chore(renovate): give Renovate credentials for npm.pkg.github.com + move preset to default.json - #45
Conversation
Renovate has never resolved any @wave-av/* package in any repo. The org preset sets an npmrc pointing @wave-av at npm.pkg.github.com but supplies no credentials, and GitHub Packages requires auth even to READ - so every lookup returns `no-result`, including in wave-foundation. Two fixes, one file: 1. hostRules for https://npm.pkg.github.com/ with the token supplied as {{ secrets.WAVE_PACKAGES_READ_TOKEN }}. No secret is committed - the Mend-hosted app resolves that reference from an ORG-scoped secret set in Credentials at developer.mend.io. Mend no longer reads `encrypted` blobs from repo config, so this templating is the supported route. 2. The preset lives in default.json, not renovate.json. Renovate fetches default.json first and only falls back to renovate.json with the deprecation warning the fleet has been seeing. renovate.json is now just the .github repo own config extending the shared preset. Also replaces the removed matchPackagePatterns key with matchPackageNames. Renovate still auto-migrates the old key, so this is future-proofing, not a bug fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
🤖 CodeAnt AI — Review Status
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThe PR enables Renovate to resolve internal @wave-av packages by adding a token-backed GitHub Packages host rule, moves the shared preset to default.json to avoid deprecated fallback behavior, updates package matching to the current option name, and leaves renovate.json as a lightweight preset reference. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_cda46ecd-fd12-4577-93ea-707c24ca1be0) |
codeant-ai
Bot
added
the
size:M
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This PR changes the org-wide Renovate preset to use an organization-scoped credential for GitHub Packages, enabling private dependency updates that may flow into deploy-on-merge automation. The authentication scope and broad automation impact warrant human review. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
|
Failed to generate code suggestions for PR |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (2)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (2)
🧰 Additional context used🔍 Remote MCP DeepWikiRelevant review context
🔇 Additional comments (2)
📝 SummarySummary by CodeRabbit
WalkthroughThe shared Renovate preset now contains recommended settings, package authentication, internal package rules, labels, and scheduling. The repository configuration now extends only this shared preset. ChangesRenovate configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This centralizes Renovate settings and enables authenticated private package lookups without exposing credentials. The configuration is validated and no merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
|
Note Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom. Code Review ✅ ApprovedMoves Renovate org-wide settings to OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Confidence score: 4/5
- In
default.json, the duplicate@wave-av/**package rule overlaps the inherited rule inorg-inherited-config.json, which can make matching package behavior— including the inheritedautomerge: truesetting—unclear; remove the duplicate or reconcile the rules explicitly.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="default.json">
<violation number="1" location="default.json:21">
P2: The `@wave-av/**` packageRule in default.json duplicates the pre-existing @wave-av rule in org-inherited-config.json (same package scope, both `minimumReleaseAge: "0 days"`). The org rule sets `automerge: true` for minor/patch under `platformAutomerge: true`, while the preset relies only on the `chassis-automerge` label for the reaper. Both now govern the same packages with different automerge semantics. Consolidate the @wave-av handling into one place (e.g. only the org-inherited config or only the preset) so the ~45 spokes that inherit both don't get competing/order-dependent behavior, and keep the `minimumReleaseAge: "0 days"` in a single rule.</violation>
</file>
Architecture diagram
sequenceDiagram
participant Repo as Spoke Repo (e.g., wave-search-edge)
participant Renovate as Renovate App (Mend-hosted)
participant Preset as Org Preset (.github/default.json)
participant SecretStore as Mend Org Credentials
participant GHCR as GitHub Packages (npm.pkg.github.com)
participant Dashboard as Dependency Dashboard
Note over Repo,Dashboard: Renovate runtime flow for private @wave-av/* lookup
Renovate->>Repo: Read repo renovate.json
Repo-->>Renovate: {"extends": ["local>wave-av/.github"]}
Renovate->>Preset: Resolve local>wave-av/.github preset
alt Preset resolution
Preset-->>Renovate: Load default.json (preferred)
else default.json missing
Preset-->>Renovate: Fallback to renovate.json (deprecated)
end
Note over Renovate: Preset config applied:<br/>npmrc registry mapping + hostRules
Renovate->>SecretStore: Resolve {{ secrets.WAVE_PACKAGES_READ_TOKEN }}
SecretStore-->>Renovate: Org-scoped PAT token (read:packages)
Renovate->>GHCR: Lookup @wave-av/spoke-chassis (auth with token)
alt Lookup succeeds
GHCR-->>Renovate: Package metadata + versions
Renovate->>Dashboard: Update dashboard (no-result line removed)
opt Bump available
Renovate->>Repo: Create bump PR (chore: spoke-chassis)
Repo-->>Renovate: Labeled chassis-automerge
end
else 401/403 Unauthorized
GHCR-->>Renovate: Auth error
Renovate->>Dashboard: Log "no-result" failure
Note over Renovate,Dashboard: Required operator action:<br/>Set WAVE_PACKAGES_READ_TOKEN in Mend org settings
end
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| "packageRules": [ | ||
| { | ||
| "description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates - which then triggers each spoke's deploy-on-merge.", | ||
| "matchPackageNames": [ |
There was a problem hiding this comment.
