fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
bae4b66fa4798a15b0b4a2aa49b3b00bfd00a4fb
agentic-dev/docs/work/ci-security-and-supply-chain/03-renovate-adoption/_story.md
Danijel Martinek bae4b66fa4 refactor(work): drop date prefixes + move _state.json into _system/ 
Convention shift: epic folders + PRD filenames + frontmatter id
fields are now bare slugs. The created: timestamp (Phase 2) carries
the date; folder names don't repeat it. A future <task-id>-<slug>
shape (e.g. ClickUp) lands cleanly when that integration ships.

Renames (git mv preserves history):
- docs/work/2026-05-13-binder-wrap-helper/
    -> docs/work/binder-wrap-helper/
- docs/work/2026-05-14-library-evaluation-policy/
    -> docs/work/library-evaluation-policy/
- docs/work/2026-05-14-ci-security-and-supply-chain/
    -> docs/work/ci-security-and-supply-chain/
- docs/work/prds/2026-05-13-binder-wrap-helper.prd.md
    -> docs/work/prds/binder-wrap-helper.prd.md
- docs/work/prds/2026-05-13-coverage-architecture.prd.md
    -> docs/work/prds/coverage-architecture.prd.md
- docs/work/prds/2026-05-14-library-evaluation-policy.prd.md
    -> docs/work/prds/library-evaluation-policy.prd.md
- docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
    -> docs/work/prds/ci-security-and-supply-chain.prd.md

Frontmatter updates inside the renamed files: epic id, epic prd,
story epic, PRD id, PRD builds-on all drop date prefixes.

System folder + state file move:
- New docs/work/_system/ holds framework-managed state.
- docs/work/_state.json -> docs/work/_system/_state.json.
- state-builder.mjs adds _system to SKIP_FOLDERS.
- cli.mjs + state-sync-guard.mjs + .husky/pre-commit point at the
  new path.

template-reset-v1 epic deleted entirely (one-off cleanup epic from
the pre-date-convention era; status was already done).

Generator-template updates (so new artifacts ship in the right
shape):
- .sandcastle/decomposer.prompt.md emits bare-slug folder names +
  ISO created: timestamp.
- .claude/skills/to-prd/SKILL.md template uses bare-slug filename +
  bare-slug id field + ISO created: timestamp.

Doc reference updates: glossary, runbook, agent-first-workflow-
and-conformance, reviewer prompt, ADR-020, ADR-022, ADR-023 all
point at the new paths/slugs.
2026-05-14 21:16:51 +02:00

2.7 KiB
Raw Blame History

id, epic, title, type, status, feature, depends-on, blocks, created, updated
id epic title type status feature depends-on blocks created updated
03-renovate-adoption ci-security-and-supply-chain Renovate adoption technical-story done tooling
09-ci-security-guide-and-docs
2026-05-14T18:59:12+02:00 2026-05-14T19:16:52.691Z

Goal

Ship .github/renovate.json configuring automated dependency management: grouped per-ecosystem npm bumps, Dockerfile base-image tracking, GitHub Actions SHA pinning, automerge for green minor+patch PRs, and a single dependency dashboard issue.

Why

Major-tag pinning for GitHub Actions is documented insecure — the 2025 tj-actions/changed-files incident proved it. Renovate's pinGitHubActionDigests preset automates the one-time SHA-pin sweep and keeps SHAs current thereafter. Grouping ecosystem clusters (Sentry, OTel, tRPC, Payload, Inversify) into weekly PRs prevents noise while ensuring drift is surfaced. Automerge on green minor+patch PRs removes human toil for routine bumps.

Done when

  • .github/renovate.json exists and is valid JSON, extending presets: config:base, helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor, :automergePatch.
  • packageRules groups @sentry/*, @opentelemetry/*, @trpc/*, payload*, and inversify* into per-cluster weekly PRs.
  • Dockerfile manager is enabled for .sandcastle/Dockerfile.
  • dependencyDashboard: true is set (opens a single Renovate-managed issue summarising open + queued PRs, labeled renovate/dashboard per PRD Q6).
  • Renovate's bump commits use chore(deps): (minor/patch) and chore(deps-major): (major) commit-message prefixes so release-please's per-package bump rules apply cleanly.
  • pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass (no executable code change; JSON config only).

In scope

  • .github/renovate.json — full Renovate configuration.

Out of scope

  • Verifying the first Renovate PR (SHA-pin sweep) — that happens when the GitHub App runs, not at commit time. The success criterion (all @v<N> pins rewritten to SHAs) is verified when Renovate's first PR merges.
  • Renovate Dependency Dashboard → docs/work/ task integration — explicitly out of scope in the PRD.

Tasks

  • Create .github/renovate.json extending presets config:base, helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor, :automergePatch; add packageRules grouping @sentry/*, @opentelemetry/*, @trpc/*, payload*, inversify* into weekly per-cluster PRs; enable Dockerfile manager for .sandcastle/Dockerfile; set dependencyDashboard: true; set commitMessagePrefix to enforce chore(deps): / chore(deps-major): per Conventional Commits; one commit, all gates pass.