feat(renovate): track the RigelBuild/devenv fork in both devenv locks (RIG-2815) - #865
Open
rigel-mintaka wants to merge 3 commits into
Open
feat(renovate): track the RigelBuild/devenv fork in both devenv locks (RIG-2815)#865rigel-mintaka wants to merge 3 commits into
rigel-mintaka wants to merge 3 commits into
Conversation
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
|
Compass engineering docs preview: https://dependencies-rig-2815-devenv.compass-eng-docs.pages.dev Deployed from |
… (RIG-2815)
Compass carries two independent devenv scopes — the root dev shell
(`devenv.lock`) and the agent base image (`agent-image/devenv.lock`) — and both
resolve the shared canonical fork `github:RigelBuild/devenv` at its default
branch. Nothing tracked either pin, so both drifted months behind the fork's
`main` until someone relocked by hand. This wires Renovate to keep both current
on a daily schedule (RIG-2546 T7).
### Mechanism
A `custom.regex` manager surfaces each lock's fork rev as a `git-refs` digest, and
a coupled packageRule opens a solo branch that runs a `postUpgradeTask` to relock
the file with `devenv update devenv`. One manager + one rule + one branch per lock
(RD-1 unifies the source but does not reconcile the two locks, so they stay on
independent cadences).
### Why not `lockFileMaintenance`
The obvious mechanism is unimplementable here, source-verified against the pinned
`renovate@44.46.2`:
- `lockFileMaintenance` is manager-scoped (`flatten.ts` gates on
`manager.supportsLockFileMaintenance`); `custom.regex` exports neither that flag
nor `updateArtifacts` (`modules/manager/custom/regex/index.ts`), so it is
silently ignored — no branch, no error, no PR.
- The native `nix` manager supports maintenance but only over
`lockFileNames = ['flake.lock']` (`modules/manager/nix/index.ts`), never
`devenv.lock`.
- `postUpgradeTasks` are filtered off `lockFileMaintenance` branches entirely
(`workers/repository/update/branch/execute-post-upgrade-commands.ts:387-400`), so
even a maintenance-capable manager could not carry the relock.
A normal digest upgrade *does* carry `postUpgradeTasks`, which is exactly what the
regex-digest + task pairing buys — the same mechanism the devenv-nixpkgs channel
lockstep (`refresh-devenv-nixpkgs.ts`) already relies on. The manager and rule
comments carry this argument in full, prefixed DO NOT SIMPLIFY.
### Verification
- `moon run renovate:typecheck renovate:test` green — 148 pass / 0 fail (+26 new
tests across the guard core, its orchestration harness, and the config coupling).
- Live `renovate@44.46.2 --dry-run=extract` against the working tree: both managers
fire — `RigelBuild/devenv` extracts the root lock's rev, `RigelBuild/devenv-agent-image`
the agent-image lock's, both as `git-refs` digests. The agent-image lock is behind
the fork HEAD, so a relock PR would open now; the root lock is coincidentally current.
- The relock script's wrong-directory guard was red-checked (`.cwd(cwd)` → `.cwd(".")`
turns the agent-image orchestration test red).
Spec-impact: none. Refs RIG-2815.
Co-authored-by: Matt Wilkinson <matt@rigel.build>
… + accurate fail-loud (RIG-2815) Round-1 review of PR #865 returned 2 high + 4 medium + 4 low. This additive commit dispositions them; the structural H1 gap is filed as RIG-3253. H2 (high) — the agent-image relock ran under the ROOT lock's devenv CLI (renovate.yml provisions one PATH devenv from devenv.lock). refresh-devenv-lock.ts now self-provisions the scope-correct devenv: `const src = flakeref(devenvSource(before))` then `nix run ${src} -- update devenv` in the scope dir, reusing devenvSource/flakeref from tools/toolchain/devenv-cli/core.ts (mirrors ci.yml:2058-2059). Each lock is now written by the devenv version IT pins — the two revs differ by design (RD-1). H1 (high) — the "fail-loud refuses to ship" comments/messages overclaimed. Verified against renovate@44.46.2: a non-zero postUpgradeTask exit does NOT abort the branch (execute-post-upgrade-commands.js:112-117 → artifactErrors; branch/index.js:408-417 reaches MANAGER_LOCKFILE_ERROR only in the releaseTimestamp arm, absent for a git-refs digest; prepareCommit reset --hard re-writes the in-memory rev-bump). Corrected every comment/message to state the real effect — a red renovate/artifacts status — and that the fail-closed guarantee is that status + mandatory human review (no automerge). Throws kept. Making renovate/artifacts a required check / adding a devenv-fork consistency CI gate is the family-wide structural fix, filed as RIG-3253. M1 — escape the interior slash in the agent-image managerFilePattern; pin the literal in config.test.ts. M2 — loud named failure when neither origin/<base> nor <base> resolves, instead of a raw git diff error; + fallback-direction and unresolvable-base tests. M3 — nix test stub gates the lock write on the post-`--` args being exactly `update devenv`; + fail-relock and corrupt-relock sentinel tests. M4 — correct the minimumReleaseAge:null justification (mechanically inapplicable to a git-refs digest; compensating control is human review). L1 isolation-chain comment; L2 readonly DEVENV_LOCK_PATHS; L3 hoist beforeRev out of the log template. moon run renovate:typecheck renovate:test → 152 pass / 0 fail (4 new tests). Biome clean on touched files (2 pre-existing config.test.ts warnings, identical on main).
