AI / RenovateBot Interview Questions
1. What is Renovate and what problem does it solve for software teams?
Renovate (also called RenovateBot) is an open-source automated dependency update tool created by Mend (formerly WhiteSource). It monitors a repository's dependency files and automatically raises pull requests whenever newer versions of dependencies are available, keeping software supply chains up...
2. How does Renovate work at a high level — what is its execution flow?
Renovate follows a repeatable discover-evaluate-act cycle each time it runs. Renovate execution flow Step What happens 1. Discover repos Connects to platform API and lists accessible repositories 2. Clone and scan Each repo is cloned; dependency files are detected 3. Extract dependencies Files ar...
3. How do you install and enable Renovate on a GitHub repository?
There are two main ways: the Mend Renovate GitHub App (hosted, easiest) and self-hosted Renovate . Both result in the same behaviour once configured. # .github/workflows/renovate.yml â self-hosted on GitHub Actions name: Renovate on: schedule: - cron: "0 2 * * 1-5" workflow_dispatch: jobs: reno...
4. What is renovate.json and what are the most important top-level configuration options?
renovate.json is the primary configuration file placed in the repository root. It is JSON (or JSON5 with comments) controlling every aspect of how Renovate behaves. { "$schema" : "https://docs.renovatebot.com/renovate-schema.json" , "extends" : [ "config:recommended" ], "enabledManagers" : [ "npm...
5. What are Renovate presets and how do you use them?
Presets are named, reusable configuration bundles that can be extended in renovate.json . Renovate ships dozens of built-in presets covering common use cases. { "extends" : [ "config:recommended" , "schedule:weekly" , "group:allNonMajor" , ":automergeMinor" , ":timezone(Europe/London)" , ":prHour...
6. What are packageRules in Renovate and how do you use them to customise update behaviour per package?
packageRules is an array of rule objects combining match criteria (which packages to target) with action settings . Rules are evaluated in order and all matching rules are merged. { "packageRules" : [ { "matchPackagePatterns" : [ "^@myorg/" ], "automerge" : true , "automergeType" : "branch" }, { ...
7. How does Renovate scheduling work and what schedule syntax does it support?
The schedule field controls when Renovate is allowed to create PRs. Outside the window, Renovate detects updates but does not open new PRs. Schedules use a human-readable string format. { "schedule" : [ "after 10pm every weekday" , "before 5am every weekday" , "every weekend" ], "timezone" : "Eur...
8. How does Renovate's grouping feature work and how do you configure it?
The groupName setting combines multiple updates into a single PR. Built-in group presets provide common patterns. { "packageRules" : [ { "matchPackagePatterns" : [ "^@aws-sdk/" ], "groupName" : "AWS SDK packages" }, { "matchUpdateTypes" : [ "patch" , "minor" ], "matchDepTypes" : [ "devDependencie...
9. What is automerge in Renovate and what are the different automerge strategies?
Automerge allows Renovate to merge a PR automatically once all status checks pass. This is most useful for patch updates and trusted packages where CI provides sufficient confidence. { "packageRules" : [ { "matchUpdateTypes" : [ "patch" ], "automerge" : true , "automergeType" : "pr" }, { "matchDe...
10. What is the Renovate Dependency Dashboard and how does it work?
The Dependency Dashboard is a GitHub/GitLab issue maintained by Renovate providing a single-pane view of all pending, open, and blocked updates. Maintainers can trigger actions by checking checkboxes in the issue. { "dependencyDashboard" : true , "dependencyDashboardTitle" : "Dependency Dashboard...
11. How do you configure Renovate pull request titles, commit messages, and branch names?
Renovate generates PR titles, commit messages, and branch names from configurable Handlebars-like templates. { "prTitle" : "chore(deps): update {{depName}} {{#if isMajor}}(MAJOR) {{/if}}to {{newVersion}}" , "commitMessage" : "chore(deps): {{commitMessageAction}} {{commitMessageTopic}}" , "branchP...
12. How do you configure Renovate to work with private npm registries and other private package sources?
Credentials for private registries are stored in hostRules or environment variables — never directly in renovate.json (which is committed to source control). // renovate.json â reference private registry (no credentials here!) { "npmrc" : "@myorg:registry=https://npm.pkg.github.com" , "hostRule...
