AI / RenovateBot Interview Questions

Renovate (also called RenovateBot) is an open-source automated dependency update tool created by Mend (formerly WhiteSource). It monitors a repository's dependency files and automatically raises pull requests whenever newer versions of dependencies are available, keeping software supply chains up to date without manual effort.

Key differentiators from Dependabot: Renovate supports far more package managers, offers rich grouping and scheduling configuration, supports monorepos natively, and can be fully self-hosted with identical behaviour to the cloud version.

Renovate follows a repeatable discover-evaluate-act cycle each time it runs.

Renovate is stateless between runs — it re-discovers everything from scratch each time. The only persistent state is the PRs and branches on the platform. Rerunning Renovate is always safe and idempotent.

There are two main ways: the Mend Renovate GitHub App (hosted, easiest) and self-hosted Renovate. Both result in the same behaviour once configured.

# .github/workflows/renovate.yml — self-hosted on GitHub Actions
name: Renovate
on:
  schedule:
    - cron: "0 2 * * 1-5"
  workflow_dispatch:
jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: renovatebot/github-action@v40
        with:
          token: ${{ secrets.RENOVATE_TOKEN }}

# renovate.json — placed in repo root
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"]
}

When Renovate first accesses a repository with no renovate.json, it raises an onboarding PR proposing a default configuration. Merging this PR activates Renovate for that repository.

renovate.json is the primary configuration file placed in the repository root. It is JSON (or JSON5 with comments) controlling every aspect of how Renovate behaves.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "enabledManagers": ["npm", "pip_requirements", "dockerfile"],
  "ignoreDeps": ["lodash"],
  "schedule": ["after 10pm every weekday", "before 5am every weekday", "every weekend"],
  "prConcurrentLimit": 5,
  "minimumReleaseAge": "3 days",
  "labels": ["dependencies", "automated"],
  "automerge": false
}

Presets are named, reusable configuration bundles that can be extended in renovate.json. Renovate ships dozens of built-in presets covering common use cases.

{
  "extends": [
    "config:recommended",
    "schedule:weekly",
    "group:allNonMajor",
    ":automergeMinor",
    ":timezone(Europe/London)",
    ":prHourlyLimit2",
    "helpers:pinGitHubActionDigests"
  ]
}

Custom organisation presets: host a renovate-config repo in your org and reference it as "github>myorg/renovate-config".

packageRules is an array of rule objects combining match criteria (which packages to target) with action settings. Rules are evaluated in order and all matching rules are merged.

{
  "packageRules": [
    {
      "matchPackagePatterns": ["^@myorg/"],
      "automerge": true,
      "automergeType": "branch"
    },
    {
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["major"],
      "labels": ["docker", "major-update"],
      "reviewers": ["team:platform"]
    },
    {
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["patch", "minor"],
      "groupName": "Dev dependency updates",
      "automerge": true
    },
    {
      "matchPackageNames": ["node"],
      "enabled": false
    }
  ]
}

The schedule field controls when Renovate is allowed to create PRs. Outside the window, Renovate detects updates but does not open new PRs. Schedules use a human-readable string format.

{
  "schedule": ["after 10pm every weekday", "before 5am every weekday", "every weekend"],
  "timezone": "Europe/London",
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "schedule": ["at any time"]
    },
    {
      "matchUpdateTypes": ["major"],
      "schedule": ["on monday"]
    }
  ]
}

The groupName setting combines multiple updates into a single PR. Built-in group presets provide common patterns.

{
  "packageRules": [
    {
      "matchPackagePatterns": ["^@aws-sdk/"],
      "groupName": "AWS SDK packages"
    },
    {
      "matchUpdateTypes": ["patch", "minor"],
      "matchDepTypes": ["devDependencies"],
      "groupName": "Dev non-major updates"
    }
  ],
  "extends": [
    "group:allNonMajor",
    "group:linters",
    "group:test",
    "group:monorepos"
  ]
}

Automerge allows Renovate to merge a PR automatically once all status checks pass. This is most useful for patch updates and trusted packages where CI provides sufficient confidence.

