Renovate Triage

Renovate keeps dependencies current by opening a steady stream of update PRs. Renovate Triage decides which of them are safe to merge without a human, but only ever in the cautious direction.

How it works

A scheduled job sweeps every open Renovate PR across the org and posts a one-comment risk verdict from a local LLM, made idempotent by hashing the PR’s diff and changelog so it doesn’t re-comment on unchanged input. Automerge is scheduled only when every deterministic gate already passes (allowlist, safe tier, green CI, branch protection, cooldown) and the verdict is low. The PR diff and changelog are treated as untrusted: fenced as data, never re-fetched, never executed.

Key decisions

• The verdict is necessary, never sufficient: the model can only add the last condition to an automerge that the deterministic gates already permit. It can withhold a merge; it can never grant one on its own. The LLM is a veto, not a key.
• Fail-closed everywhere: missing metadata, CI not green, a non-low verdict, or the model simply being unreachable all resolve to the same safe outcome: schedule nothing, leave it for a human.
• Untrusted input by default: the diff and aggregated changelog are fenced as data and never executed or re-fetched upstream, so a prompt-injected or malicious PR can at worst be ignored, never trusted into a merge.
• Idempotent per content, not per run: keying on a hash of the diff and changelog means the schedule can run often without spamming comments or churning verdicts on PRs that haven’t changed.