Config-help: Branch automerge is not working for protected branches even if given push access

[jfairley]

Which Renovate are you using?

WhiteSource Renovate App

Which platform are you using?

GitHub.com

Have you checked the logs? Don't forget to include them if relevant

yes (snippet included)

What would you like to do?

This feels like a duplicate of https://github.com/renovatebot/renovate/issues/4460, but the configuration mentioned there isn't working for me, and I don't know what more to try.

I too have branch protection enabled:

(click for screenshot)

... and I tried explicitly adding renovate as a user who could push. I have also tried with this unchecked

(click for screenshot)

... but renovate is unable to push from a branch

DEBUG: Found PR #170(branch="renovate/docker-circleci-node-12")
DEBUG: Returning from graphql open PR list(branch="renovate/docker-circleci-node-12")
DEBUG: Found branch protection(branch="renovate/docker-circleci-node-12")
DEBUG: Branch protection: PR Reviews are required before merging(branch="renovate/docker-circleci-node-12")
DEBUG: Branch protection: Pushing to branch is restricted(branch="renovate/docker-circleci-node-12")
{
  "users": [],
  "teams": []
}
DEBUG: Branch is stale and needs rebasing(branch="renovate/docker-circleci-node-12")

click to see my config

{
  "extends": [
    "config:base",
    "docker:pinDigests",
    "group:recommended",
    "group:definitelyTyped",
    "group:fortawesome",
    "group:linters",
    "group:reactMonorepo",
    "schedule:weekly"
  ],
  "automerge": true,
  "labels": ["dependencies"],
  "packageRules": [
    {
      "extends": ["schedule:nonOfficeHours"],
      "automerge": true,
      "automergeType": "branch",
      "datasources": ["docker", "orb"]
    },
    {
      "extends": ["schedule:daily"],
      "automerge": true,
      "automergeType": "branch",
      "depTypeList": ["devDependencies"],
      "updateTypes": ["minor", "patch", "pin", "digest"]
    },
    {
      "groupName": "dev-tools",
      "packageNames": [
        "check-node-version",
        "concurrently",
        "create-ts-index",
        "fixpack",
        "husky",
        "is-ci",
        "lint-staged",
        "nodemon",
        "prettier",
        "rimraf",
        "semantic-release",
        "ts-node",
        "wait-on"
      ],
      "packagePatterns": ["^@commitlint/", "^@semantic-release/", "webpack"]
    },
    {
      "groupName": "cypress",
      "packageNames": ["cypress"],
      "packagePatterns": ["^@cypress/", "^cypress-"]
    },
    {
      "groupName": "enzyme",
      "packageNames": ["enzyme"],
      "packagePatterns": ["^enzyme-adapter-"]
    },
    {
      "groupName": "graphql",
      "packagePatterns": ["apollo", "graphql"]
    },
    {
      "groupName": "jest",
      "packageNames": ["@types/jest", "jest", "ts-jest"],
      "packagePatterns": ["^jest-"]
    },
    {
      "groupName": "styled-components",
      "packagePatterns": ["styled-components"]
    },
    {
      "groupName": "vx",
      "packagePatterns": ["^@vx/"]
    }
  ],
  "separateMultipleMajor": true,
  "timezone": "America/Denver",
  "updateNotScheduled": false
}

[rarkins]

The problem is PR Reviews are required before merging. If that's enabled, then even those with push access can't push directly.

[jfairley]

OK, I was curious if that was it, but I wasn't sure. I can push, but I'm an admin.

Curious, do you know if I made the renovate bot an admin if it could push, or would it not even try because it detects the branch protection rules?

[rarkins]

I wasn't aware you can make apps into an admin. We assume we are not though, so don't have any logic to handle that scenario if so.

[jfairley]

You might be right. I tried to add renovate as a repo admin, and it wanted to consume a github seat. I mean, maybe it would work, but it's not worth it for me to pay for an additional seat.

[jfairley]

It'd be really nice if github allowed rule exceptions, like "this rule applies to everyone except renovate".

[rarkins]

FYI:

• the user "renovate" is not us so be careful you don't add them
• we control @renovate-bot but don't currently use its credentials/token for anything like merging
• GitHub chose to disable automerging for Dependabot after it was integrated, apparently for security reasons (so it doesn't contribute to propagating any future malicious packages) so they may not be inclined to let you give another bot such powers :)

[jfairley]

Thanks for the dialog @rarkins. My preferred branch permissions have me at a dead end on automerge. I'll focus on setting up package rules to combine certain dependencies into fewer PRs.

[rarkins]

I'm assuming you're able to get PR-based automerging working though?

[jfairley]

Well, we also have a requirement for 1 review which gets dismissed on change, so usually even if i review a PR, it'll get rebased and dismissed more likely than merged, so usually, I just end up merging most of them myself.

[rarkins]

Check out github.com/apps/renovate-approve

[jfairley]

@rarkins Ooh. That is exactly what I need. Thanks!

[jfairley]

I got it all set up yesterday, and renovate-approve approved and merged ~20 PRs last night. 🎉 🎊 🥇 Thanks again!