{
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr"
    },
    {
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true,
      "automergeStrategy": "squash"
    },
    {
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["major"],
      "automerge": false
    }
  ]
}

The Dependency Dashboard is a GitHub/GitLab issue maintained by Renovate providing a single-pane view of all pending, open, and blocked updates. Maintainers can trigger actions by checking checkboxes in the issue.

{
  "dependencyDashboard": true,
  "dependencyDashboardTitle": "Dependency Dashboard",
  "dependencyDashboardAutoclose": true
}

Renovate generates PR titles, commit messages, and branch names from configurable Handlebars-like templates.

{
  "prTitle": "chore(deps): update {{depName}} {{#if isMajor}}(MAJOR) {{/if}}to {{newVersion}}",
  "commitMessage": "chore(deps): {{commitMessageAction}} {{commitMessageTopic}}",
  "branchPrefix": "renovate/",
  "semanticCommits": "enabled",
  "semanticCommitType": "chore",
  "semanticCommitScope": "deps"
}

Credentials for private registries are stored in hostRules or environment variables — never directly in renovate.json (which is committed to source control).

// renovate.json — reference private registry (no credentials here!)
{
  "npmrc": "@myorg:registry=https://npm.pkg.github.com",
  "hostRules": [
    {
      "matchHost": "npm.pkg.github.com",
      "hostType": "npm",
      "token": "{{ secrets.GITHUB_TOKEN }}"
    },
    {
      "matchHost": "myartifactory.example.com",
      "hostType": "npm",
      "username": "{{ secrets.ARTIFACTORY_USER }}",
      "password": "{{ secrets.ARTIFACTORY_PASS }}"
    }
  ]
}

# Self-hosted: provide credentials via environment variables
export RENOVATE_TOKEN=ghp_xxx
export NPM_TOKEN=npm_xxx

docker run \
  -e RENOVATE_TOKEN="${RENOVATE_TOKEN}" \
  -e NPM_TOKEN="${NPM_TOKEN}" \
  renovate/renovate:latest \
  --token="${RENOVATE_TOKEN}" myorg/myrepo

Renovate's rangeStrategy controls how it modifies version constraints when an update is available.

{
  "rangeStrategy": "pin",
  "packageRules": [
    {
      "matchFileNames": ["packages/*/package.json"],
      "rangeStrategy": "bump"
    },
    {
      "matchFileNames": ["apps/*/package.json"],
      "matchDepTypes": ["dependencies"],
      "rangeStrategy": "update-lockfile"
    }
  ]
}

The official renovate/renovate Docker image contains the complete Renovate CLI.

# Basic Docker run for a single repository
docker run --rm \
  -e RENOVATE_TOKEN="${GITHUB_TOKEN}" \
  renovate/renovate:latest \
  --token="${GITHUB_TOKEN}" \
  myorg/myrepo

# With a global config file
docker run --rm \
  -e RENOVATE_TOKEN="${GITHUB_TOKEN}" \
  -e LOG_LEVEL="debug" \
  -v "$(pwd)/config.js:/usr/src/app/config.js" \
  renovate/renovate:latest

// config.js — global Renovate config
module.exports = {
  platform: "github",
  token: process.env.RENOVATE_TOKEN,
  autodiscover: true,
  autodiscoverFilter: ["myorg/*"],
  logLevel: "info",
  onboarding: true,
  extends: ["config:recommended"],
  prConcurrentLimit: 10,
}

Renovate has first-class GitLab support. The core functionality is identical — differences are in configuration keys, token requirements, and MR (merge request) vs PR terminology.

// config.js — GitLab self-hosted
module.exports = {
  platform: "gitlab",
  endpoint: "https://gitlab.com/api/v4/",
  token: process.env.RENOVATE_TOKEN,
  repositories: ["mygroup/myrepo"],
}

# .gitlab-ci.yml
renovate:
  image: renovate/renovate:latest
  variables:
    RENOVATE_TOKEN: $RENOVATE_TOKEN
    LOG_LEVEL: info
  script:
    - renovate
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

Renovate supports over 90 package managers (called managers), auto-detected by scanning for known file patterns.

