Repository navigation
fix(ci): install renovate-check's Renovate from a lockfile with npm ci - #5
Merged
Merged
Conversation
make renovate-check ran `npx --package renovate@<version>`, which pins Renovate but resolves its ~600 transitive dependencies at run time, so every run installs whatever the registry published last. On 2026-10-26 the same command failed in magicdrive/ark (CI run 40393137410) with E404 for bowser 2.15.0, fetched under four minutes after it was published, before the registry served its tarball. Renovate 44.x also requires Node.js ^24.11.0, which this job did not pin. Renovate 44.149.0 and its whole dependency tree are now pinned by .github/renovate-check/package.json and package-lock.json (sha512 integrity for every package) and installed by run.sh with `npm ci --ignore-scripts --engine-strict`. CI sets up the Node.js of .github/renovate-check/.node-version (24.22.1) and caches npm tarballs keyed on the lockfile. Renovate updates the directory as one group (npm and nodenv managers) and refreshes the lockfile weekly (lockFileMaintenance); RENOVATE_VERSION leaves the Makefile. test_run.py (make renovate-check-test, run in CI) points npm at a fake registry and checks that the lockfile decides the version, that a version not in it is not installed, that a 404 or an integrity mismatch fails npm ci and run.sh, and that .node-version satisfies the engines of every locked package. Same change as magicdrive/ark#88. Claude-Session: https://claude.ai/code/session_01RbGbwRHvCEhsKLZfbvbbRg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
make renovate-check(CI: validate renovate.json) installed Renovate withnpx --yes --package renovate@$(RENOVATE_VERSION). The same command failed on magicdrive/ark main in run 40393137410:bowser 2.15.0 was published at 20:06:27Z, 3m49s earlier. This repository runs the identical command, so it is exposed to the same failure. Node.js:
node-version: lts/*(floating; it changes major when a new LTS line starts); Renovate 44.x requires^24.11.0.Root Cause
Classification: Dependency Instability.
npx --package renovate@Xpins Renovate only; its ~600 transitive dependencies are resolved from semver ranges on every run (@aws-sdk/coreasks forbowser ^2.11.0), so each run installs whatever was published last, including releases minutes old whose tarballs the registry does not serve yet. With--beforetwo times apart, the same command installs bowser 2.14.1 vs 2.15.0.CI is not meant to validate with the newest Renovate (the version was pinned in the Makefile and moved by Renovate); this keeps that design and pins the whole tree.
Solution
Same change as magicdrive/ark#88:
.github/renovate-check/package.json+package-lock.jsonpin renovate 44.149.0 and every transitive package (registry.npmjs.org URL and sha512 integrity each)..github/renovate-check/run.shinstalls them in a temp dir withnpm ci --ignore-scripts --engine-strict, checks the installed version, and runsrenovate-config-validator --strict renovate.json..github/renovate-check/.node-version(24.22.1) is the Node.js CI sets up (node-version-file), with the npm cache keyed on the lockfile.renovate.json: the directory is one group ("Renovate validator": npm manager + nodenv),lockFileMaintenancerefreshes the lockfile weekly;RENOVATE_VERSIONleaves the Makefile; run.sh joinsmake lint's shellcheck sources.Security Impact
Positive: every package is integrity-checked against the committed lockfile and no install scripts run.
re2(optional native module) is not built; the npx install did not have it either (RE2 not usablewarning in both).Compatibility
make renovate-checkkeeps its name and output; locally it needs Node.js satisfying Renovate's engines (24.11+), older fails withEBADENGINE.Tests
make renovate-check-test(.github/renovate-check/test_run.py, run in CI) against a fake registry on 127.0.0.1: the lockfile decides the version (a newer publish is not taken); a version not in the lockfile is not installed (EUSAGE, tarball never requested); a 404 failsnpm ciandrun.sh(E404, no "Config validated"); an integrity mismatch fails (EINTEGRITY);.node-versionsatisfies every locked package'sengines.node.Local (macOS, Node.js 24.22.1):
make renovate-check-> "Config validated successfully";make renovate-check-test8/8 OK; shellcheck andmake actionlintpass.CI
The job running
make renovate-checknow sets up Node.js from.node-versionand runs the test step first.Migration
None.
Risks
lockFileMaintenancePRs pull fresh transitive versions; a propagation 404 can still hit that PR's CI, not main.https://claude.ai/code/session_01RbGbwRHvCEhsKLZfbvbbRg