From 3a6142c864388b9f9da011478927f0b75fe691c7 Mon Sep 17 00:00:00 2001 From: FZ2000 Date: Thu, 30 Jul 2026 23:25:44 -0700 Subject: [PATCH 1/2] fix: Renovate could not look up any of the CI-pinned tools MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate reported, on its first run against this repo: Failed to look up github-releases package ci-pinned-tools: no-result Files affected: .github/workflows/ci.yml My bug, and three separate ones behind that single message. 1. `depNameTemplate: "ci-pinned-tools"` was a name I invented. A datasource lookup needs a real package, so Renovate dutifully asked GitHub for a repository called `ci-pinned-tools` and got nothing. The depName is now CAPTURED from the URL — `gitleaks/gitleaks`, `trufflesecurity/trufflehog` — rather than templated to a constant. 2. `markdownlint-cli` arrives via `npx`, so it is an npm package. It was pointed at the github-releases datasource, which could never have resolved it whatever the name. 3. lychee tags its releases `lychee-vX.Y.Z`, not `vX.Y.Z`. A single matchString covering all three tarballs would have mis-parsed it, so it gets its own manager plus an `extractVersionTemplate` to recover the bare version from the tag. Net effect of the bug: all five pinned tools — gitleaks, trufflehog, lychee (twice) and markdownlint-cli — were unmanaged while the config looked like it was managing them. That is the same failure mode as the `fileMatch`/`matchPackagePatterns` options this file already had removed: configuration that reads as coverage and provides none. Verified by running each regex against the real ci.yml rather than reasoning about it: github-releases -> gitleaks/gitleaks 8.30.1 trufflesecurity/trufflehog 3.96.0 github-releases -> lycheeverse/lychee 0.24.2 npm -> markdownlint-cli 0.45.0 Also converted renovate.json -> renovate.json5. Renovate reads it natively, and the reasoning above is worth keeping next to the regexes — plain JSON has no comment syntax, and the `_comment` key workaround trips Renovate's unknown-option validation. Validated with a real JSON5 parser against Renovate's published schema, after the first hand-rolled comment-stripper I tried silently mangled an inline key. Added a "CI pinned tools" package rule so these arrive as one grouped PR rather than five. --- renovate.json | 46 ------------------------------- renovate.json5 | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+), 46 deletions(-) delete mode 100644 renovate.json create mode 100644 renovate.json5 diff --git a/renovate.json b/renovate.json deleted file mode 100644 index ad213e2..0000000 --- a/renovate.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:recommended", "helpers:pinGitHubActionDigests"], - "schedule": ["before 6am on Monday"], - "labels": ["dependencies"], - "commitMessagePrefix": "chore(deps)", - "commitMessageTopic": "{{depName}}", - "prConcurrentLimit": 5, - "prHourlyLimit": 2, - "rangeStrategy": "bump", - "configMigration": true, - "pre-commit": { - "enabled": true - }, - "customManagers": [ - { - "customType": "regex", - "managerFilePatterns": ["/^\\.github/workflows/[^/]+\\.ya?ml$/"], - "matchStrings": [ - "gitleaks/gitleaks/releases/download/v(?[0-9.]+)/", - "trufflesecurity/trufflehog/releases/download/v(?[0-9.]+)/", - "lycheeverse/lychee/releases/download/lychee-v(?[0-9.]+)/", - "markdownlint-cli@(?[0-9.]+)" - ], - "depNameTemplate": "ci-pinned-tools", - "datasourceTemplate": "github-releases", - "versioningTemplate": "semver" - } - ], - "packageRules": [ - { - "groupName": "python dev tooling", - "matchManagers": ["pep621"], - "matchPackageNames": ["/^(ruff|mypy|pytest|pytest-cov)$/"] - }, - { - "groupName": "CI actions", - "matchManagers": ["github-actions"], - "matchPackageNames": ["/^actions\\//"] - }, - { - "groupName": "pre-commit hooks", - "matchManagers": ["pre-commit"] - } - ] -} diff --git a/renovate.json5 b/renovate.json5 new file mode 100644 index 0000000..a275fbf --- /dev/null +++ b/renovate.json5 @@ -0,0 +1,75 @@ +{ + // JSON5 rather than JSON so this file can explain itself. Renovate reads + // renovate.json5 natively; plain JSON has no comment syntax, and the + // `_comment` key workaround trips Renovate's unknown-option validation. + $schema: "https://docs.renovatebot.com/renovate-schema.json", + + extends: ["config:recommended", "helpers:pinGitHubActionDigests"], + schedule: ["before 6am on Monday"], + labels: ["dependencies"], + commitMessagePrefix: "chore(deps)", + commitMessageTopic: "{{depName}}", + prConcurrentLimit: 5, + prHourlyLimit: 2, + rangeStrategy: "bump", + configMigration: true, + + // Off by default, so the five hook revs in .pre-commit-config.yaml would + // never be bumped without this. + "pre-commit": { enabled: true }, + + customManagers: [ + { + // CI curl-downloads three tools from GitHub releases and runs one via + // npx. None is visible to a built-in manager, so without these they + // stay pinned forever. + // + // depName is CAPTURED from the URL, never templated to a literal. An + // earlier version of this file set depNameTemplate to the invented + // name "ci-pinned-tools", and Renovate reported exactly that: + // Failed to look up github-releases package ci-pinned-tools: no-result + // A datasource lookup needs a real package name. + customType: "regex", + managerFilePatterns: ["/^\\.github/workflows/[^/]+\\.ya?ml$/"], + matchStrings: [ + "https://github\\.com/(?[^/\"]+/[^/\"]+)/releases/download/v(?[0-9]+\\.[0-9]+\\.[0-9]+)/", + ], + datasourceTemplate: "github-releases", + versioningTemplate: "semver", + }, + { + // lychee tags its releases `lychee-vX.Y.Z`, not `vX.Y.Z`, so it needs + // its own matchString and an extractVersion to recover the bare + // version from the tag name. + customType: "regex", + managerFilePatterns: ["/^\\.github/workflows/[^/]+\\.ya?ml$/"], + matchStrings: [ + "https://github\\.com/(?lycheeverse/lychee)/releases/download/lychee-v(?[0-9]+\\.[0-9]+\\.[0-9]+)/", + ], + datasourceTemplate: "github-releases", + extractVersionTemplate: "^lychee-v(?.+)$", + versioningTemplate: "semver", + }, + { + // markdownlint-cli arrives via npx, so it is an npm package. The + // previous config asked the github-releases datasource for it, which + // could never have resolved. + customType: "regex", + managerFilePatterns: ["/^\\.github/workflows/[^/]+\\.ya?ml$/"], + matchStrings: ["(?markdownlint-cli)@(?[0-9]+\\.[0-9]+\\.[0-9]+)"], + datasourceTemplate: "npm", + versioningTemplate: "semver", + }, + ], + + packageRules: [ + { + groupName: "python dev tooling", + matchManagers: ["pep621"], + matchPackageNames: ["/^(ruff|mypy|pytest|pytest-cov)$/"], + }, + { groupName: "CI actions", matchManagers: ["github-actions"], matchPackageNames: ["actions/**"] }, + { groupName: "pre-commit hooks", matchManagers: ["pre-commit"] }, + { groupName: "CI pinned tools", matchManagers: ["custom.regex"] }, + ], +} From bcbb6275043712323c41573d8fb9a0e11924e9f8 Mon Sep 17 00:00:00 2001 From: FZ2000 Date: Thu, 30 Jul 2026 23:26:13 -0700 Subject: [PATCH 2/2] fix: two references to renovate.json survived the rename to .json5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit .gitattributes export-ignore and .github/CODEOWNERS both still named the old file. The CODEOWNERS one matters more than it looks: GitHub silently ignores a pattern that matches nothing, so the entry would have read as review protection on the Renovate config while providing none. Caught by tools/check_discoverability.py, which asserts every CODEOWNERS pattern matches something — a check added earlier for exactly this, after two other entries had rotted the same way. It reported: FAIL every CODEOWNERS pattern matches something — dead: ['renovate.json'] so the discoverability job on this PR would have failed had I pushed it. --- .gitattributes | 2 +- .github/CODEOWNERS | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitattributes b/.gitattributes index 231f6ea..76532e4 100644 --- a/.gitattributes +++ b/.gitattributes @@ -47,7 +47,7 @@ Makefile text eol=lf .git-blame-ignore-revs export-ignore .editorconfig export-ignore Makefile export-ignore -renovate.json export-ignore +renovate.json5 export-ignore tests/ export-ignore examples/ export-ignore tools/ export-ignore diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index bf10f0c..13d38bd 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -19,5 +19,5 @@ install.sh @FZ2000 install_schedule.sh @FZ2000 pyproject.toml @FZ2000 .github/ @FZ2000 -renovate.json @FZ2000 +renovate.json5 @FZ2000 .gitignore @FZ2000