konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(review-bot,renovate): useful reviews of dependency updates #1610

Merged
k.renner merged 1 commits from daedalus/review-bot-dependency-reviews into main 2026-11-09 07:13:27 +00:00
Conversation 0 Commits 1 Files Changed 5
+57 -13
hermes-bot commented 2026-11-09 06:43:10 +00:00
Member
Copy Link
Copy Source

Makes review-bot's reviews of Renovate PRs say what changed upstream, whether it touches the repo, and what CI says. Trigger: the review of konairius/ical-proxy#22 restated the diff and listed "digests and CI not checked" as ⚪.

Changes

  • Renovate: RENOVATE_GITHUB_COM_TOKEN (kubernetes/apps/renovate/externalsecret.yaml), from its own OpenBao key homelab/apps/renovate/github, field token (ESO key apps/renovate/github). No other service reads it. The job logged "No github.com token has been configured. Skipping release notes retrieval". RENOVATE_GITHUB_COM_TOKEN is the current name; upstream marks GITHUB_COM_TOKEN as deprecated (docs.renovatebot.com/getting-started/private-packages). The key exists now, according to the owner. If it were missing, only this ExternalSecret's refresh would fail, and the Secret would keep its old data.
  • review-bot defaultMCPTools matched the live gitea-mcp 1.13.0 for only 11 of 20 names. 1.13 folded get_commit, list_commits, compare_commits, list_branches, get_tag, list_tags, get_release, get_latest_release and list_releases into commit_read / branch_read / tag_read / release_read. I checked with tools/list on gitea-mcp.renner.uno: none of the old names is served. That broke the prompt's compare_commits (re-reviews) and list_commits (mandatory check 1). The list now uses the 1.13 names, and a test keeps it read-only. CI status needs no new tool: pull_request_read method get_status returns the combined status of the head, which is where Woodpecker reports. actions_run_read covers Gitea Actions only, which these repos don't use for CI, so it stays off.
  • prompt.md:
    • New mandatory check: CI status of the head, with failing and pending contexts named.
    • New Dependency updates section:
      • Use the release notes between the old and new version.
      • Check this repo's use of everything they change (breaking changes, deprecations, changed defaults, CVEs), with path:line.
      • Digest-only rebuilds of the same tag get one line.
      • No notes available: one line, not a ⚪.
      • No restating the diff.
    • ⚪ is now only for real suspicions, never for things no tool can check.

Verification

  • go vet, go test ./... (go 1.27.3) green.
  • kubectl kustomize kubernetes/apps/renovate renders the new key.

After merge

  1. ExternalSecret renovate/renovate-token synced, and the next Renovate run logs no "Skipping release notes retrieval".
  2. Re-request review-bot on ical-proxy#22. Release notes for kaniko additionally need konairius/renovate-config (source URL) and/or the web-fetch PR stacked on this one.

Hermes-Card: t_81d3ebcd (daedalus)

