The Renovate GitHub App settings need one confirming look in the browser. This cannot be checked from the CLI, and one of the three is currently believed rather than verified.
Verified from the job log
The 2026-07-30T17:42Z run confirms these are set as intended:
requireConfig: "required" - "Require config file" is onforkProcessing: "enabled" - correct, since this repo is a forkonboarding: true
It also confirms the repo config resolved correctly: automerge: false, timezone: "America/Los_Angeles", schedule: ["before 6am on monday"], osvVulnerabilityAlerts: true, prConcurrentLimit: 3, prHourlyLimit: 2, minimumReleaseAge: "3 days", and helpers:pinGitHubActionDigests present in extends. Zero warnings, zero errors.
Not verified
"Automated PRs". This was inferred from the fact that PRs #39 and #40 got created, not read from the setting. That inference is reasonable but it is not the same as looking. Worth confirming, because the failure mode is quiet: if the app is in a scan-only mode, the dependency dashboard still populates and still looks healthy while no PRs ever appear.
Related and worth knowing: dependencyDashboardApproval is deliberately not set in the config, precisely because it would re-impose scan-only behaviour at the config layer and defeat the "Automated PRs" app setting. So the app setting is the only thing governing this.
Worth a glance at the same time
"Require config file" has a silent failure mode. With it on, Renovate does nothing at all - silently - if .github/renovate.json5 is absent or unparseable on the default branch. That is indistinguishable from "no updates available". If the bot ever appears to go quiet, check this before assuming there is nothing to update.
The practical guard is to validate before merging any config edit:
npx --yes --package renovate -- renovate-config-validator .github/renovate.json5
Run it from outside the project root if a package manager is ever pinned via devEngines in package.json, or a bare npx fails with EBADDEVENGINES. Not currently an issue here - this repo has no devEngines.
Done when
Someone has looked at the app's settings page and confirmed "Automated PRs" is the active mode, or corrected it.
The Renovate GitHub App settings need one confirming look in the browser. This cannot be checked from the CLI, and one of the three is currently believed rather than verified.
Verified from the job log
The 2026-07-30T17:42Z run confirms these are set as intended:
requireConfig: "required"- "Require config file" is onforkProcessing: "enabled"- correct, since this repo is a forkonboarding: trueIt also confirms the repo config resolved correctly:
automerge: false,timezone: "America/Los_Angeles",schedule: ["before 6am on monday"],osvVulnerabilityAlerts: true,prConcurrentLimit: 3,prHourlyLimit: 2,minimumReleaseAge: "3 days", andhelpers:pinGitHubActionDigestspresent inextends. Zero warnings, zero errors.Not verified
"Automated PRs". This was inferred from the fact that PRs #39 and #40 got created, not read from the setting. That inference is reasonable but it is not the same as looking. Worth confirming, because the failure mode is quiet: if the app is in a scan-only mode, the dependency dashboard still populates and still looks healthy while no PRs ever appear.
Related and worth knowing:
dependencyDashboardApprovalis deliberately not set in the config, precisely because it would re-impose scan-only behaviour at the config layer and defeat the "Automated PRs" app setting. So the app setting is the only thing governing this.Worth a glance at the same time
"Require config file" has a silent failure mode. With it on, Renovate does nothing at all - silently - if
.github/renovate.json5is absent or unparseable on the default branch. That is indistinguishable from "no updates available". If the bot ever appears to go quiet, check this before assuming there is nothing to update.The practical guard is to validate before merging any config edit:
Run it from outside the project root if a package manager is ever pinned via
devEnginesinpackage.json, or a barenpxfails withEBADDEVENGINES. Not currently an issue here - this repo has nodevEngines.Done when
Someone has looked at the app's settings page and confirmed "Automated PRs" is the active mode, or corrected it.