# Renovate and Dependabot - Automation Semantics Renovate applies its config at branch creation time, not at merge time. Its internal automerge also waits for all checks, while GitHub platform auto-merge waits only for required checks. These two semantics explain why green PRs sit unmerged and which automerge mode a repo needs. ## Key points - Renovate snapshots its config into each branch at creation time. A PR opened before a config merge keeps `Automerge: Disabled by config` and never retroactively automerges. The branch inherits the new config only when Renovate updates or recreates it. - For "automerge when CI is green" in a repo with no required status checks, use Renovate-internal automerge with `platformAutomerge: false`. Renovate waits for all checks, including path-filtered builds. GitHub platform auto-merge waits only for required checks, so it can merge a PR while a build still runs. - `"minimumReleaseAge": "2 days"` holds PR creation until a release is 2 days old. Comment `@renovate rebase` on a stale PR, and Renovate rebases it onto a newly green main immediately. - `customManagers` with `regex` type solves the single-source-of-truth problem for non-standard version strings, such as a version in a Makefile or a tag in a submodule. This is more reliable than drift guards for external dependencies. - Dependabot maintains SHA-pinned reusable workflow refs. Use a plain SHA with no comment for Dependabot-managed refs. - Enforce action pins with a ratchet-style linter instead of Renovate. Renovate can be disabled for workflow paths through `matchFileNames`. A tag-only pin fails CI. - Validate a Renovate JSON5 config before you push it with `npx -y -p renovate renovate-config-validator <file>`. Separate pre-existing validator errors from new ones. Strict-JSON editor diagnostics on a JSON5 file are noise. ## How to apply 1. Validate a config change before you push it: ```bash npx -y -p renovate renovate-config-validator <file> ``` 2. Want automerge when all checks pass, and the repo has no required status checks? Set `platformAutomerge: false` and let Renovate wait for every check. 3. See green PRs that report `Automerge: Disabled by config` after you merged a config change? These PRs predate the merge. Comment `@renovate rebase` on them so Renovate recreates the branch with the new config. 4. Hold PR creation until a release is 2 days old: set `"minimumReleaseAge": "2 days"`. 5. Pin a version that lives outside a package manifest, such as in a Makefile or a submodule pointer: define a `customManagers` entry with `regex` type. 6. Let Dependabot own reusable workflow refs. Write them as a plain SHA with no comment. ## Observations - [ci] Renovate branches carry the config they were created with. A PR that predates a config merge never automerges until its branch updates. #renovate (source: agent sessions, 2026-11) - [tooling] Renovate-internal automerge waits for all checks. GitHub platform auto-merge waits only for required checks and can merge too early. #automation (source: agent sessions, 2026-11) - [dependency-management] `customManagers` with `regex` type keeps one source of truth for versions outside package manifests. #renovate (source: agent sessions, 2026-02) - [security] Dependabot keeps SHA-pinned workflow refs current. Use a plain SHA with no comment. #github-actions (source: agent sessions, 2026-10) - [verification] Validate a Renovate config before you push it. Separate pre-existing validator errors from new ones. #verification (source: agent sessions, 2026-10) - [ci] Enforce action pins with a ratchet-style linter. A tag-only pin fails CI. #ci (source: agent sessions, 2026-09) ## Relations - relates_to [[resources/documentation/GitHub Actions - Workflow Security and Rulesets]] (SHA pinning of reusable workflow refs) - relates_to [[resources/documentation/CI - Failure Triage and Silent Non-Runs]] (automerge waits on the same checks that triage investigates) - relates_to [[resources/documentation/GitHub - Pull Request Workflow]] (stale PRs and the rebase path) ## Sources - Personal agent-session notes, February 2026 to November 2026