Renovate: AI Reviews Pull Requests, Auto-Merge Enabled

The workflow reflects a practical response to a common pain point: while tools like Dependabot and Renovate already automate creating update pull requests, the review step remains manual. Reading release notes to check for breaking changes, deprecated APIs, and type or config impacts can eat minutes per PR, and those minutes add up as the queue grows. The author splits updates by type: patches continue to auto-merge after CI passes, minor updates go through AI review with possible auto-merge, and major updates are reviewed but left for a person to merge. Packages like Rails that can include de facto breaking changes in minor releases are handled the same as major updates. To keep AI use efficient, the workflow computes a SHA-256 fingerprint from only the added and removed lines of the diff. If a rebase leaves the change content the same, the previous verdict is reused rather than triggering a fresh review. The design also separates the AI review job from write permissions, so even if malicious instructions are hidden in release notes or node_modules, the agent cannot post comments or commit. The prompt explicitly warns against following instructions found in those files, a defense against prompt injection. Auto-merge is off by default, letting teams compare AI verdicts with their own judgment before enabling it.