agentic-dev/docs/work/2026-05-14-ci-security-and-supply-chain/03-renovate-adoption/_story.md

id, epic, title, type, status, feature, depends-on, blocks

id	epic	title	type	status	feature	depends-on	blocks
03-renovate-adoption	2026-05-14-ci-security-and-supply-chain	Renovate adoption	technical-story	done	tooling		09-ci-security-guide-and-docs

Goal

Ship .github/renovate.json configuring automated dependency management: grouped per-ecosystem npm bumps, Dockerfile base-image tracking, GitHub Actions SHA pinning, automerge for green minor+patch PRs, and a single dependency dashboard issue.

Why

Major-tag pinning for GitHub Actions is documented insecure — the 2025 tj-actions/changed-files incident proved it. Renovate's pinGitHubActionDigests preset automates the one-time SHA-pin sweep and keeps SHAs current thereafter. Grouping ecosystem clusters (Sentry, OTel, tRPC, Payload, Inversify) into weekly PRs prevents noise while ensuring drift is surfaced. Automerge on green minor+patch PRs removes human toil for routine bumps.

Done when

• .github/renovate.json exists and is valid JSON, extending presets: config:base, helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor, :automergePatch.
• packageRules groups @sentry/*, @opentelemetry/*, @trpc/*, payload*, and inversify* into per-cluster weekly PRs.
• Dockerfile manager is enabled for .sandcastle/Dockerfile.
• dependencyDashboard: true is set (opens a single Renovate-managed issue summarising open + queued PRs, labeled renovate/dashboard per PRD Q6).
• Renovate's bump commits use chore(deps): (minor/patch) and chore(deps-major): (major) commit-message prefixes so release-please's per-package bump rules apply cleanly.
• pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass (no executable code change; JSON config only).

In scope

• .github/renovate.json — full Renovate configuration.

Out of scope

• Verifying the first Renovate PR (SHA-pin sweep) — that happens when the GitHub App runs, not at commit time. The success criterion (all @v<N> pins rewritten to SHAs) is verified when Renovate's first PR merges.
• Renovate Dependency Dashboard → docs/work/ task integration — explicitly out of scope in the PRD.

Tasks

• Create .github/renovate.json extending presets config:base, helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor, :automergePatch; add packageRules grouping @sentry/*, @opentelemetry/*, @trpc/*, payload*, inversify* into weekly per-cluster PRs; enable Dockerfile manager for .sandcastle/Dockerfile; set dependencyDashboard: true; set commitMessagePrefix to enforce chore(deps): / chore(deps-major): per Conventional Commits; one commit, all gates pass.