Harden renovate config

[AlexSkrypnyk]

Review configs in https://github.com/Akollade/renovate-config and analyse missing items and assign a priority/criticality of the changes.

[AlexSkrypnyk]

@coderabbitai plan this

[coderabbitai]

🔗 Related PRs

#1686 - Fixed Renovate config. [merged]
#2277 - Updated Renovate config to only update deps in the root of the project. [merged]
#2278 - Add config to Renovate to update root FE deps. [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Summary

• Security-first prioritization: Docker digest pinning and vulnerability alerts address the most critical gaps, protecting against supply-chain attacks and ensuring rapid security response
• Controlled automation: Automerge is enabled selectively for low-risk updates (dev dependencies, patches) while requiring approval for risky changes (unstable versions, majors)
• Gap-focused changes: Only implementing features genuinely missing from current config; GitHub Actions digest pinning is already present via existing package rule
• Dashboard-driven oversight: Using dependencyDashboardApproval allows visibility into all available updates while giving explicit control over when risky updates are applied

Implementation Steps

Phase 1: Security Hardening

This phase addresses critical security gaps by adding digest pinning for Docker images and enabling vulnerability alert handling. These changes reduce supply-chain attack vectors and ensure timely security patches.

Task 1: Add Docker Digest Pinning

Extend the configuration to pin Docker image digests, ensuring immutable references and protection against tag mutation attacks.

• Add the docker:pinDigests preset to the extends array in renovate.json
• This ensures all Docker images in .docker/ Dockerfiles and docker-compose.yml are pinned to specific SHA256 digests
• Renovate will automatically add digest suffixes and update them when new versions are available

Task 2: Configure Vulnerability Alerts

Enable Renovate's vulnerability alert handling to prioritize and auto-merge security patches with appropriate urgency.

• Add a vulnerabilityAlerts configuration block to renovate.json
• Configure with enabled: true, appropriate labels (e.g., Security), and a weekday-morning schedule for rapid response
• Enable automerge: true for vulnerability fixes to minimize exposure time
• Set dependencyDashboardApproval: false to allow immediate PR creation for security issues

🤖 Prompt for AI agents

Implement security hardening changes in `renovate.json`. The goal is to add
Docker digest pinning and enable vulnerability alert handling.

- In the `extends` array, add `"docker:pinDigests"` preset
- Add a top-level `vulnerabilityAlerts` configuration block with the following
settings:
  - `enabled: true`
  - An appropriate label such as `"Security"`
  - A weekday-morning schedule for rapid response
  - `automerge: true`
  - `dependencyDashboardApproval: false`

Phase 2: Update Safety & Approval Workflows

This phase introduces safeguards against accidentally adopting unstable or breaking changes by requiring explicit approval for risky updates. These controls balance automation with human oversight for critical decisions.

Task 1: Add Unstable Version Controls

Prevent automatic updates to pre-release versions (beta, alpha, RC) that may introduce instability.

• Add a package rule matching Packagist dependencies with matchCurrentVersion patterns for /beta|alpha|rc|dev/i
• Set dependencyDashboardApproval: true to require explicit approval before updating to unstable versions
• Apply to both PHP (Packagist) and potentially npm dependencies
• Add descriptive group name like "Unstable versions - Requires approval"

Task 2: Enhance Drupal Core Update Handling

Refine Drupal core update strategy to separate patch-level updates (safer to auto-apply) from minor updates (require review).

• Modify the existing "PHP - Drupal core - Minor and patch" rule to split into separate rules
• Create a new rule for Drupal core patches with automerge: true and higher prPriority (e.g., 15)
• Create a separate rule for Drupal core minor updates requiring dependencyDashboardApproval: true
• Add separateMinorPatch: true to ensure patches and minor updates are handled independently
• Major updates remain disabled as currently configured via the "PHP - All packages - Major" rule

Task 3: Convert JavaScript Major Updates to Approval Workflow

Change JavaScript major updates from disabled to approval-gated, providing visibility into available updates while maintaining control.

• Modify the existing "JavaScript - All packages - Major - Skipped" rule in renovate.json
• Change from enabled: false to dependencyDashboardApproval: true
• This provides visibility into available major updates in the dependency dashboard while preventing automatic PRs

🤖 Prompt for AI agents

Implement update safety and approval workflow changes in `renovate.json`. The
goal is to add controls that require explicit human approval for risky or
unstable updates.

