Skip to content

Onboard to the reusable renovate-analysis workflow (ai-workflows@v0.2.10) #257

Closed
#259
Closed
Onboard to the reusable renovate-analysis workflow (ai-workflows@v0.2.10)#257
#259

Description

@lenaxia
lenaxia
opened on Aug 15, 2026

Onboard to the reusable renovate-analysis workflow (ai-workflows@v0.2.10)

Context: lenaxia/ai-workflows now ships a reusable Renovate-PR analysis workflow (shipped in ai-workflows#33, tag v0.2.10). It:

  • Posts a ## Renovate PR Analysis comment on every open renovate[bot] PR (posted via gh pr comment --body-file, then verified via the issues API before moving on),
  • Auto-merges only PRs it recommends "Safe to merge" (gh pr merge --squash),
  • Runs on schedule + workflow_dispatch only — deliberately not pull_request, because the opencode action's assertPermissions() requires the event actor to be a repo collaborator, which renovate[bot] can never be (the run fails before the AI starts; this is the bug that hit k8s-mechanic/talos previously).

Reference implementation: k8s-mechanic#51 (thin caller + forked repo-specific prompt).

Steps

Current state: this repo is fully onboarded to ai-workflows' other reusable workflows (ai-comment / pr-review / issue-opened callers + a full .github/prompts/ set) but has no Renovate config and no renovate-analysis workflow. Dependency updates are currently unmanaged.

1. Enable Renovate — add renovate.json5 (org-standard config)

{
  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
  extends: [
    'config:recommended',
    ':disableRateLimiting',
    ':dependencyDashboard',
    ':semanticCommits',
  ],
  dependencyDashboard: true,
  dependencyDashboardTitle: 'Renovate Dashboard 🤖',
  suppressNotifications: ['prEditedNotification', 'prIgnoreNotification'],
  rebaseWhen: 'conflicted',
  packageRules: [
    {
      description: ['Auto merge GitHub Actions digest/patch/minor updates'],
      matchManagers: ['github-actions'],
      automerge: true,
      automergeType: 'branch',
      ignoreTests: true,
      matchUpdateTypes: ['digest', 'patch', 'minor'],
    },
    {
      description: ['Never auto-merge anomalyco/opencode updates'],
      matchPackageNames: ['anomalyco/opencode'],
      automerge: false,
    },
  ],
}

This mirrors renovate.json5 in ai-workflows/k8s-mechanic. Digest/patch/minor GitHub-Actions updates auto-merge onto the base branch; anything else opens a PR for the analysis workflow to review. The anomalyco/opencode exclusion is a no-op unless this repo pins the action directly, but keeps the rule uniform.

2. Add the caller workflow .github/workflows/renovate-analysis.yml

name: Renovate PR Analysis

on:
  schedule:
    # Every 2 hours — picks up newly-opened Renovate PRs and re-analyzes any
    # that have been updated since the last analysis comment.
    - cron: "0 */2 * * *"
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to analyze (leave empty for all open Renovate PRs)"
        required: false
        type: string

permissions:
  id-token: write
  contents: write
  issues: write
  pull-requests: write

jobs:
  analyze-prs:
    uses: lenaxia/ai-workflows/.github/workflows/renovate-analysis.yml@v0.2.10
    secrets: inherit
    with:
      project_name: containers
      pr_number: ${{ inputs.pr_number }}

3. Add the prompt .github/prompts/renovate-analysis.md (forked copy)

This repo's prompts are forked (not rendered), so add a repo-specific copy rather than relying on the generic template:

# in a checkout of lenaxia/ai-workflows:
go run ./scripts/ai-sync render --consumer containers --into /tmp/renovate-prompt
cp /tmp/renovate-prompt/renovate-analysis.md .github/prompts/renovate-analysis.md

Then edit it to add repo-specific context and auto-merge exclusions (reference: k8s-mechanic's fork) — e.g. core framework deps, LLM/AI SDKs, anything that must always stay "Needs manual review". Keep the read-only guardrails: scratch files under /tmp only, "DO NOT post any comment" when there are no open PRs, no branch creation (the checkout is persist-credentials: false).

4. ai-workflows consumer config (one line, tracked in the linked issue)

Add renovate-analysis.md to the forked: list in consumers/containers.yaml so propagate syncs never overwrite the fork with the generic template (same pattern as k8s-mechanic, ai-workflows#35). Tracked in ai-workflows#36 — coordinate so the fork lands before the next tag propagate.

