Repository navigation
Extend Renovate coverage to workflow tool pins and the lockfile - #67
Merged
Merged
Conversation
Renovate only tracked direct dependencies, so tool versions pinned in workflow env vars and transitive packages in uv.lock went stale. - Annotate uv, actionlint, and markdownlint pins in the workflows so the customManagers:githubActionsVersions preset can update them - Enable daily lock file maintenance to refresh transitive packages - Enable OSV vulnerability alerts for locked packages Amp-Thread-ID: https://ampcode.com/threads/T-01a1ca38-20a5-7436-a7ae-1f2bce712489 Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renovate only tracked direct dependencies here, so tool versions pinned in workflow env vars and transitive packages in
uv.lockwent stale without a PR.What changes
# renovate:comments above theUV_VERSION,ACTIONLINT_VERSION, andMARKDOWNLINT_CLI2_VERSIONpins, read by thecustomManagers:githubActionsVersionspreset.lockFileMaintenanceon a daily schedule (before 4am UTC): one PR that refreshes every transitive package inuv.lock.osvVulnerabilityAlerts: security PRs for locked packages with an OSV advisory. Renovate marks this feature experimental.PYTHON_VERSIONis left alone on purpose: it is the minimum supported Python, not a tool pin.What to expect after merge
uv0.11.7 to 0.13.4 (three OSV advisories against 0.11.7).markdownlint-cli20.22.1 to 0.24.0.uv lock --upgrade --dry-runshows 9 packages behind today.Testing
Ran
renovate --platform=local --dry-run=lookup(Renovate 44.222.5) on this branch, withlocal>swapped forgithub>so the shared preset resolves outside the hosted app:actionlintresolved to its current release 1.7.12, so theextractVersionrule strips thevprefix correctly.actionlintis clean.The local dry run does not build branches, so the lock file maintenance PR and the schedule are first exercised by the hosted Renovate app.