Skip to content

Configure Renovate - #1

Closed
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/configure
Closed

Configure Renovate#1
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/configure

Conversation

@renovate

@renovate renovate Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

Detected Package Files

  • agent-bot/package.json (bun)
  • agent-computer/package.json (bun)
  • agent-langgraph/package.json (bun)
  • package.json (bun)
  • app/package.json (bun)
  • server/package.json (bun)
  • worker/package.json (bun)
  • supervisor/package.json (bun)
  • docker-compose.yml (docker-compose)
  • agent-bot/Dockerfile (dockerfile)
  • agent-computer/Dockerfile (dockerfile)
  • agent-langgraph/Dockerfile (dockerfile)
  • server/Dockerfile (dockerfile)
  • supervisor/Dockerfile (dockerfile)
  • .github/workflows/ci.yml (github-actions)
  • .github/workflows/security_zizmor.yml (github-actions)

Configuration Summary

Based on the default config's presets, Renovate will:

  • Start dependency updates only once this onboarding PR is merged
  • Hopefully safe environment variables to allow users to configure.
  • Show all Merge Confidence badges for pull requests.
  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
  • Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
  • Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
  • Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
  • Correctly link to the source code for golang.org/x packages
  • Link to pkg.go.dev/... for golang.org/x packages' title
  • Provide a link to octochangelog's improved breakdown for Renovate's changelogs

What to Expect

With your current configuration, Renovate will create 14 Pull Requests:

Update dependency @ag-ui/client to v0.0.58
  • Schedule: ["at any time"]
  • Branch name: renovate/ag-ui-client-0.x
  • Merge into: main
  • Upgrade @ag-ui/client to 0.0.58
Update dependency @ag-ui/core to v0.0.58
  • Schedule: ["at any time"]
  • Branch name: renovate/ag-ui-core-0.x
  • Merge into: main
  • Upgrade @ag-ui/core to 0.0.58
Update dependency @ag-ui/encoder to v0.0.58
  • Schedule: ["at any time"]
  • Branch name: renovate/ag-ui-encoder-0.x
  • Merge into: main
  • Upgrade @ag-ui/encoder to 0.0.58
Update ghcr.io/spiffe/spire-agent Docker tag to v1.15.2
  • Schedule: ["at any time"]
  • Branch name: renovate/ghcr.io-spiffe-spire-agent-1.x
  • Merge into: main
  • Upgrade ghcr.io/spiffe/spire-agent to 1.15.2
Update ghcr.io/spiffe/spire-server Docker tag to v1.15.2
  • Schedule: ["at any time"]
  • Branch name: renovate/ghcr.io-spiffe-spire-server-1.x
  • Merge into: main
  • Upgrade ghcr.io/spiffe/spire-server to 1.15.2
Update zizmorcore/zizmor-action action to v0.6.2
  • Schedule: ["at any time"]
  • Branch name: renovate/zizmorcore-zizmor-action-0.x
  • Merge into: main
  • Upgrade zizmorcore/zizmor-action to 3dc1ecc9bcb9e94e9b2c709687979e1298497054
Update busybox Docker tag to v1.38
  • Schedule: ["at any time"]
  • Branch name: renovate/busybox-1.x
  • Merge into: main
  • Upgrade busybox to 1.38
Update dependency @​copilotkit/react-core to v1.68.1
  • Schedule: ["at any time"]
  • Branch name: renovate/copilotkit-react-core-1.x
  • Merge into: main
  • Upgrade @copilotkit/react-core to 1.68.1
Update dependency @​copilotkit/runtime to v1.68.1
  • Schedule: ["at any time"]
  • Branch name: renovate/copilotkit-runtime-1.x
  • Merge into: main
  • Upgrade @copilotkit/runtime to 1.68.1
Update dependency @​vitejs/plugin-react to v6
  • Schedule: ["at any time"]
  • Branch name: renovate/vitejs-plugin-react-6.x
  • Merge into: main
  • Upgrade @vitejs/plugin-react to ^6.0.0
Update dependency eventsource to v5
  • Schedule: ["at any time"]
  • Branch name: renovate/eventsource-5.x
  • Merge into: main
  • Upgrade eventsource to 5.1.0
Update dependency openai to v7
  • Schedule: ["at any time"]
  • Branch name: renovate/openai-7.x
  • Merge into: main
  • Upgrade openai to ^7.0.0
Update dependency typescript to v7
  • Schedule: ["at any time"]
  • Branch name: renovate/typescript-7.x
  • Merge into: main
  • Upgrade typescript to ^7.0.0
Update dependency vite to v8
  • Schedule: ["at any time"]
  • Branch name: renovate/vite-8.x
  • Merge into: main
  • Upgrade vite to ^8.0.0

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

This PR was generated by Mend Renovate. View the repository job log.

