Restore Renovate: RENOVATE_TOKEN setup and post-merge validation across three repos

[vredchenko]

Summary

The Mend.io-hosted org-wide Renovate GitHub App has been unreliable since late April 2026 — last dependency PR landed 2026-04-29 on smartem-frontend, dashboards stale 4-5 weeks on the other two. Visible cost on smartem-decisions: four manually-authored security bumps in 17 days (mako, urllib3, idna, starlette CVEs) that Renovate should have automated.

PRs to restore the self-hosted Renovate workflow (originally dropped 2026-03-25 in #182) are open on the three smartem repos. fandanGO-cryoem-dls excluded from this round.

PRs

• chore: restore self-hosted Renovate workflow smartem-decisions#289
• chore: restore self-hosted Renovate workflow #214
• chore: restore self-hosted Renovate workflow smartem-frontend#100

Each adds .github/workflows/renovate.yml only. Twice-daily cron (0 4,16 * * *) plus workflow_dispatch. Pins renovatebot/github-action@v46.1.14 (latest as of 2026-05-11). Reads existing renovate.json — no config changes.

Step-by-step (in order)

• 1. Create fine-grained PAT. See "RENOVATE_TOKEN setup" below.
• 2. Add RENOVATE_TOKEN secret to all three repos (same value).
• 3. Merge the three PRs (#289, chore: restore self-hosted Renovate workflow #214, Accessibility (a11y) improvements needed #100).
• 4. Trigger the first run manually on each repo: Actions → Renovate → Run workflow. Do NOT wait for the 04:00 cron. The first manual run is the validation gate — watch one complete cleanly before walking away.
• 5. Verify the Dependency Dashboard issue refreshes on each repo (#282, Dependency Dashboard #195, Database Production Readiness Assessment - Critical Gaps Identified #82 update in place).
• 6. Verify at least one real PR appears for an item from each dashboard's "Awaiting Schedule" list. Most likely candidates: osv-scanner-action v2.3.3 → v2.3.5 on smartem-decisions/devtools, npm minor/patch group on smartem-frontend.
• 7. Pin the Dependency Dashboard issues on each repo (Issues → … → Pin issue). Currently none of them are pinned.
• 8. Set calendar reminder to rotate RENOVATE_TOKEN one year out (fine-grained PAT max lifetime).

RENOVATE_TOKEN setup

Open https://github.com/settings/personal-access-tokens/new (fine-grained PAT, NOT classic).

Field	Value
Token name	Renovate (SmartEM repos)
Expiration	1 year (max for fine-grained)
Resource owner	vredchenko (your user — DLS org admin not required)
Repository access	Only select repositories → smartem-decisions, smartem-devtools, smartem-frontend

Repository permissions (everything else: No access):

Permission	Level
Actions	Read
Contents	Read and write
Issues	Read and write
Metadata	Read (mandatory, auto-selected)
Pull requests	Read and write
Workflows	Read and write

Workflows: Read and write is required because Renovate updates .github/workflows/* (the github-actions manager is enabled in renovate/default.json).

Click Generate, copy the token. For each of the three repos: Settings → Secrets and variables → Actions → New repository secret → name RENOVATE_TOKEN, paste value.

PRs Renovate opens will be authored as vredchenko (the PAT identity), not as a bot — this is fine for portfolio repos. To move to a bot identity later, swap the PAT for a GitHub App token; no workflow changes needed.

What about the existing Dependency Dashboard issues (#282, #195, #82)?

Leave them alone. Renovate updates them in place on every run. Once Renovate restarts, each will refresh with current state — checked [x] items on smartem-frontend#82 will be processed (PRs created), stale awaiting-schedule items will be re-evaluated.

Do NOT close them — Renovate may recreate or, in some configurations, treat closure as "disable dashboard for this repo".

Once Renovate is running, pin them on each repo so they're easy to find.

What about the closed "Action Required" issues (#260, #178, #77)?

Already resolved 2026-04-28 (preset path // separator fix). Leave closed. If Renovate fires a new "Action Required" issue after the self-hosted restoration, that's a real signal — investigate immediately.

What this issue does NOT cover

• DLS cyber-sec session prep on native secret scanning / push protection — see Decide: enable GitHub native secret scanning + push protection alongside gitleaks? #213.
• CodeQL adoption — pending separate discussion.
• fandanGO-cryoem-dls — excluded from this Renovate restoration round.

Background

See PR #182 for the original "drop self-hosted" reasoning (sound at the time, didn't pan out empirically). See #172 for the Dependabot→Renovate migration context.