agentic-dev/_story.md at 90fc2853f286a60d1c9a594f0a13fe8ad56664e1

Template

Files

Danijel Martinek 90fc2853f2 feat(work): add ISO timestamps + auto-bump on staged work-doc changes

- New scripts/work/bump-updated-timestamps.mjs stamps the `updated:`
  frontmatter field to the current ISO 8601 UTC timestamp on every
  staged docs/work/**/*.md file. Idempotent; adds the field after
  `created:` if missing.
- .husky/pre-commit invokes the bump script as step 2 (before
  rebuild-state) so _state.json sees the fresh timestamp.
- Backfill all existing work docs (4 PRDs + 3 epics + 21 stories):
    * created: promoted from \`YYYY-MM-DD\` -> ISO timestamp using
      git log --diff-filter=A on each file (first-commit date for
      stories that had no \`created:\` line, midnight UTC for PRDs
      and epics that had date-only created).
    * updated: added from \`git log -1 --format=%aI\` on each file
      (last-commit timestamp); will be re-stamped to "now" by the
      pre-commit hook on this commit.

Stories that had no \`created:\` line now get one.

2026-05-14 21:10:34 +02:00

2.7 KiB

Raw Blame History

id, epic, title, type, status, feature, depends-on, blocks, created, updated

epic

title

type

status

feature

depends-on

blocks

created

updated

03-renovate-adoption

2026-05-14-ci-security-and-supply-chain

Renovate adoption

technical-story

done

tooling

09-ci-security-guide-and-docs

2026-05-14T18:59:12+02:00

2026-05-14T19:10:35.370Z

Goal

Ship .github/renovate.json configuring automated dependency management: grouped per-ecosystem npm bumps, Dockerfile base-image tracking, GitHub Actions SHA pinning, automerge for green minor+patch PRs, and a single dependency dashboard issue.

Why

Major-tag pinning for GitHub Actions is documented insecure — the 2025 tj-actions/changed-files incident proved it. Renovate's pinGitHubActionDigests preset automates the one-time SHA-pin sweep and keeps SHAs current thereafter. Grouping ecosystem clusters (Sentry, OTel, tRPC, Payload, Inversify) into weekly PRs prevents noise while ensuring drift is surfaced. Automerge on green minor+patch PRs removes human toil for routine bumps.

Done when

.github/renovate.json exists and is valid JSON, extending presets: config:base, helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor, :automergePatch.
packageRules groups @sentry/*, @opentelemetry/*, @trpc/*, payload*, and inversify* into per-cluster weekly PRs.
Dockerfile manager is enabled for .sandcastle/Dockerfile.
dependencyDashboard: true is set (opens a single Renovate-managed issue summarising open + queued PRs, labeled renovate/dashboard per PRD Q6).
Renovate's bump commits use chore(deps): (minor/patch) and chore(deps-major): (major) commit-message prefixes so release-please's per-package bump rules apply cleanly.
pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass (no executable code change; JSON config only).

In scope

.github/renovate.json — full Renovate configuration.

Out of scope

Verifying the first Renovate PR (SHA-pin sweep) — that happens when the GitHub App runs, not at commit time. The success criterion (all @v<N> pins rewritten to SHAs) is verified when Renovate's first PR merges.
Renovate Dependency Dashboard → docs/work/ task integration — explicitly out of scope in the PRD.

Tasks

Create .github/renovate.json extending presets config:base, helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor, :automergePatch; add packageRules grouping @sentry/*, @opentelemetry/*, @trpc/*, payload*, inversify* into weekly per-cluster PRs; enable Dockerfile manager for .sandcastle/Dockerfile; set dependencyDashboard: true; set commitMessagePrefix to enforce chore(deps): / chore(deps-major): per Conventional Commits; one commit, all gates pass.

2.7 KiB Raw Blame History