{
  "enabledManagers": ["npm", "dockerfile", "github-actions"],
  "packageRules": [
    {
      "matchManagers": ["gradle"],
      "enabled": false
    }
  ]
}

Renovate distinguishes between the manifest (package.json) and the lockfile. lockFileMaintenance periodically regenerates the entire lockfile to update transitive dependencies.

{
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 5am on monday"]
  },
  "packageRules": [
    {
      "matchManagers": ["npm"],
      "rangeStrategy": "pin"
    }
  ]
}

Renovate's dockerfile manager extracts FROM image references and raises PRs when newer tags are available. It supports both tag-based and digest-based pinning.

# Dockerfile — Renovate parses FROM lines
FROM node:20.11.0-alpine3.19
# → PR to update to node:20.12.0-alpine3.19

# Digest pinning (immutable)
FROM node:20@sha256:a1b2c3d4...  # Renovate updates digest when node:20 changes

{
  "packageRules": [
    {
      "matchManagers": ["dockerfile"],
      "matchPackageNames": ["node"],
      "allowedVersions": "20",
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ],
  "digest": {
    "enabled": true,
    "automerge": true
  }
}

Renovate supports Helm via two managers: helmv3 (Chart.yaml dependencies) and helm-values (image tags in values.yaml).

# Chart.yaml — Renovate updates chart dependency versions
dependencies:
  - name: postgresql
    version: "13.2.0"
    repository: "https://charts.bitnami.com/bitnami"

# values.yaml — Renovate updates image tags
image:
  repository: myorg/myapp
  tag: "1.2.3"

{
  "helmv3": { "fileMatch": ["(^|/)Chart\.yaml$"] },
  "helm-values": { "fileMatch": ["(^|/)values.*\.ya?ml$"] },
  "packageRules": [
    {
      "matchManagers": ["helmv3"],
      "matchPackageNames": ["postgresql"],
      "allowedVersions": ">=13.0.0 <14.0.0",
      "groupName": "Helm database charts"
    }
  ]
}

Renovate integrates with the GitHub Security Advisory database (GHSA) and OSV to detect vulnerable dependency versions and can be configured to treat security updates differently from routine updates.

{
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security", "vulnerability"],
    "assignees": ["@security-team"],
    "prPriority": 10,
    "schedule": ["at any time"],
    "automerge": false
  },
  "schedule": ["after 9am and before 5pm every weekday"],
  "packageRules": [
    {
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["patch"],
      "schedule": ["at any time"],
      "prPriority": 5
    }
  ]
}

Renovate supports monorepos natively — it detects multiple manifest files across subdirectories and groups packages from the same source via group:monorepos.

{
  "extends": ["config:recommended", "group:monorepos"],
  "includePaths": ["packages/**", "apps/**", "libs/**"],
  "ignorePaths": ["**/node_modules/**", "legacy/**"],
  "packageRules": [
    {
      "matchPackagePatterns": ["^@myorg/"],
      "groupName": "Internal workspace packages",
      "automerge": true
    },
    {
      "matchFileNames": ["packages/*/package.json"],
      "groupName": "Package dependencies"
    }
  ]
}

minimumReleaseAge tells Renovate to wait a specified number of days after a package version is published before raising a PR, guarding against bad releases that are quickly patched.

{
  "minimumReleaseAge": "3 days",
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "minimumReleaseAge": "0 days"
    },
    {
      "matchUpdateTypes": ["major"],
      "minimumReleaseAge": "7 days"
    },
    {
      "matchPackagePatterns": ["^@myorg/"],
      "minimumReleaseAge": "0 days"
    }
  ]
}

When Renovate appears to have missed an update, most issues fall into a handful of root causes: schedule restrictions, rate limits, config rules filtering the update out, or the update being in an unexpected state.

# Debug with verbose logging
docker run --rm \
  -e RENOVATE_TOKEN="${GITHUB_TOKEN}" \
  -e LOG_LEVEL="debug" \
  renovate/renovate:latest \
  --token="${GITHUB_TOKEN}" \
  myorg/myrepo 2>&1 | grep -i "lodash"

# Dry run — shows what Renovate WOULD do without making changes
npx renovate --token="${GITHUB_TOKEN}" --dry-run=full myorg/myrepo

prCreation controls when Renovate actually opens a PR after detecting an update.

{
  "packageRules": [
    {
      "matchUpdateTypes": ["major"],
      "prCreation": "approval",
      "dependencyDashboardApproval": true
    },
    {
      "matchUpdateTypes": ["patch"],
      "prCreation": "status-success",
      "automerge": true
    },
    {
      "matchUpdateTypes": ["minor"],
      "prCreation": "not-pending"
    }
  ]
}

Renovate's terraform manager updates provider versions, module versions, and the Terraform core version in .tf files.

# main.tf — Renovate detects and updates these
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.1.2"
}

{
  "packageRules": [
    {
      "matchManagers": ["terraform"],
      "matchPackageNames": ["hashicorp/aws"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    },
    {
      "matchManagers": ["terraform"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

Renovate's github-actions manager detects uses: references and raises PRs when new action versions are available. The helpers:pinGitHubActionDigests preset pins actions to immutable SHA digests.

# .github/workflows/ci.yml — Renovate manages these
steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4.0.2

# After digest pinning:
  - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

{
  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["major"],
      "labels": ["github-actions", "major"],
      "reviewers": ["team:devops"]
    },
    {
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

Renovate classifies PRs with update types beyond major/minor/patch. Understanding pin and digest helps configure automerge correctly.

{
  "packageRules": [
    {
      "matchUpdateTypes": ["pin"],
      "automerge": true,
      "groupName": "Pin dependencies"
    },
    {
      "matchUpdateTypes": ["digest"],
      "automerge": true,
      "schedule": ["at any time"]
    },
    {
      "matchUpdateTypes": ["replacement"],
      "labels": ["dependency-replacement"],
      "automerge": false
    }
  ]
}

Renovate's rebaseWhen setting controls when it automatically rebases update branches.

{
  "rebaseWhen": "auto",
  "rebaseLabel": "rebase",
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "rebaseWhen": "behind-base-branch"
    }
  ]
}

Renovate supports several Python dependency tools, each as a separate manager.

{
  "packageRules": [
    {
      "matchManagers": ["pip_requirements", "poetry"],
      "matchPackageNames": ["django"],
      "allowedVersions": "<5",
      "minimumReleaseAge": "7 days"
    },
    {
      "matchManagers": ["pip_requirements"],
      "rangeStrategy": "pin",
      "automerge": false
    }
  ]
}

These two settings prevent Renovate from overwhelming a repository with pull requests, working at different time scales.

{
  "prHourlyLimit": 5,
  "prConcurrentLimit": 15,
  "packageRules": [
    {
      "matchUpdateTypes": ["major"],
      "prConcurrentLimit": 2,
      "prPriority": -1
    },
    {
      "matchUpdateTypes": ["patch", "minor"],
      "prPriority": 1
    }
  ]
}
// Setting to 0 removes the limit entirely (unlimited)

Renovate supports Azure DevOps for both Azure Repos (Git) and Azure Artifacts. Self-hosted deployment is the primary approach.

# Azure DevOps Pipeline — renovate.yml
trigger: none
schedules:
  - cron: "0 2 * * 1-5"
    displayName: "Nightly Renovate"
    branches:
      include: ["main"]
    always: true
pool:
  vmImage: ubuntu-latest
steps:
  - task: NodeTool@0
    inputs:
      versionSpec: "20.x"
  - script: npx renovate
    env:
      RENOVATE_TOKEN: $(RENOVATE_TOKEN)
      RENOVATE_PLATFORM: azure
      RENOVATE_ENDPOINT: https://dev.azure.com/myorg/
      RENOVATE_REPOSITORIES: "myproject/myrepo"

By default Renovate scans every file matching a known dependency pattern. ignorePaths excludes specific paths; includePaths restricts scanning to only specific paths.

{
  "ignorePaths": [
    "**/node_modules/**",
    "vendor/**",
    "legacy/**",
    "docs/**",
    "**/test/fixtures/**"
  ],
  "includePaths": [
    "src/**",
    "packages/*/package.json",
    ".github/workflows/**"
  ],
  "packageRules": [
    {
      "matchFileNames": ["docs/example/package.json"],
      "enabled": false
    }
  ]
}

Renovate's maven manager updates version properties and dependency versions in pom.xml files.

<!-- pom.xml — Renovate updates these elements -->
<properties>
  <spring.boot.version>3.2.2</spring.boot.version>
</properties>
<dependencies>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
    <version>${spring.boot.version}</version>
  </dependency>
  <dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.16.1</version>
  </dependency>
</dependencies>

{
  "packageRules": [
    {
      "matchManagers": ["maven"],
      "matchPackagePrefixes": ["org.springframework"],
      "groupName": "Spring Framework",
      "minimumReleaseAge": "7 days"
    },
    {
      "matchManagers": ["maven"],
      "matchUpdateTypes": ["major"],
      "enabled": false
    }
  ],
  "hostRules": [
    {
      "matchHost": "nexus.mycompany.com",
      "hostType": "maven",
      "username": "{{ secrets.NEXUS_USER }}",
      "password": "{{ secrets.NEXUS_PASS }}"
    }
  ]
}

postUpdateOptions enables specific actions Renovate runs after updating a dependency — such as regenerating lockfiles or running deduplication.

{
  "postUpdateOptions": ["npmDedupe", "gomodTidy"],
  "packageRules": [
    {
      "matchManagers": ["npm"],
      "postUpdateOptions": ["npmDedupe"]
    },
    {
      "matchManagers": ["gomod"],
      "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"]
    }
  ]
}

Organisation presets allow a central team to define Renovate standards in one repository and have all repos inherit them with a single line.

// Step 1: Create "renovate-config" repo in your GitHub org
// Add default.json:
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["after 9pm every weekday", "every weekend"],
  "timezone": "Europe/London",
  "prConcurrentLimit": 10,
  "minimumReleaseAge": "3 days",
  "labels": ["dependencies"],
  "semanticCommits": "enabled",
  "dependencyDashboard": true,
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "matchDepTypes": ["devDependencies"],
      "automerge": true
    },
    {
      "matchUpdateTypes": ["major"],
      "prCreation": "approval"
    }
  ]
}

// Step 2: Each repo's renovate.json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["github>myorg/renovate-config"],
  // Only repo-specific overrides:
  "ignoreDeps": ["legacy-package"]
}

allowedVersions restricts which version ranges Renovate is permitted to update to. Any version outside the allowed range is silently ignored.

{
  "packageRules": [
    {
      "matchPackageNames": ["node"],
      "allowedVersions": "20"
    },
    {
      "matchPackageNames": ["react", "react-dom"],
      "allowedVersions": "<19"
    },
    {
      "matchPackageNames": ["django"],
      "allowedVersions": "/^(3\.2|4\.2)/"
    },
    {
      "matchPackageNames": ["kubernetes"],
      "allowedVersions": ">=28.0.0 <29.0.0"
    }
  ]
}

Renovate can automatically request reviews and set assignees on PRs using configured usernames, team slugs, or randomised sample sizes.

{
  "reviewers": ["alice", "bob"],
  "assignees": ["carol"],
  "reviewersSampleSize": 1,
  "packageRules": [
    {
      "matchManagers": ["dockerfile", "helm-values", "terraform"],
      "reviewers": ["team:platform"],
      "labels": ["infrastructure"]
    },
    {
      "matchUpdateTypes": ["major"],
      "reviewers": ["team:security", "team:architecture"],
      "reviewersSampleSize": 1
    },
    {
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["patch", "minor"],
      "reviewers": [],
      "automerge": true
    }
  ],
  "reviewersFromCodeOwners": true
}

stabilityDays was renamed to minimumReleaseAge in Renovate v34. Combining timing controls gives teams precise risk-speed control per update category.

{
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "prCreation": "status-success"
    },
    {
      "matchUpdateTypes": ["minor"],
      "minimumReleaseAge": "5 days",
      "schedule": ["every weekend"],
      "automerge": false,
      "prCreation": "not-pending"
    },
    {
      "matchUpdateTypes": ["major"],
      "minimumReleaseAge": "14 days",
      "prCreation": "approval",
      "dependencyDashboardApproval": true
    }
  ],
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "timezone": "Europe/London"
}