5. Verify

  • Dispatch the workflow: Actions → Renovate PR Analysis → Run workflow.
  • Confirm a ## Renovate PR Analysis comment lands on each open renovate PR (it will be skipped if already fresh), and that no excluded dependency gets merged.
  • The 2h schedule takes over from there.

Notes

  • Secrets (OPENAI_API_KEY, OPENAI_API_BASE, OPENAI_MODEL) are already configured for the other AI workflows — no new secrets needed.
  • Pick auto-merge exclusions in the forked prompt that match this repo's risk profile (core framework deps, security-relevant packages). When in doubt, the prompt defaults to "Needs manual review" — conservative is correct.
  • Renovate onboarding will first open its own onboarding PR; merge it, then dependency PRs start flowing to the analysis workflow.

Activity

  1. github-actions commented on Aug 15, 2026

    @github-actions
    github-actionsBot
    on Aug 15, 2026 – with GitHub Actions

    Issue #257 — action taken

    PR opened: feat/issue-257-renovate-analysis-onboarding (steps 2 + 3 implemented; step 1 intentionally not executed — false premise, details below).

    Step 1 blocked: this repo already has an active Renovate config

    The issue states this repo has "no Renovate config". That is incorrect:

    • .renovaterc.json5 exists at the repo root (tracked, 199 lines), extending github>home-operations/renovate-config, with custom datasources (plex, qbittorrent, servarr), docker-bake.hcl regex custom managers, app automerge rules, and base-image allowedVersions constraints.
    • It is actively maintained by Renovate itself: commit 99385ab chore(config): migrate config .renovaterc.json5 (#76) is Renovate's config-migration PR.
    • Renovate is live today: gh pr list --author "renovate[bot]" --state open returns feat(deps): update dependency mcp (1.30.0 → 2.3.0) #255 (feat(deps): update dependency mcp (1.29.0 → 2.0.0)) and chore(github-action): update github-actions #249 (chore(github-action): update github-actions).

    Adding renovate.json5 as specified would not extend the config — Renovate refuses to run when multiple config files are present ("Multiple configuration files found": renovate.json5 + .renovaterc.json5), which would disable dependency management repo-wide. So I did not add it.

    Migrating .renovaterc.json5 to the org-standard preset is a real decision with trade-offs, not a mechanical swap: the current config automerges docker-bake.hcl app VERSION bumps (automergeType: 'pr', ignoreTests: true) and pins base images via allowedVersions (ubuntu 24.04, alpine 3.21/3.22, python 3.13-alpine3.21, cuda 13.0.x); the issue's org-standard config has neither. Maintainer decision needed: keep the existing config (analysis workflow works against it unchanged), or replace it with the org-standard preset in a separate change — in which case the base-image allowedVersions guards should be re-implemented or intentionally dropped.

    Step 2 done — .github/workflows/renovate-analysis.yml

    Matches the k8s-mechanic#51 reference caller: schedule (every 2h) + workflow_dispatch (optional pr_number), the four required permissions, uses: lenaxia/ai-workflows/.github/workflows/renovate-analysis.yml@v0.2.10, project_name: containers.

    Verified against the actual v0.2.10 workflow_call definition (fetched from the tag): project_name (required string) ✓, pr_number (optional string, default "") ✓. The ref tag exists. Note: this caller takes no version input and uses the tag ref (not the SHA-pinning used by this repo's older v0.2.0 callers) — that is the documented contract for this workflow ("the tag in the uses: ref IS the version"; propagate.yml bumps it on releases). YAML parse validated with yq.

