feat(renovate): dogfood the shipped renovate config on the maintainer repo - #15
Merged
Conversation
… repo Closes gap #6 of the 2026-07-01 dogfooding audit. The config is the scoped design from the dependency-inventory spec (amended 2026-08-04): config:recommended + pinGitHubActionDigests, weekly lockFileMaintenance (the only source of in-range uv.lock refreshes, since every dev dep is a capped range), the pre-commit manager off (its rev SHA must move with the template copy, which no manager sees), and astral-sh/uv disabled via matchPackageNames so both the mise and setup-uv sites stay manual. The file is inert until the Mend Renovate app is installed on the repository; that is an operator step after merge.
Renovate re-derives only the maintainer's mise.toml gitleaks pin; the template's mise.toml.jinja and the AGENTS.md prose literal are invisible to it. Assert all three agree so a Renovate gitleaks PR stays red until the template and prose are bumped on the same branch.
Add a Renovate section (scope, the operator install step, how a gitleaks bump PR interacts with the policy gate, and the divergences from the template's renovate.json). Retire the "the maintainer has no Renovate" sentences and name the new parity assertion in the policy-gate scope.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The template ships a Renovate layer that the maintainer repo never carried, so its own uv/mise/Actions pins drifted with nothing to surface it. This lands the scoped
renovate.jsonfrom the amended dependency-inventory spec and closes Phase 1 of the 2026-07-01 dogfooding audit.Changes
renovate.json, verbatim fromdocs/superpowers/specs/2026-06-25-dependency-inventory-design.md: weeklylockFileMaintenance(the only source of in-rangeuv.lockrefreshes, since every dev dep is a capped range), thepre-commitmanager off, andastral-sh/uvdisabled viamatchPackageNamesso both its mise and setup-uv sites stay manual.test_gitleaks_pin_matches_template: themise.tomlgitleaks pin must equal the template'smise.toml.jinjacopy and the AGENTS.md literal. Renovate can only see the first, so a gitleaks bump PR stays red until the template and prose follow on the same branch.Testing
just fmt-check lint typecheck policy— all pass; policy suite 6 passed (was 5).python3 -m json.tool renovate.json— valid JSON. Renovate's own config validation is not yet run: it happens on the app's first run after install.just test) not run locally; CI'stestjob covers it.Notes for reviewers
customManagerfor theuvxrun-step pins. The only maintainer uvx pins are parity-locked to the rendered template by the generation suite, so a one-sided bump would failjust test.Related
docs/superpowers/specs/2026-06-25-dependency-inventory-design.md(amended in docs(specs): correct the renovate design after adversarial review #11).docs/superpowers/plans/2026-07-01-dogfood-gap-audit.md, gap 6.