13. How does Renovate handle versioning and range strategies for different package ecosystems?
Renovate's rangeStrategy controls how it modifies version constraints when an update is available. rangeStrategy values Value Behaviour Example auto (default) Picks the best strategy per manager npm → replace; pip → pin pin Convert ranges to exact pinned versions ^1.2.0 → 1.3.0 bump Bump the rang...
14. How do you run Renovate self-hosted using Docker?
The official renovate/renovate Docker image contains the complete Renovate CLI. # Basic Docker run for a single repository docker run --rm \ -e RENOVATE_TOKEN = "${ GITHUB_TOKEN }" \ renovate/renovate:latest \ --token = "${ GITHUB_TOKEN }" \ myorg/myrepo # With a global config file docker run --r...
15. How does Renovate support GitLab and what differences exist compared to GitHub?
Renovate has first-class GitLab support. The core functionality is identical — differences are in configuration keys, token requirements, and MR (merge request) vs PR terminology. // config.js â GitLab self-hosted module.exports = { platform: "gitlab", endpoint: "https://gitlab.com/api/v4/", to...
16. What package managers does Renovate support and how are they detected?
Renovate supports over 90 package managers (called managers ), auto-detected by scanning for known file patterns. Key Renovate managers by ecosystem Ecosystem Manager Files detected JavaScript npm package.json, package-lock.json, yarn.lock Python pip_requirements / poetry requirements.txt, pyproj...
17. How does Renovate handle npm lockfiles and what is lockFileMaintenance?
Renovate distinguishes between the manifest ( package.json ) and the lockfile. lockFileMaintenance periodically regenerates the entire lockfile to update transitive dependencies. { "lockFileMaintenance" : { "enabled" : true , "schedule" : [ "before 5am on monday" ] }, "packageRules" : [ { "matchM...
18. How does Renovate update Docker image versions in Dockerfiles?
Renovate's dockerfile manager extracts FROM image references and raises PRs when newer tags are available. It supports both tag-based and digest-based pinning. # Dockerfile â Renovate parses FROM lines FROM node: 20.11.0 - alpine3 .19 # â PR to update to node:20.12.0-alpine3.19 # Digest pinni...
19. How does Renovate handle Helm chart updates?
Renovate supports Helm via two managers: helmv3 (Chart.yaml dependencies) and helm-values (image tags in values.yaml). # Chart.yaml â Renovate updates chart dependency versions dependencies: - name: postgresql version: "13.2.0" repository: "https://charts.bitnami.com/bitnami" # values.yaml â ...
20. How does Renovate handle security vulnerability updates and CVE patching?
Renovate integrates with the GitHub Security Advisory database (GHSA) and OSV to detect vulnerable dependency versions and can be configured to treat security updates differently from routine updates. { "vulnerabilityAlerts" : { "enabled" : true , "labels" : [ "security" , "vulnerability" ], "ass...
21. How do you configure Renovate for a monorepo with multiple packages?
Renovate supports monorepos natively — it detects multiple manifest files across subdirectories and groups packages from the same source via group:monorepos . { "extends" : [ "config:recommended" , "group:monorepos" ], "includePaths" : [ "packages/**" , "apps/**" , "libs/**" ], "ignorePaths" : [ ...
22. What is the minimumReleaseAge setting and why is it recommended?
minimumReleaseAge tells Renovate to wait a specified number of days after a package version is published before raising a PR, guarding against bad releases that are quickly patched. { "minimumReleaseAge" : "3 days" , "packageRules" : [ { "matchUpdateTypes" : [ "patch" ], "minimumReleaseAge" : "0 ...
23. How do you debug Renovate when it is not creating expected PRs?
When Renovate appears to have missed an update, most issues fall into a handful of root causes: schedule restrictions, rate limits, config rules filtering the update out, or the update being in an unexpected state. Debugging checklist Check How to investigate Dependency Dashboard Check which sect...
24. What is Renovate's prCreation setting and what are the available options?
prCreation controls when Renovate actually opens a PR after detecting an update. prCreation values Value Behaviour immediate (default) Open the PR as soon as an update is detected not-pending Wait until all branch status checks are complete before opening the PR status-success Only open the PR if...
25. How does Renovate handle Terraform and infrastructure-as-code updates?
Renovate's terraform manager updates provider versions, module versions, and the Terraform core version in .tf files. # main . tf â Renovate detects and updates these terraform { required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } module ...
26. How do you configure Renovate for GitHub Actions workflow updates?
Renovate's github-actions manager detects uses: references and raises PRs when new action versions are available. The helpers:pinGitHubActionDigests preset pins actions to immutable SHA digests. # .github/workflows/ci.yml â Renovate manages these steps: - uses: actions/checkout@v4 - uses: actio...
27. What is the difference between Renovate's 'pin' and 'digest' update types?
Renovate classifies PRs with update types beyond major/minor/patch. Understanding pin and digest helps configure automerge correctly. All Renovate update types Type Meaning Example major Breaking change 1.x.x → 2.0.0 minor New features, backward-compatible 1.2.x → 1.3.0 patch Bug fixes, backward-...
28. How do you configure Renovate to rebase or update pull requests when the base branch changes?
Renovate's rebaseWhen setting controls when it automatically rebases update branches. rebaseWhen values Value Behaviour auto (default) Rebase when PR is behind the base branch OR has conflicts never Never rebase — leave branch as-is even if conflicts exist conflicted Only rebase if there are merg...
29. How does Renovate work with Python dependency management (pip, Poetry, pip-compile)?
Renovate supports several Python dependency tools, each as a separate manager. Python manager coverage Manager Files Notes pip_requirements requirements*.txt Simple requirements files; exact version pins pip-compile requirements*.in Updates .in files and regenerates .txt poetry pyproject.toml + p...
30. What are Renovate's prHourlyLimit and prConcurrentLimit and how do they work together?
These two settings prevent Renovate from overwhelming a repository with pull requests, working at different time scales. PR limiting settings Setting Controls Default prHourlyLimit Maximum new PRs opened in a single Renovate run 2 prConcurrentLimit Maximum total open Renovate PRs at any one time ...
31. How do you configure Renovate to support Azure DevOps repositories?
Renovate supports Azure DevOps for both Azure Repos (Git) and Azure Artifacts. Self-hosted deployment is the primary approach. # Azure DevOps Pipeline â renovate.yml trigger: none schedules: - cron: "0 2 * * 1-5" displayName: "Nightly Renovate" branches: include: ["main"] always: true pool: vmI...
32. What is Renovate's 'ignorePaths' and 'includePaths' and when do you need them?
By default Renovate scans every file matching a known dependency pattern. ignorePaths excludes specific paths; includePaths restricts scanning to only specific paths. { "ignorePaths" : [ "**/node_modules/**" , "vendor/**" , "legacy/**" , "docs/**" , "**/test/fixtures/**" ], "includePaths" : [ "sr...
33. How does Renovate handle Maven (Java) dependency updates?
Renovate's maven manager updates version properties and dependency versions in pom.xml files.
34. What is Renovate's 'postUpdateOptions' and what post-update actions does it support?
postUpdateOptions enables specific actions Renovate runs after updating a dependency — such as regenerating lockfiles or running deduplication. Common postUpdateOptions values Value What it does npmDedupe Run npm dedupe after updating package-lock.json yarnDedupeHighest Run yarn-deduplicate to re...
35. How do you use Renovate's 'extends' to create and share an organisation-wide preset?
Organisation presets allow a central team to define Renovate standards in one repository and have all repos inherit them with a single line. // Step 1: Create "renovate-config" repo in your GitHub org // Add default.json: { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends"...
36. What is Renovate's 'allowedVersions' configuration and how do you use it to restrict updates?
allowedVersions restricts which version ranges Renovate is permitted to update to. Any version outside the allowed range is silently ignored. { "packageRules" : [ { "matchPackageNames" : [ "node" ], "allowedVersions" : "20" }, { "matchPackageNames" : [ "react" , "react-dom" ], "allowedVersions" :...
37. How do you configure Renovate to automatically add reviewers and assignees to pull requests?
Renovate can automatically request reviews and set assignees on PRs using configured usernames, team slugs, or randomised sample sizes. { "reviewers" : [ "alice" , "bob" ], "assignees" : [ "carol" ], "reviewersSampleSize" : 1 , "packageRules" : [ { "matchManagers" : [ "dockerfile" , "helm-values"...
38. What was Renovate's 'stabilityDays' setting and what is the recommended timing/stability configuration?
stabilityDays was renamed to minimumReleaseAge in Renovate v34. Combining timing controls gives teams precise risk-speed control per update category. Timing and stability controls Setting What it controls minimumReleaseAge Minimum time a version must be published before Renovate raises a PR sched...