Makes review-bot's reviews of Renovate PRs say what changed upstream, whether it touches the repo, and what CI says. Trigger: the review of konairius/ical-proxy#22 restated the diff and listed "digests and CI not checked" as ⚪. ## Changes - **Renovate: `RENOVATE_GITHUB_COM_TOKEN`** (`kubernetes/apps/renovate/externalsecret.yaml`), from its own OpenBao key **`homelab/apps/renovate/github`, field `token`** (ESO key `apps/renovate/github`). No other service reads it. The job logged "No github.com token has been configured. Skipping release notes retrieval". `RENOVATE_GITHUB_COM_TOKEN` is the current name; upstream marks `GITHUB_COM_TOKEN` as deprecated (docs.renovatebot.com/getting-started/private-packages). The key exists now, according to the owner. If it were missing, only this ExternalSecret's refresh would fail, and the Secret would keep its old data. - **review-bot `defaultMCPTools` matched the live gitea-mcp 1.13.0 for only 11 of 20 names.** 1.13 folded `get_commit`, `list_commits`, `compare_commits`, `list_branches`, `get_tag`, `list_tags`, `get_release`, `get_latest_release` and `list_releases` into `commit_read` / `branch_read` / `tag_read` / `release_read`. I checked with `tools/list` on gitea-mcp.renner.uno: none of the old names is served. That broke the prompt's `compare_commits` (re-reviews) and `list_commits` (mandatory check 1). The list now uses the 1.13 names, and a test keeps it read-only. CI status needs no new tool: `pull_request_read` method `get_status` returns the combined status of the head, which is where Woodpecker reports. `actions_run_read` covers Gitea Actions only, which these repos don't use for CI, so it stays off. - **`prompt.md`:** - New mandatory check: CI status of the head, with failing and pending contexts named. - New **Dependency updates** section: - Use the release notes between the old and new version. - Check this repo's use of everything they change (breaking changes, deprecations, changed defaults, CVEs), with `path:line`. - Digest-only rebuilds of the same tag get one line. - No notes available: one line, not a ⚪. - No restating the diff. - ⚪ is now only for real suspicions, never for things no tool can check. ## Verification - `go vet`, `go test ./...` (go 1.27.3) green. - `kubectl kustomize kubernetes/apps/renovate` renders the new key. ## After merge 1. ExternalSecret `renovate/renovate-token` synced, and the next Renovate run logs no "Skipping release notes retrieval". 2. Re-request review-bot on ical-proxy#22. Release notes for kaniko additionally need konairius/renovate-config (source URL) and/or the web-fetch PR stacked on this one. Hermes-Card: t_81d3ebcd (daedalus)
hermes-bot added 1 commit 2026-11-09 06:43:11 +00:00
feat(review-bot,renovate): useful reviews of dependency updates
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/review-bot-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
354d2b18d7 
The review-bot review of konairius/ical-proxy#22 (golang/alpine digests,
kaniko v1.25.20 -> v1.25.21) restated the diff and listed "digests and CI
not checked" as unverified. Three causes:

- Renovate wrote no release notes: it has no github.com token ("No
  github.com token has been configured. Skipping release notes retrieval",
  job renovate-29903220). The ExternalSecret now renders
  RENOVATE_GITHUB_COM_TOKEN (the current name; GITHUB_COM_TOKEN is
  deprecated) from its own OpenBao key apps/renovate/github, field `token`.
  No other service reads that key.
- defaultMCPTools still named per-method tools that gitea-mcp 1.13 folded
  into commit_read, branch_read, tag_read and release_read. tools/list on
  gitea-mcp.renner.uno has none of get_commit, list_commits,
  compare_commits, list_branches, get_tag, list_tags, get_release,
  get_latest_release, list_releases, so 9 of the 20 enabled names matched
  nothing and the prompt's compare_commits/list_commits steps had no tool.
  The list now has the 1.13 names; a test keeps it read-only.
- prompt.md had no guidance for dependency updates. New "Dependency
  updates" section: release notes between old and new version, the repo's
  use of what they change (path:line), one line for digest-only rebuilds,
  no unverified boilerplate. New mandatory check: CI status of the head
  (pull_request_read get_status; Woodpecker reports commit statuses).
hermes-bot requested review from review-bot 2026-11-09 07:01:32 +00:00
review-bot approved these changes 2026-11-09 07:05:33 +00:00
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model claude-sonnet-5-5, commit 354d2b18d7faa38118a6c17ec08f2ec62ad06634.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Request a review from review-bot again for a fresh one.

Summary

This PR adds a RENOVATE_GITHUB_COM_TOKEN to the Renovate ExternalSecret, taken from the separate OpenBao key apps/renovate/github. It also moves review-bot's MCP tool allowlist to the gitea-mcp 1.13 names and adds a CI-status check and a "Dependency updates" section to prompt.md. CI on the head is success with all 3 contexts green: ci-scripts-test, review-bot-test and ci-manifests-test. mergeable is true. The review-bot review already on the PR has an empty body and no marker, so I treated this as a first review.

⚪ Unverified

  • New tool names and commit_read method names. review-bot/config.go now lists commit_read, branch_read, tag_read and release_read, and prompt.md tells the model to call commit_read with methods compare and list. I can't see the gitea-mcp server, so I can't confirm those names or method values. The PR description says they were checked with tools/list. If a name is wrong, the tool is silently unavailable and the re-review and mandatory-check-1 instructions break.
  • Base-branch check. The tool list I have includes no commit-listing tool, so I could not run the check for recent base-branch commits touching the changed files. mergeable is true, so I did not read the base-tip files.

🟡 Suggestions

  • review-bot/config_test.go: TestDefaultMCPToolsOnlyRead accepts any name ending in _read. A tool like commit_read is read-only only if the server's methods all are. That is fine for now, but the test only proves the naming pattern, not read-only behaviour.
  • kubernetes/apps/renovate/externalsecret.yaml: a missing apps/renovate/github key would fail the whole ExternalSecret sync. That would also block rotation of the existing RENOVATE_TOKEN and RENOVATE_HOST_RULES values. The PR says the existing Secret keeps its old data, and the owner says the key exists now. It is worth confirming the key before merge.

Tests

TestDefaultMCPToolsOnlyRead is enough for the allowlist change, and CI passes. The ExternalSecret and prompt changes have no automated tests, which is normal for this repo. The PR says the Kubernetes render was checked with kubectl kustomize.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5-5`, commit `354d2b18d7faa38118a6c17ec08f2ec62ad06634`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Request a review from `review-bot` again for a fresh one. --- ## Summary This PR adds a `RENOVATE_GITHUB_COM_TOKEN` to the Renovate ExternalSecret, taken from the separate OpenBao key `apps/renovate/github`. It also moves review-bot's MCP tool allowlist to the gitea-mcp 1.13 names and adds a CI-status check and a "Dependency updates" section to `prompt.md`. CI on the head is `success` with all 3 contexts green: `ci-scripts-test`, `review-bot-test` and `ci-manifests-test`. `mergeable` is true. The review-bot review already on the PR has an empty body and no marker, so I treated this as a first review. ## ⚪ Unverified - **New tool names and `commit_read` method names.** `review-bot/config.go` now lists `commit_read`, `branch_read`, `tag_read` and `release_read`, and `prompt.md` tells the model to call `commit_read` with methods `compare` and `list`. I can't see the gitea-mcp server, so I can't confirm those names or method values. The PR description says they were checked with `tools/list`. If a name is wrong, the tool is silently unavailable and the re-review and mandatory-check-1 instructions break. - **Base-branch check.** The tool list I have includes no commit-listing tool, so I could not run the check for recent base-branch commits touching the changed files. `mergeable` is true, so I did not read the base-tip files. ## 🟡 Suggestions - `review-bot/config_test.go`: `TestDefaultMCPToolsOnlyRead` accepts any name ending in `_read`. A tool like `commit_read` is read-only only if the server's methods all are. That is fine for now, but the test only proves the naming pattern, not read-only behaviour. - `kubernetes/apps/renovate/externalsecret.yaml`: a missing `apps/renovate/github` key would fail the whole ExternalSecret sync. That would also block rotation of the existing `RENOVATE_TOKEN` and `RENOVATE_HOST_RULES` values. The PR says the existing Secret keeps its old data, and the owner says the key exists now. It is worth confirming the key before merge. ## Tests `TestDefaultMCPToolsOnlyRead` is enough for the allowlist change, and CI passes. The ExternalSecret and prompt changes have no automated tests, which is normal for this repo. The PR says the Kubernetes render was checked with `kubectl kustomize`. ## Recommendation Looks reasonable — no blocking issues; comments above are optional. <!-- pr-review:sha=354d2b18d7faa38118a6c17ec08f2ec62ad06634 -->
k.renner merged commit 2161fda275 into main 2026-11-09 07:13:27 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1610