Conversation
dormouse-bot
left a comment
dormouse-bot
left a comment
There was a problem hiding this comment.
The Renovate config itself maps the old Dependabot setup over faithfully — update-lockfile ≈ increase-if-necessary, the minimumReleaseAge tiers (1/3/14 days) match the old cooldown, the three group rules mirror the old groups, and github-actions correctly stays cooldown-free. One gap, though: the migration doesn't reach SECURITY.md, which the security audit treats as its source of truth.
SECURITY.md is mechanically enforced by security-audit.yaml — "The audit reads SECURITY.md, executes each FAIL IF as a mechanical check" — and is a required gate before VS Code releases. Two of its FAIL IF lines still assert against the file this PR deletes:
- FAIL IF
.github/dependabot.ymlis missing npm coverage for/or Cargo coverage for/standalone/src-tauri.- FAIL IF
.github/dependabot.ymlis missing dependency cooldown windows.
With .github/dependabot.yml gone, both checks now fail against a missing file, so the next nightly audit would open a security-audit-failure issue (and block the next release-gated audit). These should be retargeted at .github/renovate.json and its Renovate equivalents — e.g. the enabledManagers covering npm/cargo, and the minimumReleaseAge package rules in place of cooldown windows.
Two stale prose references in the same file should move over too:
- The "Dependency Supply Chain" section links maturity gating to
[dependabot configuration](.github/dependabot.yml)— a now-broken link that should point to.github/renovate.json. - "GitHub Actions Policies" says "Dependabot will update the hashes as necessary" — now Renovate's job.
(Optional, same file: "no Dependabot ecosystem tracks it" in the Node-runtime paragraph reads a bit anachronistically post-migration.)
All of these are outside this PR's diff, so I can't attach inline suggestions. Want me to push a commit updating SECURITY.md (the two FAIL IF assertions plus the prose references) onto this branch?
|
@dormouse-bot yes please, push a commit to this branch |
The Renovate migration removed .github/dependabot.yml, but SECURITY.md still asserted two FAIL IF checks against it and linked to it in prose. Retarget the audit checks to .github/renovate.json (enabledManagers and minimumReleaseAge package rules) and update the supply-chain link, the GitHub Actions hash-update note, and the Node-runtime parenthetical. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Deploying mouseterm with
|
| Latest commit: |
3fa10ce
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://36babb38.mouseterm.pages.dev |
| Branch Preview URL: | https://renovate.mouseterm.pages.dev |
|
Done — pushed
The next nightly audit should pass against the new file. |
The "Install system dependencies" step hits flaky apt mirrors: a healthy run finishes in <1min, but a bad mirror can hang the step for 15-80min (observed an 84min run). Restarting just rerolls the same dice. Wrap each apt call in `timeout` so a hung attempt is killed and retried (a fresh attempt almost always lands on a healthy mirror), retry up to 3x, add --no-install-recommends to trim the download, drop -qq to -q for visibility, and cap the whole step at 10min as a hard backstop. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Last run proved retries alone don't help: all 3 attempts hit the same degraded Azure mirror (update was fast, but the .deb download dribbled ~60s per file) and the job failed cleanly at the 10min mark. apt's own mirror method only fails over on connection errors, not slowness, so it wouldn't help either. Rotate the mirror host between attempts instead: Azure first (same datacenter, sub-minute when healthy), falling back to archive.ubuntu.com. The per-attempt timeout turns a slow mirror into a failed attempt, and the next attempt points at a different host -- so a sustained single-mirror problem is escaped rather than retried into the ground. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2 participants
Summary
.github/renovate.jsoninstead of the removed Dependabot config.Validation
npx --yes --package renovate renovate-config-validator .github/renovate.json