Composer, npm and GitHub Actions

In my last post, Let Renovate keep your Docker images up to date, I showed you how to get Renovate to create pull requests for Docker images. That was only the start.

A typical web project has more things that go out of date. There are the Composer dependencies, the npm packages for the frontend build, and the actions in your GitHub workflows. Renovate can handle all of them, without any extra tools.

What does Renovate understand?

Renovate has something called managers, one for each type of file it knows. The ones I use the most in my projects are

• composer for composer.json and composer.lock
• npm for package.json and the lock file, package-lock.json, yarn.lock or pnpm-lock.yaml
• github-actions for the workflow files in .github/workflows
• dockerfile and docker-compose for the Docker images from the last post

If you already have Renovate running, the only thing you need to do, is to have these files in your repository. Renovate will find them on its own.

Composer

Renovate creates a pull request when one of your dependencies has a new version. It updates both composer.json and composer.lock, so you will see the full change in the pull request.

This is where your CI pipeline becomes important. The pull request will run your tests, and you can see if the update broke anything before you merge it.

npm

Even if I'm not a frontend developer kind of person, most projects have a package.json somewhere, for the build of CSS and JavaScript. Those packages need updates too, and there are a lot of them.

Renovate works the same way as with Composer. It updates package.json and the lock file together, whichever package manager you use, so you can see the full change in the pull request.

A nice thing to know is that Renovate doesn't need any extra configuration for it. If you have a package.json in your repository, you will get pull requests for npm packages too.

The lock file can also drift over time, as dependencies of your dependencies get new versions. Renovate can refresh it for you, in a separate pull request, on a schedule that you decide.

{
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 5am on monday"]
  }
}

This works for Composer too, so you can use it in both kinds of projects.

GitHub Actions

The workflow files are easy to forget. You write uses: actions/checkout@v4, and then you don't look at it for a year.

Renovate will create pull requests for these too. You can go a step further, and pin the actions to a specific commit instead of a version tag. A tag can be moved, but a commit can't, so this is safer.

Renovate has a preset for this

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests"
  ]
}

Your workflow will now look like this, and Renovate keeps it updated

- uses: actions/checkout@<commit-sha> # v4.x.x

Auto-merge the safe updates

Having a pull request for every update is great, but I don't want to click merge on all of them. For the safe ones I let Renovate do it.

For me the safe ones are minor and patch updates of the development dependencies, like PHPUnit and PHPStan for Composer, or the linters and build tools for npm. They don't change how my code runs in production.

In Composer the development dependencies are called require-dev, and in npm they are called devDependencies. Renovate needs to know both.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests"
  ],
  "packageRules": [
    {
      "matchDepTypes": ["require-dev", "devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

Renovate waits for your CI checks to pass before it merges. So please make sure that you have some tests, and that they run on pull requests. Without tests, auto-merge has nothing to protect you.

When auto-merge is a bad idea

Major updates can contain breaking changes, so I want to look at those myself. I don't want to have them auto-merged, and I don't want to be nagged about them either.

This is where the Dependency Dashboard comes in. You can tell Renovate to wait for your approval on major updates.

{
  "matchUpdateTypes": ["major"],
  "dependencyDashboardApproval": true
}

Add it to your packageRules. The major updates will now show up as Pending Approval in the dashboard, and Renovate creates the pull request when you tick the box. You might remember this view from my last post, where I had Renovate running in silent mode by mistake.

Conclusion

With a few lines of configuration, Renovate watches your Docker images, your Composer and npm packages and your GitHub Actions. The safe updates are merged for me, and I decide on the rest.

Have fun with fewer outdated dependencies.