Phase 1 — Discovery

[farhan]

The output of this phase is a short design doc / decision record answering:

• Host repo: does the shared config live in a new openedx/renovate-config, under openedx/.github, or somewhere else?
• Preset shape: one preset, or a base + frontend + backend split? What goes in each, given the FE/BE divergence above?
• Policy reconciliation: for places where current configs disagree (automerge breadth, schedules, semantic commits, vulnerability alerts), what's the org default? Where do we honor existing per-repo overrides vs. unify?
• Override pattern: how does a repo opt out or extend (e.g. team reviewers, custom grouping) without forking the whole config?
• Repo inventory: the ~40 repos with existing configs, plus repos that should have Renovate but don't today.
• POC scope: pick 1–2 FE repos and 1–2 BE repos to migrate first.

[farhan]

Discovery Notes (from initial research)

1. Audit existing renovate.json versions across repos

• There are 58 repos in openedx with a renovate.json (excluding test fixtures and cookiecutter templates)
• Most use "extends": ["config:base"]; a few (e.g. xblocks-core) have migrated to "config:recommended"
• File locations are inconsistent: some repos use root-level renovate.json, others use .github/renovate.json
• openedx-platform uses .github/renovate.json5 (JSON5 format — allows comments)
• The shared preset should standardize on the latest recommended base (config:recommended over the deprecated config:base)

2. Python packages — Renovate does NOT handle them

• openedx manages Python dependency updates via a separate GitHub Actions workflow: .github/workflows/upgrade-python-requirements.yml
• Runs every Tuesday via cron, uses a dedicated REQUIREMENTS_BOT_GITHUB_TOKEN
• Calls a shared reusable workflow from openedx/.github
• The shared Renovate preset should not add any Python package manager config — this is intentionally handled elsewhere

3. GitHub Actions updates — defer to Dependabot

• openedx uses Dependabot (not Renovate) for GitHub Actions updates
• Every dependabot.yml checked is GitHub Actions-only:

  updates:
    - package-ecosystem: "github-actions"
      directory: "/"
      schedule:
        interval: "weekly"

• 30 repos currently have both renovate.json and dependabot.yml — since config:base enables GitHub Actions updates in Renovate by default, these repos risk getting duplicate PRs for the same Action update
• The shared preset should explicitly disable the github-actions manager in Renovate to avoid conflicts with Dependabot

Summary of what the shared preset should cover

Dependency type	Tool	Notes
npm / JS packages	✅ Renovate	Primary use case
GitHub Actions	❌ Renovate (disable)	Handled by Dependabot
Python packages	❌ Renovate	Handled by upgrade-python-requirements workflow