- Add a new `packageRules` entry to gate pre-release versions:
- Match Packagist (and potentially npm) dependencies using a
`matchCurrentVersion` regex pattern for `/beta|alpha|rc|dev/i`
  - Set `dependencyDashboardApproval: true`
  - Set `groupName: "Unstable versions - Requires approval"`

- Split the existing "PHP - Drupal core - Minor and patch" `packageRules` entry
into two separate rules:
- **Patch rule**: target patch-level updates, set `automerge: true` and
`prPriority: 15`
- **Minor rule**: target minor-level updates, set `dependencyDashboardApproval:
true`
- Add `separateMinorPatch: true` to ensure patches and minor updates are handled
independently
- Leave the existing major update handling ("PHP - All packages - Major" rule)
unchanged

- Modify the existing "JavaScript - All packages - Major - Skipped"
`packageRules` entry:
  - Remove `enabled: false`
  - Add `dependencyDashboardApproval: true`

Phase 3: Workflow Optimization

This phase adds automerge capabilities for safe updates and optimizes PR handling to reduce developer overhead while maintaining quality controls.

Task 1: Configure DevDependency Automerge

Enable automerge for low-risk development dependencies to reduce PR noise and manual merge overhead.

• Add a package rule for npm devDependencies matching matchDepTypes: ["devDependencies"]

• Enable automerge: true for minor, patch, pin, and digest update types

• Group these updates together with groupName: "JavaScript - DevDependencies - Minor and patch"

• Set prPriority: 10 to process these efficiently

• Add a similar rule for Composer require-dev dependencies

• Match using matchDepTypes: ["require-dev"] for Packagist datasource

• Enable automerge for minor and patch updates with appropriate grouping

• Exclude from this rule any dev dependencies that require manual testing

Task 2: Enable Platform Automerge

Leverage GitHub's native merge capabilities for approved automerge PRs.

• Add platformAutomerge: true at the top level of renovate.json
• This delegates the actual merge action to GitHub after CI passes
• Requires branch protection rules to be configured appropriately in the repository settings

Task 3: Add PR Concurrency Limits

Add explicit PR limits to manage review workload since the default hourly limit has been removed.

• The current config has ignorePresets: [":prHourlyLimit2"] which removes the default 2 PRs/hour limit
• Add explicit prConcurrentLimit (suggest 3-5 for manageable review load)
• Optionally add prHourlyLimit: 10 for reasonable burst protection
• Existing schedules are already well-configured and do not need changes

Task 4: Add Package Grouping Rules

Group related packages to reduce PR count and ensure coordinated updates.

• Add a grouping rule for PHPStan packages: matchPackageNames: ["/^phpstan/"] with appropriate group name
• Add a grouping rule for Twig packages if applicable: matchPackageNames: ["/^twig/"]
• Consider grouping Drupal tooling packages (drush, drupal-lenient) for coordinated updates
• These grouping rules complement existing grouping strategies

🤖 Prompt for AI agents

Implement workflow optimization changes in `renovate.json`. The goal is to
enable safe automerge for low-risk updates, reduce PR noise, and fine-tune rate
limiting and grouping.

- Add `"platformAutomerge": true` at the top level of `renovate.json`
- Add explicit `prConcurrentLimit` (suggested value: 3–5) at the top level;
optionally add `prHourlyLimit: 10` for burst protection; note that existing
schedules do not need changes

- Add a new `packageRules` entry for npm `devDependencies`:
  - `matchDepTypes: ["devDependencies"]`
  - `automerge: true` for minor, patch, pin, and digest update types
  - `groupName: "JavaScript - DevDependencies - Minor and patch"`
  - `prPriority: 10`

- Add a new `packageRules` entry for Composer `require-dev` dependencies:
  - `matchDepTypes: ["require-dev"]` with Packagist datasource
  - `automerge: true` for minor and patch updates
  - Appropriate `groupName`
  - Exclude any dev dependencies that require manual testing

- Add new `packageRules` grouping entries:
- PHPStan packages: `matchPackageNames: ["/^phpstan/"]` with an appropriate
group name
- Twig packages (if applicable): `matchPackageNames: ["/^twig/"]` with an
appropriate group name
  - Consider a grouping rule for Drupal tooling packages (drush, drupal-lenient)

Research

Codebase Summary

This is a Drupal project using Vortex scaffolding with dependency management via Composer (PHP) and npm (JavaScript), Docker-based local development, and GitHub Actions for CI/CD. The existing renovate.json provides comprehensive package rules organized by technology stack (PHP, JavaScript, Docker, GitHub Actions) with grouping strategies, scheduling, and a custom regex manager for docker-compose image references. The configuration already includes GitHub Actions digest pinning via package rule and well-structured schedules, but lacks Docker digest pinning, vulnerability alert handling, automerge capabilities, and several workflow optimizations present in the Akollade shared presets.

