chore(ci): Renovate を導入し依存更新を自動化#336
Conversation
actions/pip/npm/terraform/docker/nix の 6 エコシステムを対象に Renovate（Mend hosted app）の設定を追加。固定運用（SHA pin / == 固定 / digest pin）は維持し、更新提案の PR 起票のみ自動化する。 自動マージは行わず全 PR を人間レビューとする。採用判断は ADR-0014 に記録。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
📝 WalkthroughWalkthroughReplaces the minimal ChangesRenovate Dependency Automation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
onboarding で main に追加されたデフォルト renovate.json を削除し、 6 エコシステム対応の .github/renovate.json5 に一本化する。設定ファイル 重複（Renovate の multiple config エラー）を防ぐ。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docs/adr/0014-renovate-dependency-automation.md (1)
9-13: ⚖️ Poor tradeoffReduce duplication of pinning strategy descriptions.
The pinning strategies (GitHub Actions digest, Python
==, Terraform~>, Nixflake.lock) are described in both the Context section (lines 9–13) and the Decision section (lines 31–35). This violates DRY principles. Consolidate by removing the repetition from one section or extracting to a shared reference point.Since the guideline
.claude/rules/common/duplication.md(referenced on line 68) is not provided in the review context, I cannot definitively verify if this violates the Rule of Three or extraction hierarchy. Please confirm whether this duplication is acceptable per your project's duplication policy.💡 Example refactor: Move details to Decision, leave summary in Context
Context (lines 9–13): Remove detailed list, keep high-level statement.
-DevForge は依存をすべて「固定」運用している。GitHub Actions は SHA(digest) ピン留め -（`uses: actions/checkout@34e1148... # v4`）、Python は `backend/requirements.txt` で -`==` 完全固定、infra プロバイダは `~>` 制約 + `.terraform.lock.hcl`、Nix は `flake.lock` -で固定している。これはサプライチェーン攻撃... +DevForge は依存をすべて「固定」運用している（詳細は決定内容を参照）。 +これはサプライチェーン攻撃...Decision (lines 31–35): Keep detailed breakdown here.
Also applies to: 31-35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/adr/0014-renovate-dependency-automation.md` around lines 9 - 13, The pinning strategies for GitHub Actions, Python, Terraform, and Nix are described in duplicate within the Context section (lines 9-13) and the Decision section (lines 31-35) of this ADR document. Consolidate this duplication by keeping the detailed pinning strategy breakdown in the Decision section and replacing the detailed list in the Context section with a high-level summary statement that acknowledges DevForge uses fixed dependency versions without repeating the specific strategy details for each tool.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/renovate.json5:
- Line 2: The comment on line 2 of the renovate.json5 file contains an incorrect
reference path. Update the comment that currently references docs/development.md
to instead point to the correct Architecture Decision Record location at
docs/adr/0014-renovate-dependency-automation.md. Replace the path portion of the
comment while keeping the rest of the descriptive text intact.
---
Nitpick comments:
In `@docs/adr/0014-renovate-dependency-automation.md`:
- Around line 9-13: The pinning strategies for GitHub Actions, Python,
Terraform, and Nix are described in duplicate within the Context section (lines
9-13) and the Decision section (lines 31-35) of this ADR document. Consolidate
this duplication by keeping the detailed pinning strategy breakdown in the
Decision section and replacing the detailed list in the Context section with a
high-level summary statement that acknowledges DevForge uses fixed dependency
versions without repeating the specific strategy details for each tool.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 01bf1d24-bff9-4420-afa1-4071cc96a1cc
📒 Files selected for processing (3)
.github/renovate.json5docs/adr/0014-renovate-dependency-automation.mdrenovate.json
💤 Files with no reviewable changes (1)
- renovate.json
| @@ -0,0 +1,82 @@ | |||
| { | |||
| // Renovate 設定の正本。詳細: ADR-0014 / docs/development.md | |||
There was a problem hiding this comment.
Correct the reference path in the comment.
Line 2 references docs/development.md, but the actual Architecture Decision Record is located at docs/adr/0014-renovate-dependency-automation.md. Update the comment to point to the correct path.
💡 Proposed fix
- // Renovate 設定の正本。詳細: ADR-0014 / docs/development.md
+ // Renovate 設定の正本。詳細: ADR-0014 / docs/adr/0014-renovate-dependency-automation.md📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| // Renovate 設定の正本。詳細: ADR-0014 / docs/development.md | |
| // Renovate 設定の正本。詳細: ADR-0014 / docs/adr/0014-renovate-dependency-automation.md |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/renovate.json5 at line 2, The comment on line 2 of the
renovate.json5 file contains an incorrect reference path. Update the comment
that currently references docs/development.md to instead point to the correct
Architecture Decision Record location at
docs/adr/0014-renovate-dependency-automation.md. Replace the path portion of the
comment while keeping the rest of the descriptive text intact.
1 participant
概要
依存更新を自動追従する仕組みが無かった（Dependabot / Renovate 未導入）課題に対し、Renovate（Mend hosted app） を導入する。固定運用は維持したまま、更新の PR 起票のみ自動化 する。
採用判断の詳細は
docs/adr/0014-renovate-dependency-automation.mdを参照。対象エコシステム（6 manager）
.github/workflows/*.ymlpinDigests（SHA +# v4コメント継続）backend/requirements.txtrangeStrategy: pin（==維持）web/package.json+ lockinfra/.../versions.tf+ 各 env lock~>+ lock 更新backend/Dockerfile,docker-compose.ymldocker:pinDigests（digest 固定）flake.nix+flake.lock方針
:dependencyDashboardで全更新を Issue 一覧管理vulnerabilityAlertsを優先起票し pip-audit の後追いを先回りで補強lockFileMaintenance有効（package-lock / flake.lock / .terraform.lock.hcl をリフレッシュ）schedule+prConcurrentLimit/prHourlyLimit検証
Config validated successfully）make ciは非該当マージ後の手動ステップ⚠️
実際に稼働させるには、GitHub で Mend Renovate App をこのリポジトリにインストールする必要がある（GitHub App の権限付与はブラウザ操作）。設定ファイルが既にあるため onboarding PR はスキップされ、Dependency Dashboard Issue が立つ。
🤖 Generated with Claude Code
Summary by CodeRabbit