ci: validate the shared dependency update policy - #30
Merged
Merged
Conversation
A mistake in the shared policy degrades to the bot staying quiet, which looks exactly like the policy working. The file now decides update behaviour for every repository in the org, so a bad edit disarms dependency updates everywhere and reports nothing. Key changes: - Add a check that runs on every change to the policy files, failing the build rather than merging a policy that does nothing - Reject options the bot does not recognise and values of the wrong type, which is how a typo degrades to silence - Reject malformed JSON ahead of the bot's own validator, which accepts trailing commas through a JSON5 fallback and exits zero - Fail when no policy file is found, so the check cannot pass vacuously Claude-Session: https://claude.ai/code/session_01QP4dYFku9krW7bng4mzriX
kevwilliams
approved these changes
Sep 9, 2026
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Approving. The check is not a no-op: jq enforces strict JSON (catching the trailing-comma/JSON5 cases the bot's own validator waves through) and renovate-config-validator --strict runs against the real Renovate schema, so unrecognized options and wrong-typed values fail the build. It validates both renovate-config.json and renovate.json, which both exist at repo root. Triggers correctly on pull_request scoped to the relevant paths (plus a push-to-main backstop), no pull_request_target, and no permissions block so the default token stays read-only. Commit message is clear and matches the diff.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A mistake in the shared dependency update policy degrades to the bot staying quiet, which is exactly what the policy looks like when it is working correctly. Nobody can tell a quiet bot from a broken one without opening a dashboard and checking by hand, and that policy now governs every repository in the org. This adds a check that fails on a broken policy before it merges, so the mistake is loud instead of invisible. It catches unrecognised options, values of the wrong type, and malformed JSON that the bot's own validator waves through.
Test plan
Related to datum-cloud/infra#4933
https://claude.ai/code/session_01QP4dYFku9krW7bng4mzriX