From 8defae8d3d96442f0c7b01b717fdbb1a87504ade Mon Sep 17 00:00:00 2001 From: flint Date: Sat, 17 Oct 2026 18:48:32 -0700 Subject: [PATCH 1/3] fix(renovate): align Renovate proposals with the reviewer gates; allow checkout v4.4.0 --- .../fixed-reviewer-renovate-rules.md | 1 + .github/renovate.json | 39 +++++++++++++++++++ packages/cli/test/reviewer/ci-job.test.ts | 9 +++++ scripts/reviewer/ci-job.mjs | 1 + 4 files changed, 50 insertions(+) create mode 100644 .changelog/unreleased/fixed-reviewer-renovate-rules.md diff --git a/.changelog/unreleased/fixed-reviewer-renovate-rules.md b/.changelog/unreleased/fixed-reviewer-renovate-rules.md new file mode 100644 index 00000000..b3645e05 --- /dev/null +++ b/.changelog/unreleased/fixed-reviewer-renovate-rules.md @@ -0,0 +1 @@ +- **Renovate proposals now match what the reviewer gates accept.** Renovate no longer proposes `engines`, peer-dependency, OpenClaw, or bun/node runtime-version changes (those move together with the reviewer runtime matrix), and keeps version ranges for the runtime dependencies of the published packages. The reviewer action allowlist accepts actions/checkout v4.4.0 at its release commit. diff --git a/.github/renovate.json b/.github/renovate.json index 6dc147d1..a184dd65 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -10,6 +10,45 @@ "@tpsdev-ai/**" ], "enabled": false + }, + { + "matchDepTypes": [ + "engines" + ], + "enabled": false + }, + { + "matchDepTypes": [ + "peerDependencies" + ], + "enabled": false + }, + { + "matchManagers": [ + "npm", + "bun", + "github-actions" + ], + "matchPackageNames": [ + "bun", + "node" + ], + "enabled": false + }, + { + "matchPackageNames": [ + "openclaw" + ], + "enabled": false + }, + { + "matchFileNames": [ + "packages/**/package.json" + ], + "matchDepTypes": [ + "dependencies" + ], + "rangeStrategy": "widen" } ] } diff --git a/packages/cli/test/reviewer/ci-job.test.ts b/packages/cli/test/reviewer/ci-job.test.ts index c29e278a..32d96915 100644 --- a/packages/cli/test/reviewer/ci-job.test.ts +++ b/packages/cli/test/reviewer/ci-job.test.ts @@ -184,6 +184,15 @@ describe("the reviewed allowlist of skipped-action refs", () => { } }); + test("the checkout allowlist accepts v4.4.0 at its release commit", () => { + const sha = "11d5960a326750d5838078e36cf38b85af677262"; + expect(SKIPPED_ACTIONS["actions/checkout"].refs[sha]).toBe("v4.4.0"); + const uses = `actions/checkout@${sha}`; + const t = jobOf(plan(bare(` - uses: ${uses}\n with:\n persist-credentials: false\n fetch-depth: 0\n - run: a\n`))); + expect(t.skipped).toEqual([{ index: 1, uses, tag: "v4.4.0", reason: SKIPPED_ACTIONS["actions/checkout"].reason }]); + expect(refused(bare(` - uses: ${uses}\n with:\n path: elsewhere\n - run: a\n`)).kind).toBe("ci-unhonourable"); + }); + test("a tag, a branch, a short SHA or an unreviewed SHA refuses", () => { for (const ref of ["actions/checkout@v4", "actions/checkout@main", "actions/checkout@11bd719", "actions/checkout@arbitrary-ref", `actions/checkout@${"a".repeat(40)}`]) { const r = refused(bare(` - uses: ${ref}\n - run: a\n`)); diff --git a/scripts/reviewer/ci-job.mjs b/scripts/reviewer/ci-job.mjs index 5cb9291b..032171aa 100644 --- a/scripts/reviewer/ci-job.mjs +++ b/scripts/reviewer/ci-job.mjs @@ -240,6 +240,7 @@ export const SKIPPED_ACTIONS = { refs: { "11bd71901bbe5b1630ceea73d27597364c9af683": "v4.2.2", "34e114876b0b11c390a56381ad16ebd13914f8d5": "v4.3.1", + "11d5960a326750d5838078e36cf38b85af677262": "v4.4.0", }, reason: "the workspace is the host-created clone at the assigned head, checked before the job", // Accepted only as a job's first step; the launcher then requires the From d455a07db348c38f18b0bf9a13e405734c01e4f6 Mon Sep 17 00:00:00 2001 From: flint Date: Sat, 17 Oct 2026 19:24:47 -0700 Subject: [PATCH 2/3] docs(changelog): name the Renovate update categories this change skips --- .changelog/unreleased/fixed-reviewer-renovate-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changelog/unreleased/fixed-reviewer-renovate-rules.md b/.changelog/unreleased/fixed-reviewer-renovate-rules.md index b3645e05..02e515ad 100644 --- a/.changelog/unreleased/fixed-reviewer-renovate-rules.md +++ b/.changelog/unreleased/fixed-reviewer-renovate-rules.md @@ -1 +1 @@ -- **Renovate proposals now match what the reviewer gates accept.** Renovate no longer proposes `engines`, peer-dependency, OpenClaw, or bun/node runtime-version changes (those move together with the reviewer runtime matrix), and keeps version ranges for the runtime dependencies of the published packages. The reviewer action allowlist accepts actions/checkout v4.4.0 at its release commit. +- **Renovate no longer proposes several update categories that the reviewer gates refuse.** It skips `engines`, peer-dependency and OpenClaw updates, and bun and node runtime-version updates through the `npm`, `bun` and `github-actions` managers; Docker node image updates stay enabled. The `dependencies` of the published packages under `packages/` keep their ranges (`widen`). The reviewer action allowlist accepts actions/checkout v4.4.0 at its release commit. From 9a79e0fa696100c3f6fb69b1717795aa98a8e53f Mon Sep 17 00:00:00 2001 From: flint Date: Sat, 17 Oct 2026 20:02:57 -0700 Subject: [PATCH 3/3] fix(renovate): limit the Actions runtime exclusion to setup-action inputs --- .github/renovate.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/renovate.json b/.github/renovate.json index a184dd65..9e675408 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -26,9 +26,21 @@ { "matchManagers": [ "npm", + "bun" + ], + "matchPackageNames": [ "bun", + "node" + ], + "enabled": false + }, + { + "matchManagers": [ "github-actions" ], + "matchDepTypes": [ + "uses-with" + ], "matchPackageNames": [ "bun", "node"