Renovate bot demo - keep your dependencies up to date

By Mindaugas Urbontaitis
2021-04-16

Hello 👋

Renovate bot demo

  • Why do we need automated dependency management?
  • Automated dependency management tools
  • What is Renovate bot?
  • Configuring Renovate bot
  • Checking and merging the Pull Requests

Why do we need automated dependency management?

  • A lot of dependencies per project
  • Time-consuming to check every dependency
  • Security updates

Snyk report 2020

  • 🥇 maven
  • 🥈 npm

Automated dependency management tools

  • Dependabot ^1
    • Github
  • Renovatebot ^2
    • Bitbucket (beta)
    • Github App
    • Gitlab App

Renovate 🤖

  • cli
  • selfhosted
  • GitHub App / Azure DevOps Ext. ^3
  • Supports different managers
    • maven
    • npm
    • helm
    • docker

How Renovate 🤖 works

  • 🤖 checks for updates
  • 🤖 opens pull requests
  • 👩‍💻 review and merge

Demo - onboarding renovate 🤖 

"onboardingConfig": {        
    "packageRules": [
        {
            "packagePatterns": ["*"],
            "updateTypes": ["patch", "minor"],
            "groupName": "non-major",
            "groupSlug": "non-major-dependencies"
        },        
        {
            "managers": ["maven", "npm"],
            "registryUrls": ["https://artifactory.custom.com/releases"]
        }
    ]
}

Demo - managers

"packageRules": [
    {
            "managers": [
              "maven",
              "npm"
            ]
    }
]

Demo - Package patterns

"packageRules": [
          {
            "packagePatterns": [
              "*"
            ],
            "updateTypes": [
              "patch",
              "minor"
            ],
            "groupName": "non-major",
            "groupSlug": "non-major-dependencies"
          }
]

Demo - Allowed versions

"packageRules": [
    {
      "groupName": "spring-boot",
      "matchDatasources": "maven",
      "matchPackageNames": [
        "org.springframework.boot:spring-boot-starter-parent"
      ],
      "allowedVersions": "<2.4.0"
    }
  ]

Wrap up

  • Pin your frontend dependencies
  • Group your dependencies
  • Limit 🤖 PR commit count
  • Start one by one project

Questions❓

Thanks 🙏

  • Renovate docs ^4
  • Preset group examples ^5
  • Presentation ^6 https://www.urbontaitis.lt/renovatebot

Global style