You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(renovate): let the Node floor pull request finish itself - #187
After this, Renovate's monthly "raise the minimum Node" pull request needs nobody.
Today each one needs someone to re-run a red check once a late installer catches up, add a changelog line, merge it, and then update the website by hand. After this:
Renovate merges it once every required check passes. The checks that make a floor safe already exist and are required: Verify refuses a floor any package feed can't serve, and Packaging waits on the test lanes that run on the declared floor.
A daily job re-runs whatever failed on that pull request. When winget or another feed catches up, nothing on the pull request changes, so without this the red Verify check would never run again. GitHub only re-runs a run within 30 days of its start, so once it refuses, the job ticks the rebase box in Renovate's pull request instead. Renovate rebuilds the branch, and every check starts over.
No changelog line. A floor raise inside the same major is a non-major update, which AGENTS.md already leaves out of the changelog.
The website follows by itself. Its new Follow LoopTroop main workflow copies the new minimum into the docs within a day and publishes them. That change went straight to the website's main in looptroop-ai/LoopTroop-Website@9ad211d. A manual run already passed there: it verified the docs against this repository's main and published nothing, because no page needed to change.
A bug this also fixes
Renovate treats a commit from anyone else as a hand edit, and from then on stops rebasing the pull request and stops moving it to newer releases. Our floor workflow and notices workflow both commit to Renovate's branches. So every floor pull request would have frozen after its first commit, and with required up-to-date checks it could never merge itself. #184 needed a manual rebase for the same reason. gitIgnoredAuthors now names the account those workflows commit as, and a test ties the two together.
Changes
.github/renovate.json: the floor rule automerges, its pull request text says nothing needs doing, and gitIgnoredAuthors is added.
.github/workflows/renovate-node-floor.yml: runs daily and on demand, with a new recheck job. It checks out nothing, reads no secret, and holds only actions: write, contents: read and pull-requests: write (to tick that one box). It only acts on Renovate's own same-repository pull request.
.github/CONTRIBUTING.md, CHANGELOG.md: describe the automatic flow. The unreleased Changed entry no longer says a person merges it, and there's a Fixed entry for the Renovate stall.
.github/workflows/release.yml: a # shellcheck disable=SC2016 on an intentionally single-quoted node -e block, so actionlint is clean on every workflow. No behaviour change.
Checks
Full suite: 446 files, 6790 tests passed, 13 skipped. Lint, typecheck and verify:version pass.
renovate-config-validator (44.40.0) accepts the config. actionlint and shellcheck are clean.
I broke each new rule once (dropped gitIgnoredAuthors, turned automerge off, let recheck run on pull requests, gave it a secret, removed the fork filter, widened a permission). Each time one test failed.
I ran the recheck queries read-only against real merged Renovate pull requests to confirm the author filter matches app/renovate.
Review follow-up
Codex (P2), fixed in 21e55ec: re-runs expire after 30 days, so a feed that stayed behind that long would have stalled the loop. The rebase-box fallback above handles it. A new test runs the job's real script against a stand-in gh and covers every path.
macOS CI, fixed in 6c39bef: the new test failed on both macOS lanes. macOS ships bash 3.2, which keeps the quotes in ${body/"…"/"${ticked}"} as text, so the box would have been written as "- [x] …". The job runs on Ubuntu, where it worked, but the replacement is now unquoted and means the same on every bash. I ran the job's real script in the bash:3.2 and bash:5.2 images to confirm: the old code writes the quotes on 3.2 and the fixed code doesn't.
DeepSource, tidied in 66de29e: the non-null assertions are gone, the "${run}" check is a regex, and the test helper is below its complexity threshold.
Greptile rates the PR 5/5 and Gitar approved it with no issues. Amazon Q summarises the PR as a Node 20 to 24 upgrade, which it isn't, and raises no finding.
What's left open
The first real run comes with the next floor raise. Node 24.18.1 turns 90 days old around 2026-10-26.