P2: The @wave-av/** packageRule in default.json duplicates the pre-existing @wave-av rule in org-inherited-config.json (same package scope, both minimumReleaseAge: "0 days"). The org rule sets automerge: true for minor/patch under platformAutomerge: true, while the preset relies only on the chassis-automerge label for the reaper. Both now govern the same packages with different automerge semantics. Consolidate the @wave-av handling into one place (e.g. only the org-inherited config or only the preset) so the ~45 spokes that inherit both don't get competing/order-dependent behavior, and keep the minimumReleaseAge: "0 days" in a single rule.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At default.json, line 21:
<comment>The `@wave-av/**` packageRule in default.json duplicates the pre-existing @wave-av rule in org-inherited-config.json (same package scope, both `minimumReleaseAge: "0 days"`). The org rule sets `automerge: true` for minor/patch under `platformAutomerge: true`, while the preset relies only on the `chassis-automerge` label for the reaper. Both now govern the same packages with different automerge semantics. Consolidate the @wave-av handling into one place (e.g. only the org-inherited config or only the preset) so the ~45 spokes that inherit both don't get competing/order-dependent behavior, and keep the `minimumReleaseAge: "0 days"` in a single rule.</comment>
<file context>
@@ -0,0 +1,37 @@
+ "packageRules": [
+ {
+ "description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates - which then triggers each spoke's deploy-on-merge.",
+ "matchPackageNames": [
+ "@wave-av/**"
+ ],
</file context>
1 participant
User description
Why
Renovate has never bumped a single
@wave-av/*package in any repo. Two walls were stacked; this PR removes the second (and harder) one.Wall 1 — no repo-level config. Fixed already:
wave-search-edge,wave-voice-edgeandwave-transcribe-edgenow carry{"extends": ["local>wave-av/.github"]}and their dashboards appeared within a minute. Measured today: 6 of 170 active repos have a repo-levelrenovate.json.Wall 2 — no credentials. The org preset sets
"npmrc": "@wave-av:registry=https://npm.pkg.github.com"and supplies no token. GitHub Packages requires auth even for a read, so every lookup fails:wave-foundation— the assumed positive control — fails identically for@wave-av/messagingand@wave-av/observability. So no internal package has ever resolved anywhere, including the two "configured" repos. A dashboard proves the config was read, not that lookups work.What changed
1.
hostRulesfor GitHub Packages. The token is referenced, never committed:{ "matchHost": "https://npm.pkg.github.com/", "hostType": "npm", "token": "{{ secrets.WAVE_PACKAGES_READ_TOKEN }}" }The obvious alternative — a committed
encrypted.tokenblob — is dead for this fleet. Fromrenovatebot/renovate@main,docs/usage/mend-hosted/credentials.md:{{ secrets.* }}templating is the supported replacement, and the docs confirm it resolves inside a preset, not just a repo config. Org-scoped secrets are "inherited by all repositories in your organization" — so one secret covers all 42+ spokes with no per-repo work.2. The preset moved to
default.json. Measured inlib/config/presets/util.ts: Renovate fetchesdefault.jsonfirst and only falls back torenovate.json, logging exactly the warning the fleet has been seeing — "Fallback to renovate.json file as a preset is deprecated, please use a default.json file instead." Becausedefault.jsonwins unconditionally, pointingrenovate.jsonatlocal>wave-av/.githubis safe and cannot self-extend.3.
matchPackagePatterns→matchPackageNames. The old key is gone from current Renovate options. This is future-proofing, not a bug fix — the validator was observed auto-migrating it tomatchPackageNames: ["/^@wave-av//"]and passing, so the rule does still apply today.Validation
renovate-config-validatoron both files:INFO: Config validated successfully. Control run against currentorigin/mainalso passes (via auto-migration), confirming the validator was actually exercising these files.The one operator step
This PR is inert until an org admin does exactly one thing:
How this gets verified
Not by a dashboard existing — that is the mistake that made
wave-foundationa broken control. The receipt is a dashboard whose lookup succeeds: after the secret is set, theno-resultline for@wave-av/spoke-chassismust be gone from the dependency dashboard of a spoke that already has config (e.g.wave-search-edge), and a real bump PR for@wave-av/spoke-chassismust be raised. Only then does this roll to the remaining spokes.Blast radius
Affects the 6 repos that currently extend this preset. Rollout to the other ~39 is deliberately not in this PR — scaling config before auth is fixed just produces dashboards that all fail the same lookup.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Note
Medium Risk
Org-wide Renovate behavior and private registry auth change; misconfigured or missing org secret would still block
@wave-av/*bumps, but no credentials are committed.Overview
Renovate’s org-wide settings move from
renovate.jsoninto a newdefault.jsonpreset, which is what Mend/Renovate resolves first and avoids the deprecatedrenovate.json-as-preset fallback. Reporenovate.jsonis reduced to only"extends": ["local>wave-av/.github"].The preset now adds
hostRulesso npm lookups againsthttps://npm.pkg.github.com/use{{ secrets.WAVE_PACKAGES_READ_TOKEN }}(org secret in Mend, not committed), fixingno-resultfailures when resolving@wave-av/*packages. The internal-package rule switches frommatchPackagePatternstomatchPackageNames:@wave-av/**, with the same chassis-automerge behavior, schedule, and timezone kept in the preset.Operator dependency: nothing takes effect until
WAVE_PACKAGES_READ_TOKENis set on the wave-av org in developer.mend.io.Reviewed by Cursor Bugbot for commit aee9df7. Bugbot is set up for automated code reviews on this repo. Configure here.
CodeAnt-AI Description
Enable Renovate to discover and update private WAVE npm packages
What Changed
@wave-av/*dependency updates to resolve instead of returning no resultsImpact
✅ Private package lookups succeed✅ WAVE package updates can be detected✅ Consistent Renovate settings across repositories💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.