@davidmckayv
davidmckayv deleted the renovate/configure branch August 17, 2026 00:50
This was referenced Aug 22, 2026
Merged
Merged
Merged
once0811-arch referenced this pull request in LAF-labs/openbot Aug 29, 2026
김기범 @kirodex 김기범
feat(desktop): one build opens every store - the shell learns the fro…
37e34bf 
…nt door

The window's origin moves from the first customer's apex to the product
domain's entry page (agent.laf-co.com), and the capability grant learns
the wildcard: https://*.agent.laf-co.com alongside the entry itself.
sajuhook.com stays granted - customer #1 predates the domain and lives
on an apex of its own - and localhost stays for development.

Until now a build was a customer: the origin was baked, so every next
store would have meant another binary. From 0.2.0 the shell opens the
entry page, the person types their store once, the page remembers, and
the next launch walks straight into their room. One build, the whole
fleet - the shape the shell's own comments were waiting for ("the day a
deployed address exists it is TWO values"; both moved together, which
tests/desktop-shell.test.ts exists to enforce).

The wildcard grant's real-world check (badge and notifications on a
*.agent store) rides the first domain-era provision - noted, not
assumed.

Co-authored-by: LAF Agent <274876363+laf-agent@users.noreply.github.com>
AbdullahFoqha referenced this pull request in AbdullahFoqha/OpenBot Sep 15, 2026
@AbdullahFoqha @claude
P5: the delivery gates, and opening a pull request exactly once
5c5d8ee 
Backlog -> Ready -> In Progress -> In Review -> Ready to Integrate -> Integrated,
written down in role instructions, is a sequence a model is asked to remember. Here
it is a set of questions answerable from rows.

Each gate exists for a specific way work goes wrong quietly, and none of them produce
an error at the time:

- Criteria are written at Ready and FROZEN there. Without them, whatever gets built
  becomes the definition of what was asked for and the review cannot fail honestly.
  Changing them is a deliberate second pass through Ready, and the refusal says so,
  because a gate with no way through is a gate people route around.

- A review is stored against a COMMIT, not a task. Approval on a task survives a push;
  approval on a commit does not, which is the entire point. The refusal names the
  commit, because the usual truth is that a review exists and is about the previous
  one -- "no reviews" would send somebody looking for a review nobody wrote instead of
  for the push that invalidated the one they remember.

- An author cannot review their own work, refused at the door rather than filtered at
  the gate: a stored self-review looks like evidence on every screen that does not
  know to exclude it, and somebody will write that screen.

- Integration is gated on the INTEGRATED commit being built and smoke tested. A squash
  merge produces a commit that has never existed and nobody reviewed, so "it passed on
  the branch" is a statement about a different tree.

- Native verification blocks only the gate it was agreed for. An unavailable check is
  untested, not passed -- and making every task wait on a device would make the flag
  meaningless by making everybody turn it off.

For GitHub, the failure built around is not an error but an ambiguous success: a
create times out, the PR exists, the retry opens a second, and a reviewer approves
whichever they found. So every create searches first -- before the first attempt too,
because a process that died in the window left no memory of having tried -- and a
non-zero exit is reconciled by searching again rather than reported. Bases are set
explicitly every time; a stacked child defaulted to the trunk shows a diff containing
its parent's changes as if the child had written them. Everything is a draft, and
nothing merges: merging is the user's authorisation and the repository's gates.

Retargeting is not restacking, and which is needed depends on the merge strategy. After
a squash the parent's commits are not in the trunk under any id the child knows, so the
child still carries them. Squash is the common default, so that case is said out loud.

19 tests, plus live proof against a private disposable repo, AbdullahFoqha/openbot-
studio-pilot: draft PR #1 opened, an immediate retry returned the same PR and created
nothing, stacked PR #2 opened against studio/empty-state with ancestry verified by
`git merge-base --is-ancestor` rather than by branch name, and its diff is scoped to
its own single line. A fabricated base commit is refused.

Also: the studio suites now clear every product in their cleanup rather than their own.
One active product is a real rule, so a leftover from an evidence run pointed at the
test database made this file fail against the leftover rather than against its code --
the same lesson the delegation suite learned from a leftover Bot called "Engineer".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FY8oPnn1ru4pvYLj5Gqkc5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davidmckayv