The unreleased changelog entries that name 24.18.0 stay as written. If 0.6 ships after a floor raise, its notes will name the older minimum. Rewriting them automatically isn't safe, because the same section uses 24.18.0 in historical examples too.
What changed
- .github/renovate.json: the "node floor" rule now automerges, and its PR
text says nothing needs doing by hand. Its description records why that is
safe. Top-level gitIgnoredAuthors now names github-actions[bot]'s commit
email.
- .github/workflows/renovate-node-floor.yml: a daily schedule (07:17 UTC,
after Renovate's own 00:00-05:59 Bucharest window) plus workflow_dispatch,
and a new `recheck` job. It finds Renovate's open renovate/node-floor pull
request (same repository, author app/renovate) and re-runs every run on its
head that ended failure or timed_out. It checks nothing out, reads no
secret, and holds only actions: write, contents: read and
pull-requests: read.
- .github/CONTRIBUTING.md: the floor section describes the automatic flow.
There is no manual changelog or website step any more. The website's
Follow LoopTroop main workflow picks up a new floor within a day. A major is
still moved by hand.
- CHANGELOG.md [Unreleased]: the Changed entry no longer says "a person
merges it", and a Fixed entry covers the Renovate stall below.
Why
The owner asked for the monthly floor raise to need nobody. Three gaps stood
in the way:
1. A person had to merge the pull request, add a changelog line, and update
the website afterwards.
2. When a late package feed catches up, nothing on the pull request changes,
so nothing re-ran the required Verify check. It stayed red until someone
clicked re-run.
3. Renovate treats any commit by another author as a hand edit. After that it
stops rebasing the pull request and stops moving it to newer releases, as
its gitIgnoredAuthors documentation describes. The floor workflow commits
to every floor pull request, so without the ignore entry each one froze
after that first commit, and with strict up-to-date checks it could never
merge itself. Renovate notices pull requests had the same problem (#184
needed a manual rebase).
Key decisions
- Floor raises get no changelog line, like any other non-major update
(AGENTS.md). The Unreleased text about 24.18.0 is left as written; it mixes
the current floor with historical examples, so rewriting it automatically
would corrupt history.
- recheck re-runs any failed run on the head, not only Verify. A flaky lane
blocks an automerge just the same, and a genuinely failing check fails
again, so nothing merges red.
- The committing workflows are derived in the test, as renovate-*.yml files
that set git's user.email. Each one's email must be in gitIgnoredAuthors,
so a changed commit identity cannot freeze these pull requests unnoticed.
Tests (tests/workflowPolicy.test.ts)
- Floor workflow jobs are regenerate, push and recheck.
- recheck's trigger, exact permissions, no secret, no checkout, the fork and
author filter, and the rerun command.
- The writing jobs stay gated to the floor branch.
- gitIgnoredAuthors covers every committing Renovate workflow.
- The floor rule automerges.
Six deliberate breakages (drop the ignore entry, automerge off, run on pull
requests, hand it a secret, drop the fork filter, widen a permission) each
turned one test red.
Checked: renovate-config-validator 44.40.0 passes on .github/renovate.json;
actionlint and shellcheck are clean; the full suite passes (446 files, 6790
tests); lint and typecheck pass.
Side effects: every Renovate pull request the notices workflow commits to is
now rebased by Renovate again, instead of freezing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-quoted
actionlint's shellcheck pass reported SC2016 (expressions don't expand in
single quotes) for the `node -e '...'` block that checks release-assets
against the release manifest. The quotes are intended: the `${...}` inside is
JavaScript template syntax and must reach node unexpanded. Marked with the
same `# shellcheck disable=SC2016` comment the other workflows use for this
case, which leaves actionlint clean across every workflow. No behaviour
change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing
This PR makes Renovate's same-major Node floor updates autonomous by enabling safe automerge, adding a least-privilege daily recheck for failed checks, and ensuring commits made by repository workflows do not stop Renovate rebasing or advancing its PRs. Documentation and policy tests describe and enforce the workflow, while a release-script annotation resolves linting without behavioral changes.
Sequence diagram for autonomous Node floor updates
sequenceDiagram
participant Renovate
participant FloorWorkflow as NodeFloorWorkflow
participant Checks as RequiredChecks
participant Website as WebsiteWorkflow
Renovate->>Renovate: Create Node floor pull request
Renovate->>FloorWorkflow: Commit synchronized floor files
FloorWorkflow-->>Renovate: Commit as configured workflow account
Renovate->>Checks: Run Verify and Packaging
opt Failed check
FloorWorkflow->>Checks: gh run rerun --failed
end
Checks-->>Renovate: All required checks pass
Renovate->>Renovate: Automerge pull request
Website->>Website: Follow LoopTroop main
Website->>Website: Update and publish floor documentation
Loading
File-Level Changes
Change
Details
Files
Make the Node-floor Renovate pull request self-service from creation through merge.
Enable automerge for the Node-floor rule and document that no manual changelog work is required.
Add a daily/on-demand recheck job that locates only the open same-repository Renovate floor PR and reruns completed failed or timed-out workflow runs.
Keep recheck isolated from checkout and secrets with narrowly scoped permissions.
Add workflow-policy coverage for triggers, branch/fork/author filtering, permissions, and rerun behavior.
Clarify that prose referring to an old Node major may still require manual website review.
.github/CONTRIBUTING.md CHANGELOG.md
Make workflow linting pass without changing release behavior.
Suppress the intentional ShellCheck warning for the single-quoted Node evaluation block.
.github/workflows/release.yml
Tips and commands
Interacting with Sourcery
Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment @sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment @sourcery-ai review to trigger a new review!
Navigate logical layers of code changes, visualize relationships, and explore their blast radius.
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: eba0dbec-c04b-4009-90ff-592e05a041da
📥 Commits
Reviewing files that changed from the base of the PR and between 21e55ec and 66de29e.
📒 Files selected for processing (2)
.github/workflows/renovate-node-floor.yml
tests/workflowPolicy.test.ts
Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.
📝 Walkthrough
Walkthrough
The Node-floor workflow re-runs failed checks on open Renovate pull requests and requests a rebase when a re-run is refused. Renovate auto-merges the floor update when required checks pass. Configuration, contributor guidance, changelog entries, and tests describe or verify the process.
Changes
Node-floor update process
Layer / File(s)
Summary
Scheduled rechecks and retry behavior .github/workflows/renovate-node-floor.yml, tests/workflowPolicy.test.ts, .github/workflows/release.yml
The workflow re-runs failed checks on open Node-floor pull requests and ticks the rebase checkbox when a re-run is refused. Tests cover workflow triggers, permissions, and recheck behavior. The release asset script gains a ShellCheck suppression comment.
Renovate merge and author policy .github/renovate.json, .github/CONTRIBUTING.md, CHANGELOG.md, tests/workflowPolicy.test.ts
Renovate ignores the workflow commit author and auto-merges the Node-floor pull request when required checks pass. Contributor guidance and changelog entries describe the update process. Tests verify the author configuration and auto-merge setting.
sequenceDiagram
participant Scheduler
participant RecheckJob
participant GitHubCLI
Scheduler->>RecheckJob: Start scheduled or manual run
RecheckJob->>GitHubCLI: Find open Node-floor pull request and failed runs
GitHubCLI-->>RecheckJob: Return pull request and run IDs
RecheckJob->>GitHubCLI: Re-run failed jobs
GitHubCLI-->>RecheckJob: Report whether re-run was accepted
RecheckJob->>GitHubCLI: Tick the rebase checkbox if re-run is refused
Loading
Merge Risk:⚪ Minimal · up to 66de2
The Node-floor automation is mergeable after normal checks; no concrete remaining issue has been established.
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Title check
✅ Passed
The title clearly summarizes the main change: Renovate Node floor pull requests can complete without manual intervention.
Description check
✅ Passed
The description provides a detailed summary, rationale, impact, implementation changes, testing results, documentation updates, and follow-up context. It does not use the repository template headings …
✨ Finishing Touches📝 Generate docstrings
Commit to this branch
Create a new PR
🧪 Generate unit tests (beta)
Commit to this branch
Create a new PR
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer TIP This summary will be updated as you push new changes.
The reason will be displayed to describe this comment to others. Learn more.
This PR implements a coordinated Node.js version upgrade across the CI/CD pipeline. The changes upgrade the runtime from Node.js 20 to Node.js 24 for most jobs, and Node.js 26 for standalone binary builds. All corresponding test expectations have been updated to validate these changes.
The implementation maintains security best practices, includes proper validation, and follows existing patterns in the codebase. No blocking issues identified.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
We reviewed changes in d2a8493...66de29e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
The reason will be displayed to describe this comment to others. Learn more.
Unexpected template string expression
ECMAScript 6 allows programmers to create strings containing variable or expressions using template literals, instead of string concatenation, by writing expressions like ${variable} between two backtick quotes (). It is easy to use the wrong quotes when wanting to use template literals, by writing ${variable}, and ending up with the literal value ${variable}` instead of a string containing the value of the templated expressions.
The reason will be displayed to describe this comment to others. Learn more.
Forbidden non-null assertion
Using non-null assertions cancels out the benefits of strict null-checking, and introduces the possibility of runtime errors. Avoid non-null assertions unless absolutely necessary. If you still need to use one, write a skipcq comment to explain why it is safe.
The reason will be displayed to describe this comment to others. Learn more.
Forbidden non-null assertion
Using non-null assertions cancels out the benefits of strict null-checking, and introduces the possibility of runtime errors. Avoid non-null assertions unless absolutely necessary. If you still need to use one, write a skipcq comment to explain why it is safe.
The PR appears safe to merge; no actionable correctness, security, or repository-rule issue remains.
Summary
This PR makes Renovate’s Node-floor updates self-completing.
Enables automerge after required floor and packaging checks pass.
Adds a daily workflow that retries failed runs and requests a Renovate rebase when runs are too old to retry.
Allows Renovate to continue updating branches after trusted workflow commits.
Adds policy and script-level tests covering retry, rebase, permissions, author filtering, and automerge behavior.
Updates contributor guidance and changelog documentation to describe the automated process.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Renovate opens Node-floor PR] --> B[Floor synchronization workflow]
B --> C[Required verification and packaging checks]
C -->|All pass| D[Renovate automerges PR]
C -->|Failure or timeout| E[Daily recheck job]
E --> F{Run can still be retried?}
F -->|Yes| G[Re-run failed jobs]
G --> C
F -->|No| H[Tick Renovate rebase checkbox]
H --> I[Renovate rebuilds branch]
I --> C
The reason will be displayed to describe this comment to others. Learn more.
Start a fresh workflow run before reruns expire
If a package feed remains behind for more than 30 days after the PR's checks first run, this loop can no longer recover it: GitHub permits rerunning a workflow only within 30 days of its initial run, and rerun attempts do not create a fresh run with a new eligibility window. Every subsequent gh run rerun will therefore fail and be reduced to a warning, leaving the advertised self-finishing PR stuck indefinitely. Trigger a new run against the head SHA when the existing run is too old, rather than relying exclusively on reruns.
The two incremental commits since the previous review at 21e55ec8 are both bug fixes, not regressions:
6c39bef fixes the rebase-box replacement under bash 3.2 by unquoting ${ticked} in ${body/"${unticked}"/${ticked}}. Under bash 3.2 (macOS) the quoted replacement "${ticked}" kept the double quotes as literal text, so the ticked box would ship as "- [x] <!-- rebase-check -->" — quotes included — and Renovate would not recognise it. Unquoting is safe: ticked contains no & for bash 5.2's patsub_replacement to expand, and the pattern "${unticked}" stays quoted so [] remain literal in both bash versions. Verified in bash:3.2 and bash:5.2 images.
66de29e resolves the remaining DeepSource findings from the previous review: the "Unexpected template string expression" note is addressed by matching "${run}" with a regex instead of a toContain string, and the "cyclomatic complexity of 6" note is resolved by extracting the readIfWritten helper and using object-spread defaults to drop the now-redundant ?? fallbacks.
Both commits fix what the previous review and external analyzers flagged; neither introduces new issues.
The incremental commit 21e55ec8 resolves the Codex P2 finding carried forward from the previous review: a package feed can stay behind longer than GitHub's 30-day re-run window, so when gh run rerun is refused the recheck job now ticks Renovate's rebase box instead of stalling forever. The logic is correct: GH_REPO is set via the step's env: block, the jq // empty guard handles the no-PR case, the refused flag accumulates any refusal across the loop, and the bash parameter substitution ${body/"${unticked}"/"${ticked}"} performs a literal replacement thanks to double-quoted operands. The pull-requests: write permission bump is justified by that single PATCH, and the new test reads the real script from the YAML and exercises every path (no PR, all-green, successful reruns, expired reruns with unticked/ticked/missing boxes). The two DeepSource non-null assertion findings on the changed test lines are fixed by the ?? '' guards in the same commit.
The automated Node floor flow is well-designed and secure. The new recheck job properly isolates itself from untrusted code: it only runs on scheduled/dispatch events (not pull requests), filters to non-fork PRs from app/renovate, uses only github.token with no secrets, checks out nothing, and has least-privilege permissions (actions: write, contents: read, pull-requests: read). The automerge: true on the node-floor rule is safe — it is guarded by the required Verify check (package feed availability), a 90-day minimum release age, and minor/patch-only updates. The top-level gitIgnoredAuthors correctly matches the workflow commit identity and prevents Renovate from freezing when repository workflows commit to its branches.
…too old to re-run
GitHub re-runs a workflow run only within 30 days of its start (Codex review
on #187). A package feed that stays behind longer than that would have left
the daily recheck failing quietly for good. Each `gh run rerun` was refused,
turned into a warning, and the self-merging floor pull request stayed red with
nothing left to move it.
Now a refused re-run makes the job tick the rebase box in Renovate's own
pull request text (`- [ ] <!-- rebase-check -->`). Renovate then rebuilds the
branch, the floor workflow writes the floor in again, and every check starts a
fresh run with a fresh 30 days.
- A box already ticked is left alone; Renovate acts on it in its next window.
- Text with no box fails the job, so a change in Renovate's format is reported
instead of silently stalling.
- The body is edited through the REST API (`gh api --method PATCH`) rather
than `gh pr edit`, which has failed under GITHUB_TOKEN on some gh versions.
- The job's pull-requests permission goes from read to write for that one
edit. It still checks nothing out and reads no secret.
Tests: a new case runs the job's real script against a stand-in `gh` and
covers every path: no pull request, nothing failed, re-runs allowed,
re-runs refused with an unticked box (only the box changes), with a ticked
box (nothing is edited), and with no box (the job fails). Three deliberate
breakages (the old warn-only loop, a PATCH that replaces the whole body, a
missing box passing silently) each turn it red. The permission assertion
follows. Two non-null assertions in the new author test became `?? ''`
(DeepSource).
CONTRIBUTING and the unreleased CHANGELOG entry describe the fallback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
`execute` has a cyclomatic complexity of 6 with "medium" risk
A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.
The new recheck test failed on both macOS lanes of #187. The job substituted
the ticked box with a quoted replacement,
`${body/"${unticked}"/"${ticked}"}`. bash 4.3 and later remove those quotes,
but bash 3.2, which macOS ships, keeps them as text. So the PR body came out
as `"- [x] <!-- rebase-check -->"` with the quotes in it, and Renovate would
not have recognised the ticked box.
The job itself runs on ubuntu-latest (bash 5.2), where it worked, but the
same script should mean the same thing on every bash. The replacement is now
unquoted. That is literal in bash 3.2 and 5.2 alike, and it contains no `&`
for bash 5.2's patsub_replacement to expand. A comment on the line says why.
Checked by running the job's real script, with the same stand-in gh as the
test, in the bash:3.2 and bash:5.2 images. Before the fix 3.2 wrote the
quotes; after it, both write exactly the ticked box.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The rerun assertion matches the shell text `"${run}"` with a regex instead
of a plain string holding `${`, which DeepSource reads as a template
literal written with the wrong quotes.
- The stand-in gh runner fills its defaults by spreading an object, and reads
its output files through a small helper, which takes `execute` below
DeepSource's complexity threshold. What it asserts does not change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🟡 Medium risk · Automates Node-floor pull request retries and merges after required checks pass
Automates Renovate's monthly Node floor pull requests to merge once required checks pass, with daily retries for failed checks and automatic website updates. Also fixes a bug where Renovate would freeze pull requests after commits from repository workflows. No issues found.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
![deepsource-io[bot]](https://avatars.githubusercontent.com/in/16372?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
What this does
After this, Renovate's monthly "raise the minimum Node" pull request needs nobody.
Today each one needs someone to re-run a red check once a late installer catches up, add a changelog line, merge it, and then update the website by hand. After this:
mainin looptroop-ai/LoopTroop-Website@9ad211d. A manual run already passed there: it verified the docs against this repository'smainand published nothing, because no page needed to change.A bug this also fixes
Renovate treats a commit from anyone else as a hand edit, and from then on stops rebasing the pull request and stops moving it to newer releases. Our floor workflow and notices workflow both commit to Renovate's branches. So every floor pull request would have frozen after its first commit, and with required up-to-date checks it could never merge itself. #184 needed a manual rebase for the same reason.
gitIgnoredAuthorsnow names the account those workflows commit as, and a test ties the two together.Changes
.github/renovate.json: the floor rule automerges, its pull request text says nothing needs doing, andgitIgnoredAuthorsis added..github/workflows/renovate-node-floor.yml: runs daily and on demand, with a newrecheckjob. It checks out nothing, reads no secret, and holds onlyactions: write,contents: readandpull-requests: write(to tick that one box). It only acts on Renovate's own same-repository pull request..github/CONTRIBUTING.md,CHANGELOG.md: describe the automatic flow. The unreleased Changed entry no longer says a person merges it, and there's a Fixed entry for the Renovate stall..github/workflows/release.yml: a# shellcheck disable=SC2016on an intentionally single-quotednode -eblock, so actionlint is clean on every workflow. No behaviour change.Checks
verify:versionpass.renovate-config-validator(44.40.0) accepts the config. actionlint and shellcheck are clean.gitIgnoredAuthors, turned automerge off, letrecheckrun on pull requests, gave it a secret, removed the fork filter, widened a permission). Each time one test failed.recheckqueries read-only against real merged Renovate pull requests to confirm the author filter matchesapp/renovate.Review follow-up
ghand covers every path.${body/"…"/"${ticked}"}as text, so the box would have been written as"- [x] …". The job runs on Ubuntu, where it worked, but the replacement is now unquoted and means the same on every bash. I ran the job's real script in thebash:3.2andbash:5.2images to confirm: the old code writes the quotes on 3.2 and the fixed code doesn't."${run}"check is a regex, and the test helper is below its complexity threshold.What's left open
🤖 Generated with Claude Code