From Renovate logs

Fallback to renovate.json file as a preset is deprecated, please use a default.json file instead.

default.json is the new default filename for shared presets¹. renovate.json has been deprecated.

Please don't use scripts for automerging the renovate PRs.

Whenever a new major version of a dependency is pushed and renovate opens a PR, we should take the time to read the changelog and not blindly merge them because tests are passing.

Because of this, some PRs that contained breaking changes that also affected the dependee package and these were merged as patch releases.

Now, I understand that these PRs could have been marked with a "Request Changes" review and it would have stopped them from being merged, however we shouldn't blindly rely on tests passing to merge these PRs

Seems like the noise is still there even though we have removed helpers:pinGitHubActionDigests

Example: octokit/auth-unauthenticated.js#161

Should we run a script to move GitHub actions back to a tag? i.e. actions/setup-node@v3

Discussed in https://github.com/orgs/octokit/discussions/57

https://github.com/octokit/rest.js/pull/1988#issuecomment-765050746

Checking the presets and props of renovate.json is should be trying to autoMerge. Is this renovate.json the one being used or there are others extending/overriding this one?

If there is not one I will search for potential opened issues in Renovate Bot repo.

📖 Description

Create a reusable test.yml workflow to be used across all the repositories of Octokit.js ecosystem.

🏁 Goal

1. To centralize GitHub Workflows used across repositories in Octokit so we can easily maintain them in a single point
2. To reduce the noise Renovatebot produces when a third-party GitHub Action inside our workflows has an update¹.

🔭 Scope

• As a first step, this re-usable workflow will support octokit/*{.js|.ts} only.
• Runs npm run lint --if-present
• Runs npm run build --if-present (context here)

🔮 Future work

• Compose actions/checkout and actions/setup-node and evaluate the execution time (more info here)
• Extend this workflow to support the remaining octokit/* of the JS Ecosystem (more info here)
• To evaluate the type-only test with tsd (context here)

🚚 Migration Plan

WIP

💬 Discussion points / 🚫 Blockers

name: Test
jobs:
  test_matrix:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node_version:
          - 18
          - 20
    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js ${{ matrix.node_version }}
        uses: actions/setup-node@v3
        with:
          node-version: ${{ matrix.node_version }}
          cache: npm
      - run: npm ci
      - run: npm test
  test:
    runs-on: ubuntu-latest
    needs: test_matrix
    steps:
      - run: exit 1
        if: ${{ needs.test_matrix.result != 'success' }}
      - uses: actions/checkout@v3
      - run: npm ci
      - run: npm run lint
    if: ${{ always() }}

this morning, i noticed that a lockfile update was treated as a fix and triggered a new version to be published. i imagine this isnt what you intended, so you might want to consider taking semanticPrefixFixDepsChoreOthers into account in your packageRules.

i think just starting with

    {
      "matchPackagePatterns": [
        "*"
      ],
      "semanticCommitType": "chore"
    }

is likely the detail that you'd want to add.