CI: no Renovate config validation gate on a preset that ships org-wide

[marcusrbrown]

default.json is a public preset consumed by every repo extending local>fro-bot/.github, but .github/workflows/main.yaml has no Renovate config validation step. A malformed rule ships org-wide with local validation as the only check.

This is not hypothetical for allowedVersions specifically: if a value fails all four parse branches, lookup/filter.ts throws CONFIG_VALIDATION for the entire repository config, not just the one dependency — so a single bad rule in the shared preset breaks Renovate for every consumer, not just the dep it targets.

Suggested addition to the Lint job:

- name: ✅ Validate Renovate config
  run: pnpm dlx --package renovate renovate-config-validator --strict default.json .github/renovate.json5

Raised during review of #3791 and kept out of that PR because it modifies CI.

[marcusrbrown]

Correction to the suggested command in the description, found while verifying it: --strict currently fails on default.json — but not for any new reason.

renovate-config-validator default.json            → exit 0
renovate-config-validator --strict default.json   → exit 1

The only finding is a pre-existing deprecation:

-  "matchSourceUrlPrefixes": ["https://github.com/bfra-me", "https://github.com/fro-bot"]
+  "matchSourceUrls": ["https://github.com/bfra-me{/,}**", "https://github.com/fro-bot{/,}**"]

--strict promotes WARN: Config migration necessary to a non-zero exit. So whoever implements this gate has to pick one:

1. Apply the migration first, then add the gate with --strict — preferred, since it also clears the deprecation before it becomes a hard removal upstream.
2. Add the gate without --strict now, and migrate separately — weaker, since deprecations then never fail the build.

Option 1 is one edit to an existing rule and makes the gate meaningful from day one.

[fro-bot]

Confirmed the gap, reproduced the validator locally, and found two problems with the suggested command. The gate is worth adding — but not as written, and not for the reason stated.

The gap is real

.github/workflows/main.yaml runs six jobs — lint, check-types, test, test-scripts-load, check-workflows, check-wiki-authority. None of them touch default.json or .github/renovate.json5. pnpm lint is check-md-links && eslint; ESLint doesn't parse Renovate semantics. Nothing validates the preset before it ships.

Reproduction: the gate fails on main today

Renovate 44.50.3, Node 24.20.0, repo at a7b536f:

$ pnpm dlx --package renovate renovate-config-validator --strict default.json .github/renovate.json5
INFO: Validating default.json as global config
WARN: Config migration necessary
WARN: Config migration diff:
-       "matchSourceUrlPrefixes": [
-         "https://github.com/bfra-me",
-         "https://github.com/fro-bot"
-       ],
+       "matchSourceUrls": [
+         "https://github.com/bfra-me{/,}**",
+         "https://github.com/fro-bot{/,}**"
+       ]
INFO: Validating .github/renovate.json5 as global config
EXIT=1

default.json:40 still uses matchSourceUrlPrefixes, removed upstream. It's the only migration in either file — .github/renovate.json5 is clean. So merging the step alone turns main red immediately. The preset fix has to land first or in the same PR.

Same failure class as marcusrbrown/renovate-config#1417 (Renovate config uses deprecated/removed options), which that repo tracks as an issue rather than an auto-fix PR. Worth staying consistent.

Defect 1: the command validates as global config

Note Validating default.json as global config. From config-validator.js:

let isGlobalConfig = true;
if (opts.global === false) isGlobalConfig = false;
const configType = isGlobalConfig ? "global" : "repo";

Any filename passed as an argument is treated as self-hosted global config unless you pass --no-global. That's the wrong validation surface for a repo preset — repo-scoped option checks aren't applied. Add the flag:

- name: ✅ Validate Renovate config
  run: pnpm dlx --package renovate renovate-config-validator --strict --no-global default.json .github/renovate.json5

With --no-global the output becomes Validating default.json as repo config. Still exit 1, for the migration above.

Defect 2: this gate does not catch the allowedVersions failure you cited

This is the part that undercuts the issue's premise. I injected garbage into allowedVersions:

{"packageRules": [{"matchPackageNames": ["python"], "allowedVersions": "<=3.13 || not-a-range(("}]}

$ renovate-config-validator --strict --no-global min-bad.json
EXIT=0

Clean pass. The validator checks schema shape and option names; it does not evaluate range strings. The CONFIG_VALIDATION throw in lookup/filter.ts happens at lookup time, downstream of anything a static validator sees. The blast radius you describe — one bad range breaking the whole repo config for every consumer — is accurate, and this gate would not have stopped it.

What the gate does catch, measured:

Failure	Caught?
Unknown/typo'd option (automergeTypo)	yes, exit 1
Invalid regex in matchPackageNames (/^(unclosed/)	yes, exit 1
Deprecated/removed options, via migration + --strict	yes, exit 1
Malformed allowedVersions range	no, exit 0
Nonexistent preset in extends	no, exit 0 (no network resolution)

That's still a worthwhile net — typos and dead options are the failures that actually accumulate in a preset nobody re-reads. Just don't sell it as allowedVersions insurance.

One more: pnpm dlx can't build the native re2 binding here, so you get WARN: RE2 not usable, falling back to RegExp: regex validation may be inaccurate. The regex check still fired via the fallback, but expect that warning in CI logs and don't let it get mistaken for a failure.

Next steps

1. Fix default.json first. Replace matchSourceUrlPrefixes with the migrated matchSourceUrls glob form Renovate emits above. Separate PR, no CI changes — cleanly reviewable.
2. Add the step with --no-global. Put it in check-workflows rather than lint; that job is already the "config shape" gate, and lint is scoped to source style. It needs no pnpm bootstrap, so it costs one dlx fetch.
3. Pin the validator. pnpm dlx --package renovate resolves floating and downloads Renovate on every run. Either pin renovate@44.50.3 in the command or add it as a devDependency so it lands in the pnpm store cache the setup action already restores, and Renovate keeps it current. Second option is cleaner — one fewer unversioned thing in CI.
4. Track allowedVersions separately if you want it covered. A static validator can't do it. A small scripts/ check that feeds each allowedVersions value through the matching versioning scheme's isValid would, and would fit alongside the existing test-scripts-load pattern. Out of scope for this issue unless you want it.

Blocked on nothing. Item 1 is the prerequisite; items 2 and 3 land together.

---

Run Summary

Field	Value
Event	issues
Repository	fro-bot/.github
Run ID	33281123399
Cache	hit
Session	ses_fb023398dffef2MAT3CKp8W1zQ

[fro-bot]

This issue is stale because it has been open for 30 days with no activity. Remove this label to keep it open.