Repository navigation
ci: track the Bun catalog in Renovate and refresh lockfiles on Renovate branches - #442
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Catalog dependency detection renovate.json |
Renovate reads dependency names and versions from the root Bun catalog. It ignores the specified GitHub Actions bot author and disables updates for react and react-native from the regex manager. |
Renovate branch lockfile refresh .github/workflows/renovate-lockfiles.yml |
On Renovate branch pushes, the workflow regenerates bun.lock and tracked npm-shrinkwrap.json files. If they change, it commits and pushes them, then dispatches CI. If they do not change, it exits without committing or dispatching. |
CI dispatch and change detection .github/workflows/ci.yml |
CI supports manual dispatch. Its base SHA falls back to origin/main when pull-request and push base SHAs are unavailable. It uses direct diff mode only for push events. |
Estimated code review effort: 3 (Moderate) | ~25 minutes
Change: Other · Severity of issue fixed: Medium
Sequence Diagram(s)
sequenceDiagram
participant Renovate
participant LockfileWorkflow as "renovate-lockfiles.yml"
participant Repository
participant CIWorkflow as "ci.yml"
Renovate->>LockfileWorkflow: Push to renovate/** branch
LockfileWorkflow->>LockfileWorkflow: Regenerate lockfiles
alt Lockfiles changed
LockfileWorkflow->>Repository: Commit and push lockfile changes
LockfileWorkflow->>CIWorkflow: Dispatch CI for the branch
else No lockfile changes
LockfileWorkflow-->>LockfileWorkflow: Exit without commit or dispatch
end
Possibly related issues
- omercnet/paseo-plugins#1 — The changes add Renovate detection for root Bun catalog entries and automate lockfile refreshes.
Possibly related PRs
- omercnet/paseo-plugins#409 — Updates the root Bun catalog and regenerates Bun and npm lockfiles.
- omercnet/paseo-plugins#429 — Updates the root Paseo catalog and related lockfiles.
- omercnet/paseo-plugins#434 — Updates a dependency through Renovate; this PR adds lockfile refresh and CI dispatch for Renovate branches.
Merge Risk: 
388ff
-
Renovate dependency PRs retain a CI signal, including after automated lockfile updates. No identified issue prevents merging after normal checks.
Security architecture risk: 
388ff
-
The new automation has repository write access, but dependency installation scripts are disabled and CI remains read-only. A failure after publishing lockfiles can leave the updated branch without its intended CI run, and rerunning the original job is not a reliable recovery path. No validation bypass was established; actual merge protection could not be verified.
Retained concerns
- Low · reliability · inferred: Lockfile publication and CI scheduling are separate, non-resumable operations. Cancellation or dispatch failure after a successful push can leave the new dependency head without its intended validation. Rerunning the original event does not reliably reconcile that head. Enforced required checks would block the update rather than permit an unvalidated merge; actual enforcement is unavailable.
Security review details
-
Security Blast Radius
- inferred — The new authority reaches repository contents and Actions operations in the triggering repository. The renovate/** filter limits invocation, not token permissions to that branch. The workflow does not directly expose this write job through pull-request events.
Security Findings and Attack Paths
- inferred — Registry-controlled dependency content reaches lockfile resolution, but both Bun installation and npm shrinkwrap generation suppress lifecycle scripts. The inspected generator imports Node built-ins rather than installed dependency modules. These controls counter a dependency-script-to-write-authority attack path in the refresh job; they do not establish safety of uninspected external actions or package-manager behavior.
Trust Boundaries and Controls
- observed — The push token is explicitly supplied to the publishing step. Branch and repository values pass through environment variables and quoted shell arguments. Checkout credential persistence is disabled, and shrinkwrap generation uses a temporary manifest, script-disabled npm resolution, and finally-block cleanup.
Resilience and Maintainability Implications
- inferred — Ordinary pull-request CI counters a blanket concern about clean refresh runs skipping validation. The distinct failure window is after a token-authored push and before dispatch. A same-event rerun normally checks out the original event SHA and can encounter a non-fast-forward push rather than repair dispatch. The sentinel documents fail-closed merge intent, but external enforcement was not available.
