PR comment commands

[rarkins]

What would you like Renovate to be able to do?

Allow authorized users to control certain functionality using PR comments

If you have any ideas on how this should be implemented, please tell us here.

There exists some prior art:

• https://docs.github.com/en/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands
• https://socket.dev/blog/introducing-bot-commands

And plenty of prior requests, of which #1355 is the only one I could find open.

While neither of those services explicitly mentions it, one would hope that the command must be by a maintainer and not just any random person with access to the repo (which would mean any GitHub user for public repos).

Q1: How can we know which users are allowed to make such comments. Do we need extra permissions compared to today?

Q2: Which commands do we want to support?

Q3: What are the performance impacts of both of the above (e.g. fetching allowed users each run, fetching every PR comment)

[rarkins]

We could have a concept of 'auto' permissions which means:

• Allow only maintainers to enable destructive actions like merging
• For private repos:
  • Allow anyone with any access at all to do non-destructive actions
• For public repos:
  • Only allow users with collaborator access or higher to do non-destructive actions

We should avoid @renovate style comments and instead /renovate ones which can be supported everywhere, consistently, regardless of platform.

We could try to intelligently cache the list of collaborators, e.g. if we have a previous list of collaborators cached, and the user requesting the action is on that list, and the action is non-destructive, then we simply let it happen without refreshing the list.

Mend's hosted apps could potentially add a 👀 emoji response when a command is received, so the user knows that a job is about to run, and then a 👍 or 🚀 once it's done.

[AArnott]

Q2: Which commands do we want to support?

1. Stop updating this or that, or maybe restrict the update to a particular version range, etc. This may prune a subset of the PR, as the PR may have updated multiple things.
   Renovatebot then responds by updating the PR to not only accommodate the request, but to add a change to renovate.json to encode my request so that it sticks.

I then review the updated PR and learn more about renovate.json syntax by looking at the bot's own change. The PR may or may not still have an actual version update. I complete the PR which now conforms to my requirements.

This would mean I no longer have to push many commits to my default branch to change renovate.json manually until I see that it has the intended effect on the original version updating PR, because I have confidence that the bot-generated change to renovate.json does what I asked, as I can see its effect applied to the PR itself.

Bonus points: if renovate implements this using AI, it can advertise itself as an AI-powered bot.