Dep Warden Guide
Your 30-minute Monday ritual to keep dependencies healthy across all repos.
Every Monday at 08:45 ICT, Renovate has already run over the weekend and grouped all pending dependency updates into PRs. A Slack message lands in #tradeit-dev tagging the warden with a summary. The warden's job is to spend ~30 minutes reviewing what needs a human decision — everything else is automated.
The Monday Slack message looks like this. It shows the stats for all repos and lists any repos with open PRs. Click ▶️ Start 30-min ritual to begin — this starts the timer and confirms you're on duty.
At +25 min Slack pings you "5 minutes left". At +30 min it reminds you to post a summary. If you're unavailable, click 🙋 Take ownership to hand to someone else, or ⛔ Skip this week.
The dashboard shows live data for all 12 repos. Repos are sorted by open PR count so the busiest ones are at the top. Focus on anything non-zero.
| Column | What to do |
|---|---|
| Open PRs | Check they're not stuck. Patch/minor PRs auto-merge if CI is green — no action needed. |
| Auto-merged 7d | Informational — confirms automation is working. |
| Stuck >1w 🔴 | Open the PR, check why CI is failing, fix or escalate to the owning dev. |
| Queued majors 🟡 | Click Dashboard → approve in the GitHub issue (Step 4). |
For each repo with open PRs, click the repo name to go to GitHub. Filter by author:app/renovate to see only Renovate PRs.
| PR type | Label | Action |
|---|---|---|
| Patch updates | auto-merge | Nothing. CI merges them automatically if green. |
| Dev dep minor | auto-merge | Nothing. Auto-merged on CI pass. |
| Prod dep minor (grouped) | review | Scan the changelog in the PR. If nothing looks breaking, approve and merge. |
| Major bump | major-bump | Don't merge directly — approve via Dashboard issue first (Step 4). |
| Security fix | security | Already auto-merged. Just verify CI passed. |
Click the Dashboard link in the deps page for any repo showing 🟡 queued majors. It opens a GitHub issue titled "Dependency Dashboard #XXXX" that looks like this:
renovate.json → default.json warning will clear after Renovate's next run following our config rename. Ignore for now. The deprecated packages (aws-sdk, coinbase-commerce-node) have no auto-replacement — log in Linear for manual migration.| Package type | Decision |
|---|---|
| GitHub Actions / CircleCI orbs | ✅ Approve — infrastructure tooling, low risk. |
| Dev tooling (eslint, typescript, jest, prettier) | ✅ Approve if changelog shows no config format change. |
| Runtime prod deps (express, aws-sdk, prisma…) | ⚠️ Create a Linear ticket in "Dependency Hygiene" project for team review. Don't approve here. |
Any package with security label | ✅ Fast-track approve regardless of major/minor. |
| Node.js runtime version bump | ⚠️ Coordinate with team — needs infra + app changes together. |
major-bump label. CI runs. If CI passes, the PR sits open for a human to merge — majors are never auto-merged. If CI fails, add a comment and assign to the relevant dev.
Reply to the Monday Slack message thread with a brief summary:
Then click ⏭️ Hand off in the original message to rotate to the next warden. The bot will confirm the next warden in the thread.
| Situation | What to do |
|---|---|
| Can't make it Monday | Click 🙋 Take ownership in Slack before 08:45 to transfer duty, or ⛔ Skip — next Monday's warden picks up the backlog. |
| Dashboard link shows "—" | Renovate hasn't scanned that repo yet. Trigger a run from the Mend admin panel ↗. |
| "renovate.json deprecated" warning in issue | Will clear automatically after Renovate's next run. Safe to ignore. |
| aws-sdk / coinbase-commerce-node "unavailable" replacement | No auto-fix exists. Log a Linear ticket for manual migration. These won't produce PRs. |
| Major PR fails CI after you approve it | Add a comment on the PR with the failure reason and assign to the relevant dev. Don't close the PR. |
| @zengamingx/* package lookup failure | Internal packages are excluded from Renovate. Safe to ignore — these are managed manually. |