    Step 3 done — .github/prompts/renovate-analysis.md (forked copy)

    Derived from templates/prompts/renovate-analysis.md at v0.2.10 (I could not run ai-sync render in this environment; the render for containers is deterministic — project_name/rules_doc substitution, no override blocks — so I applied it directly). Repo-specific edits:

    • Repo context: the four dependency flavors here (digest-pinned base images, docker-bake.hcl // renovate: VERSION annotations incl. custom datasources, pinned packages in Dockerfiles, GitHub Actions).
    • Impact analysis adapted: multi-arch platform availability, musl/glibc and Python-wheel ABI effects of base bumps, tests.yaml version assertions that a bump can break.
    • Auto-merge exclusions for this repo's risk profile: all major bumps; base image updates (digest or version); LLM/AI SDKs and AI-app deps (mcp, tabbyAPI, kicad-mcp, opengist-mcp — PR feat(deps): update dependency mcp (1.30.0 → 2.3.0) #255 falls here); app VERSION bumps for stateful apps (home-assistant, plex, qbittorrent, transmission, postgres-init, mysql-init); anything requiring Dockerfile/bake/tests changes.
    • Guardrails kept verbatim: skip-if-fresh check, "DO NOT post any comment" when no open PRs, /tmp-only scratch, no branch creation, post-and-verify loop, exact comment structure.

    Step 4 — external dependency (not actionable in this repo)

    consumers/containers.yaml in ai-workflows must list renovate-analysis.md under forked: (ai-workflows#36). Until that lands, the next propagate tag run would overwrite this fork with the generic template. The fork is committed here first, satisfying the ordering constraint mentioned in the issue.

    Step 5 — verification status

    No container images were modified, so task local-build-* was not run.

  2. github-actions commented on Aug 15, 2026

    @github-actions
    github-actionsBot
    on Aug 15, 2026 – with GitHub Actions

    Done. Issue comment posted: #257 (comment)

    Implemented (branch feat/issue-257-renovate-analysis-onboarding, commit cf39f43):

    • .github/workflows/renovate-analysis.yml — thin caller for lenaxia/ai-workflows/renovate-analysis.yml@v0.2.10, verified against the actual v0.2.10 workflow_call contract and YAML-parsed with yq
    • .github/prompts/renovate-analysis.md — forked prompt from the v0.2.10 template with containers-specific context (four dependency flavors, multi-arch/musl/tests.yaml impact checks) and exclusions (majors, base images, mcp/AI deps, stateful-app VERSION bumps); all read-only guardrails kept verbatim

    Skipped step 1 with evidence: the issue's "no Renovate config" premise is wrong — .renovaterc.json5 exists, is Renovate-maintained (99385ab, PR #76), and Renovate is live (open PRs #255, #249). Adding renovate.json5 would trigger Renovate's "multiple configuration files found" failure and disable dependency management. Migration to the org-standard preset (which drops the existing allowedVersions base-image guards and app automerge) is flagged in the comment as a maintainer decision.

    No apps/ changes, so container build/tests were not applicable. Step 4 (ai-workflows#36 forked: list) is external and must land before the next propagate tag, or it would overwrite this fork.

    github run

  3. github-actions commented on Aug 15, 2026

    @github-actions
    github-actionsBot
    on Aug 15, 2026 – with GitHub Actions

    AI Assistant Commands

    The following commands are available on this issue/PR thread. Reply with one to trigger the assistant — any text after a command tunes the request (e.g. /review focus on the handler registration).

    Command Description
    /ai [text] Re-assess this issue/PR in full, or address a specific request (context-dependent).
    /review [text] Explicit code review of the current PR. Append text to focus on specific areas.
    /fix <description> Fix a bug: creates a branch, writes TDD regression tests, opens a PR, iterates through review until approved, then merges.
    /implement <description> Implement a feature/story: TDD, opens a PR, iterates through review until approved, then merges.
    /test <target> Write or improve tests for the specified code: TDD, opens a PR, iterates through review until approved.
    /analyze [text] Deep read-only analysis. Posts findings as a comment. No code changes.
    /explain <topic> Explain code, architecture, or data flow. Posts explanation as a comment. No code changes.
    /security [text] Security-focused review (credentials, packet handling, input validation, concurrency).
    /triage [text] Triage this issue — categorize, prioritize, assess impact, suggest labels.
    /design [text] Iterate on a design doc under docs/ before implementing/fixing. Opens a PR, iterates through review, then holds (never auto-merges).
    /merge Explicitly merge an approved PR (squash). Use after /design or a --no-merge run.
    /help Show the full command reference.

    All commands are available to repository owners, members, and collaborators. Code-change commands (/fix, /implement, /test, /security) auto-merge after approval by default — append --no-merge to hold for an explicit /merge. /design always holds. None of these ever commit to main directly.

  4. lenaxia
    closed this as completedin #259on Aug 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions