packageRules are applied again after the updateType config (flatten.ts), so from its old position the per-path rules below re-applied and won. --- renovate.json | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/renovate.json b/renovate.json index 4a182d4b0e9e..c222b5b27da5 100644 --- a/renovate.json +++ b/renovate.json @@ -10,11 +10,6 @@ "schedule": ["before 9am on monday"] }, "packageRules": [ - { - "description": "Re-enable lock file maintenance, which security:only-security-updates disables via its blanket matchPackageNames ['*'] rule. Renovate raises security PRs from manifest entries, so a CVE in a package that appears only in a lock file is never actioned; refreshing the lock file within existing ranges is the only mechanism that reaches transitive pins.", - "matchUpdateTypes": ["lockFileMaintenance"], - "enabled": true - }, { "matchManagers": ["pep621"], "matchFileNames": ["api/**"], @@ -50,6 +45,12 @@ "matchPackageNames": ["flagsmith-common", "flagsmith-private"], "enabled": true, "rangeStrategy": "bump" + }, + { + "description": "Re-enable lock file maintenance, which security:only-security-updates disables — it is the only mechanism that reaches CVEs pinned solely in lock files. Keep last with an empty scope: packageRules are re-applied after the updateType config, so the per-path rules above would otherwise scope this PR to one arbitrary workspace.", + "matchUpdateTypes": ["lockFileMaintenance"], + "enabled": true, + "semanticCommitScope": "" } ], "semanticCommitScope": "" From cd723a591cdf20103deea45e7c67e4706006f8b8 Mon Sep 17 00:00:00 2001 From: Matthew Elwell Date: Mon, 14 Sep 2026 17:38:50 +0100 Subject: [PATCH 3/3] Desloppification --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index c222b5b27da5..40d1c3150233 100644 --- a/renovate.json +++ b/renovate.json @@ -47,7 +47,7 @@ "rangeStrategy": "bump" }, { - "description": "Re-enable lock file maintenance, which security:only-security-updates disables — it is the only mechanism that reaches CVEs pinned solely in lock files. Keep last with an empty scope: packageRules are re-applied after the updateType config, so the per-path rules above would otherwise scope this PR to one arbitrary workspace.", + "description": "Re-enable lock file maintenance, which security:only-security-updates disables. Keep last with an empty scope to ensure commit scope is applied correctly.", "matchUpdateTypes": ["lockFileMaintenance"], "enabled": true, "semanticCommitScope": ""