File-Level Change Summary

Primary file: renovate.json

Section	Changes Required
extends array	Add docker:pinDigests preset (GitHub Actions pinning already implemented via package rule)
Top-level config	Add platformAutomerge: true, add prConcurrentLimit
New block	Add vulnerabilityAlerts configuration object
packageRules	Add 4-5 new rules: unstable version control, devDependency automerge (npm + composer), package grouping
packageRules	Modify existing Drupal core rule to split patch vs minor handling with separateMinorPatch: true
packageRules	Modify JS major rule from enabled: false to dependencyDashboardApproval: true

Priority Classification:

Priority	Changes
Critical	Docker digest pinning, Vulnerability alerts
High	Unstable version controls, Drupal core patch/minor separation
Medium	DevDependency automerge, Platform automerge, JS major approval workflow
Low	PR concurrency limits, Package grouping rules

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement security hardening changes in `renovate.json`. The goal is to add
Docker digest pinning and enable vulnerability alert handling.

- In the `extends` array, add `"docker:pinDigests"` preset
- Add a top-level `vulnerabilityAlerts` configuration block with the following
settings:
  - `enabled: true`
  - An appropriate label such as `"Security"`
  - A weekday-morning schedule for rapid response
  - `automerge: true`
  - `dependencyDashboardApproval: false`
===============================================================================

Task: 2

Implement update safety and approval workflow changes in `renovate.json`. The
goal is to add controls that require explicit human approval for risky or
unstable updates.

- Add a new `packageRules` entry to gate pre-release versions:
- Match Packagist (and potentially npm) dependencies using a
`matchCurrentVersion` regex pattern for `/beta|alpha|rc|dev/i`
  - Set `dependencyDashboardApproval: true`
  - Set `groupName: "Unstable versions - Requires approval"`

- Split the existing "PHP - Drupal core - Minor and patch" `packageRules` entry
into two separate rules:
- **Patch rule**: target patch-level updates, set `automerge: true` and
`prPriority: 15`
- **Minor rule**: target minor-level updates, set `dependencyDashboardApproval:
true`
- Add `separateMinorPatch: true` to ensure patches and minor updates are handled
independently
- Leave the existing major update handling ("PHP - All packages - Major" rule)
unchanged

- Modify the existing "JavaScript - All packages - Major - Skipped"
`packageRules` entry:
  - Remove `enabled: false`
  - Add `dependencyDashboardApproval: true`
===============================================================================

Task: 3

Implement workflow optimization changes in `renovate.json`. The goal is to
enable safe automerge for low-risk updates, reduce PR noise, and fine-tune rate
limiting and grouping.

- Add `"platformAutomerge": true` at the top level of `renovate.json`
- Add explicit `prConcurrentLimit` (suggested value: 3–5) at the top level;
optionally add `prHourlyLimit: 10` for burst protection; note that existing
schedules do not need changes

- Add a new `packageRules` entry for npm `devDependencies`:
  - `matchDepTypes: ["devDependencies"]`
  - `automerge: true` for minor, patch, pin, and digest update types
  - `groupName: "JavaScript - DevDependencies - Minor and patch"`
  - `prPriority: 10`

- Add a new `packageRules` entry for Composer `require-dev` dependencies:
  - `matchDepTypes: ["require-dev"]` with Packagist datasource
  - `automerge: true` for minor and patch updates
  - Appropriate `groupName`
  - Exclude any dev dependencies that require manual testing

- Add new `packageRules` grouping entries:
- PHPStan packages: `matchPackageNames: ["/^phpstan/"]` with an appropriate
group name
- Twig packages (if applicable): `matchPackageNames: ["/^twig/"]` with an
appropriate group name
  - Consider a grouping rule for Drupal tooling packages (drush, drupal-lenient)

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[AlexSkrypnyk]

@coderabbitai Did you see my current renovate.json? Some of the items are already there. Please update your plan accordingly to only list the gap.

[coderabbitai]

I've updated the plan above based on your feedback. Ready to proceed when you are!