Hardening Proposals
- proposed — Make the publication-to-validation handoff resumable: reconcile the current published commit and its CI state on recovery, including when regeneration produces no new diff, while preserving required validation for the exact branch head.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main changes: Renovate tracking for the Bun catalog and lockfile refreshes on Renovate branches. Linked Issues check Issue #362is directly linked and has two coding objectives.renovate.jsonadds a recursive regex manager for the rootpackage.jsoncatalog, uses the npm datasource and versioning, and preserves…Out of Scope Changes check The reviewed changes stay within issue #362. The Renovate configuration implements catalog tracking. The lockfile workflow implements regeneration and CI dispatch. Theci.ymlchanges support correct…Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Full details: Linked Issues check
-
Explanation
Issue
#362is directly linked and has two coding objectives.renovate.jsonadds a recursive regex manager for the rootpackage.jsoncatalog, uses the npm datasource and versioning, and preserves the required React and React Native exclusions..github/workflows/renovate-lockfiles.ymlruns onrenovate/**pushes, runsbun install --ignore-scripts, regenerates every trackednpm-shrinkwrap.jsonthat fails the existing check, commits and pushes changed lockfiles, and dispatchesci.yml.ci.ymlaccepts the dispatch and uses the merge base for affected-plugin detection. These changes cover catalog detection, lockfile regeneration, and the CI signal required by#362.
Full details: Out of Scope Changes check
-
Explanation
The reviewed changes stay within issue
#362. The Renovate configuration implements catalog tracking. The lockfile workflow implements regeneration and CI dispatch. Theci.ymlchanges support correct dispatched-run change detection. No unrelated implementation is shown. The PR correctly leaves Renovate'sArtifact update problemcomments out of scope.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Fixes #362
Problem
cataloginpackage.json. Neither thebunnor thenpmmanager reads Bun catalogs (bun catalog support is still an open Renovate PR, feat(bun): add catalog extraction and update support renovatebot/renovate#42909), so the Dependency Dashboard lists onlyrelease-pleaseandbunfor the rootpackage.json. The@getpaseo/*group rule never matched anything.bun.lockand thenpm-shrinkwrap.jsonfiles stale. The npm manager fails oncatalog:specs (EUNSUPPORTEDPROTOCOL), and nothing regeneratesbun.lock. CI then fails atbun install --frozen-lockfile, as on fix(deps): update dependency agent-browser to v0.40.0 #441:node ../scripts/shrinkwrap.mjs --check .reportsagent-browser: package.json 0.40.0, npm-shrinkwrap.json 0.39.4.Change
renovate.json: a regex custom manager for the rootcatalogblock (npm datasource and versioning). React and React Native stay disabled there because the Paseo app supplies them and the catalog pins its versions.gitIgnoredAuthorslistsgithub-actions[bot]so Renovate keeps rebasing branches that carry the lockfile commit..github/workflows/renovate-lockfiles.yml: on each push torenovate/**, runsbun install --ignore-scriptsand regenerates every drifted shrinkwrap with the existingscripts/shrinkwrap.mjs. If anything changed it commitschore(deps): refresh lockfilesand pushes withGITHUB_TOKEN. That push cannot retrigger the workflow (no loop) and does not start CI either, so the job dispatches CI on the branch withgh workflow run, which GitHub allows forGITHUB_TOKEN. The resultingCI sentinelcheck lands on the new head commit.ci.yml: acceptsworkflow_dispatch. For dispatched runs, affected-plugin detection diffs against the merge base withorigin/main, same as pull requests.No new secrets or app permissions are needed. Renovate's hosted app does not allow
postUpgradeTasks, so the sharedomercnet/renovate-configpreset needs no change.Out of scope
Verification
bun install --frozen-lockfileonrenovate/agent-browser-0.xnode ../scripts/shrinkwrap.mjs --check .inpaseo-shared-browseragent-browserbun.lockandpaseo-shared-browser/npm-shrinkwrap.jsonnpm run check,npm run typecheckinpaseo-shared-browseron that branchrenovate-config-validator(Renovate 44.198.3)Config validated successfullyrenovate --platform=local --dry-run=lookupwith the custom managerskipReason: disabled; e.g.zod 4.4.3 -> 4.6.7,pino 10.3.1 -> 10.4.0actionlint,zizmor 1.30.1The live path (Renovate push, lockfile commit, dispatched CI) can only run after this merges; #441 is the first case.
Astra review: see the PR comments.
Summary by CodeRabbit