Automatically keep swup and plugins at their latest version

There has been a request that the docs should always run on the latest version of a11y plugin.

I'd very much like this to be true for every swup dependency: core and all used @swup/ plugins.

The idea

Run a check once daily via github workflow, that checks for new versions, including major version jumps
keep a rolling PR open, e.g. deps/swup or so, that gets automatically created or updated if it already exists
checks run automatically
needs a PAT that we will need to rotate once a year, plus auto-merge activated
maybe a good use case for trying out renovate?

Questions

Should the PR auto-merge itself? I guess not, as major versions do include breaking changes
Maybe it would make sense to make the validation checks a bit more clever, at least checking e2e if there are JS errors being thrown

Regarding auto-merge: It would be great if

patch and minor releases could automatically be merged to main, triggering a re-publish.
major releases require a manual check

Implementation roadmap

Use the hosted Renovate GitHub App for regular checks, rolling PRs, and conditional auto-merge. This avoids maintaining a custom scheduled update workflow or an annually rotated PAT.

Merge policy: patch/minor updates auto-merge after required checks pass; major updates require manual review.

1. Strengthen CI first

[Bug]: tests are running against 0 pages #255

2. Configure Renovate

Done in 9489ea8 and c6c2893 (renovate.json)

~~Check daily~~ Check whenever the hosted app runs (every few hours, no schedule), restricted to runtime swup and @swup/* dependencies, including themes. Leave unrelated dependencies untouched (incl. dev-only @swup/cli and @swup/prettier-config).
Update package-lock.json for releases within existing version ranges as well as updates requiring range changes (rangeStrategy: update-lockfile).
Maintain one rolling patch/minor PR (renovate/swup) eligible for auto-merge after required checks pass.
Keep major updates separate and manual, so they cannot block patch/minor updates.
Activate the Renovate GitHub App for swup/docs
Activate renovate-approve for swup/docs, so that Renovate can review it's own PRs automatically without manual intervention from a maintainer

3. Configure the repo on GitHub

Enable "Allow auto-merge" and require the Run tests check on main.
Verify review requirements permit the intended bot auto-merges without weakening protection for other changes. Force pushes to main should be limited to maintainers (not Renovate).

4. Setup Renovate

Install the Renovate App for this repository (→ https://developer.mend.io/github/swup/docs)
Set the following settings within Renovate under https://developer.mend.io/github/swup/-/settings → Dependencies
- Make sure to adjust the settings on the swup org level, not the repo itself. The repo inherits them automatically
- Silent mode → off
- Automated PRs → on
- Require config file → on
- Create onboarding PRs → off

Install the renovate-approve app so that Renovate can approve the PRs it creates without requiring a manual review from one of the maintainers

When required, trigger Actions → Run Renovate scan on the repo's Renovate page manually to test the setup:

6. Review the initial catch-up

A local Renovate dry run predicts these PRs. Check if they get created as expected:

renovate/swup (auto-merge): lockfile updates for swup 4.x and @swup/preload-plugin 3.x
@swup/a11y-plugin → 5.x (manual)
@swup/scroll-plugin → 4.x (manual)
Review the a11y v5 migration requirements and plugin/core compatibility. At planning time, the lockfile contains a11y 4.5.2, while the registry's latest stable release is 5.2.1.
Review the scroll-plugin v4 migration requirements.

6. Verify end-to-end

New releases refresh existing rolling PRs rather than creating duplicates.
Failing required checks prevent auto-merge.
Major updates remain manual.
An auto-merged patch/minor update triggers deployment. The existing deployment workflow already runs on pushes to main.

7. Cleanup

Disable Dependabot for the repo here: https://github.com/vendor/repo/settings/security_analysis
Close any Dependabot PRs that are still lingering

Add Renovate config for swup packages

Everyhing works! 🤠

Swup and a few plugins were updated automatically and deployed to https://swup.js.org via PR #260

Before I merging the major version jumps I'll convert the codebase to typescript to make regressions easier to catch. The order:

Navigation Menu

Repository navigation

Automatically keep swup and plugins at their latest version #254

The idea

Questions

Implementation roadmap

1. Strengthen CI first

2. Configure Renovate

3. Configure the repo on GitHub

4. Setup Renovate

6. Review the initial catch-up

6. Verify end-to-end

7. Cleanup

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Automatically keep swup and plugins at their latest version #254

Description

The idea

Questions

Activity

hirasso commented on Nov 9, 2026

hirasso commented on Nov 9, 2026

Implementation roadmap

1. Strengthen CI first

2. Configure Renovate

3. Configure the repo on GitHub

4. Setup Renovate

6. Review the initial catch-up

6. Verify end-to-end

7. Cleanup

hirasso commented on Nov 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions