fix(renovate): align Renovate proposals with the reviewer gates; allow checkout v4.4.0

.changelog/unreleased/fixed-reviewer-renovate-rules.md

@@ -0,0 +1 @@
+- **Renovate no longer proposes several update categories that the reviewer gates refuse.** It skips `engines`, peer-dependency and OpenClaw updates, and bun and node runtime-version updates through the `npm`, `bun` and `github-actions` managers; Docker node image updates stay enabled. The `dependencies` of the published packages under `packages/` keep their ranges (`widen`). The reviewer action allowlist accepts actions/checkout v4.4.0 at its release commit.

.github/renovate.json

@@ -10,6 +10,57 @@
         "@tpsdev-ai/**"
       ],
       "enabled": false
+    },
+    {
+      "matchDepTypes": [
+        "engines"
+      ],
+      "enabled": false
+    },
+    {
+      "matchDepTypes": [
+        "peerDependencies"
+      ],
+      "enabled": false
+    },
+    {
+      "matchManagers": [
+        "npm",
+        "bun"
+      ],
+      "matchPackageNames": [
+        "bun",
+        "node"
+      ],
+      "enabled": false
+    },
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchDepTypes": [
+        "uses-with"
+      ],
+      "matchPackageNames": [
+        "bun",
+        "node"
+      ],
+      "enabled": false
+    },
+    {
+      "matchPackageNames": [
+        "openclaw"
+      ],
+      "enabled": false
+    },
+    {
+      "matchFileNames": [
+        "packages/**/package.json"
+      ],
+      "matchDepTypes": [
+        "dependencies"
+      ],
+      "rangeStrategy": "widen"
     }
   ]
 }

packages/cli/test/reviewer/ci-job.test.ts

@@ -184,6 +184,15 @@ describe("the reviewed allowlist of skipped-action refs", () => {
     }
   });
 
+  test("the checkout allowlist accepts v4.4.0 at its release commit", () => {
+    const sha = "11d5960a326750d5838078e36cf38b85af677262";
+    expect(SKIPPED_ACTIONS["actions/checkout"].refs[sha]).toBe("v4.4.0");
+    const uses = `actions/checkout@${sha}`;
+    const t = jobOf(plan(bare(`      - uses: ${uses}\n        with:\n          persist-credentials: false\n          fetch-depth: 0\n      - run: a\n`)));
+    expect(t.skipped).toEqual([{ index: 1, uses, tag: "v4.4.0", reason: SKIPPED_ACTIONS["actions/checkout"].reason }]);
+    expect(refused(bare(`      - uses: ${uses}\n        with:\n          path: elsewhere\n      - run: a\n`)).kind).toBe("ci-unhonourable");
+  });
+
   test("a tag, a branch, a short SHA or an unreviewed SHA refuses", () => {
     for (const ref of ["actions/checkout@v4", "actions/checkout@main", "actions/checkout@11bd719", "actions/checkout@arbitrary-ref", `actions/checkout@${"a".repeat(40)}`]) {
       const r = refused(bare(`      - uses: ${ref}\n      - run: a\n`));

scripts/reviewer/ci-job.mjs

@@ -240,6 +240,7 @@ export const SKIPPED_ACTIONS = {
     refs: {
       "11bd71901bbe5b1630ceea73d27597364c9af683": "v4.2.2",
       "34e114876b0b11c390a56381ad16ebd13914f8d5": "v4.3.1",
+      "11d5960a326750d5838078e36cf38b85af677262": "v4.4.0",
     },
     reason: "the workspace is the host-created clone at the assigned head, checked before the job",
     // Accepted only as a job's first step; the launcher then requires the