… substituter coupling guard (RIG-2815) Round-2 review of the R1 fixes (0 high / 2 medium / 3 low) surfaced two runtime-surface gaps introduced by the R1 relock rework, plus follow-on review of these fixes (R3) hardened them: - executionTimeout: 45 (bot-config.json5, globalOnly) so the fork-devenv relock — which cold-builds the fork `#devenv` from source, no binary cache — is not killed at Renovate's 15-min child-process default, which would leave the regex rev bump committed but the lock unrelocked. Comment states the knob's GLOBAL scope (raises the hang budget for every manager, accepted deliberately) and cites the fork's own ~4.5-min ubuntu-latest build. Pinned by a config.test.ts assertion (floor >= 30, mutation-killed on removal and on a lowered value). - Substituter-coupling header note on refresh-devenv-lock.ts + a config.test.ts guard that renovate.yml's extra_nix_config still names both caches and both trusted keys on LIVE (comment-stripped) config lines, so a future trim — including a commented-out or narrated-away block — fails the test rather than silently wedging the nightly relock. - Test hardening: a base-ref direction test where both origin/main and a stale local main resolve-and-differ (the prior test passed with the arms flipped); a mandatory `--` separator in the nix stub; and a matchStrings sync guard across the two fork managers. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
dependencies/rig-2815-devenv-lockfile-maintenance
branch
from
September 4, 2026 22:04
2c6710f to
ec367d6
Compare
rigel-mintaka
marked this pull request as ready for review
September 4, 2026 22:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Compass carries two independent devenv scopes — the root dev shell
(
devenv.lock) and the agent base image (agent-image/devenv.lock) — and bothresolve the shared canonical fork
github:RigelBuild/devenvat its defaultbranch. Nothing tracked either pin, so both drifted months behind the fork's
mainuntil someone relocked by hand. This wires Renovate to keep both currenton a daily schedule (RIG-2546 T7).
Mechanism
A
custom.regexmanager surfaces each lock's fork rev as agit-refsdigest, anda coupled packageRule opens a solo branch that runs a
postUpgradeTaskto relockthe file with
devenv update devenv. One manager + one rule + one branch per lock(RD-1 unifies the source but does not reconcile the two locks, so they stay on
independent cadences).
Why not
lockFileMaintenanceThe obvious mechanism is unimplementable here, source-verified against the pinned
renovate@44.46.2:lockFileMaintenanceis manager-scoped (flatten.tsgates onmanager.supportsLockFileMaintenance);custom.regexexports neither that flagnor
updateArtifacts(modules/manager/custom/regex/index.ts), so it issilently ignored — no branch, no error, no PR.
nixmanager supports maintenance but only overlockFileNames = ['flake.lock'](modules/manager/nix/index.ts), neverdevenv.lock.postUpgradeTasksare filtered offlockFileMaintenancebranches entirely(
workers/repository/update/branch/execute-post-upgrade-commands.ts:387-400), soeven a maintenance-capable manager could not carry the relock.
A normal digest upgrade does carry
postUpgradeTasks, which is exactly what theregex-digest + task pairing buys — the same mechanism the devenv-nixpkgs channel
lockstep (
refresh-devenv-nixpkgs.ts) already relies on. The manager and rulecomments carry this argument in full, prefixed DO NOT SIMPLIFY.
Verification
moon run renovate:typecheck renovate:testgreen — 148 pass / 0 fail (+26 newtests across the guard core, its orchestration harness, and the config coupling).
renovate@44.46.2 --dry-run=extractagainst the working tree: both managersfire —
RigelBuild/devenvextracts the root lock's rev,RigelBuild/devenv-agent-imagethe agent-image lock's, both as
git-refsdigests. The agent-image lock is behindthe fork HEAD, so a relock PR would open now; the root lock is coincidentally current.
.cwd(cwd)→.cwd(".")turns the agent-image orchestration test red).
Spec-impact: none. Refs RIG-2815.
Co-authored-by: Matt Wilkinson matt@rigel.build