The review-bot review of konairius/ical-proxy#22 (golang/alpine digests,
kaniko v1.25.20 -> v1.25.21) restated the diff and listed "digests and CI
not checked" as unverified. Three causes:
- Renovate wrote no release notes: it has no github.com token ("No
github.com token has been configured. Skipping release notes retrieval",
job renovate-29903220). The ExternalSecret now renders
RENOVATE_GITHUB_COM_TOKEN (the current name; GITHUB_COM_TOKEN is
deprecated) from its own OpenBao key apps/renovate/github, field `token`.
No other service reads that key.
- defaultMCPTools still named per-method tools that gitea-mcp 1.13 folded
into commit_read, branch_read, tag_read and release_read. tools/list on
gitea-mcp.renner.uno has none of get_commit, list_commits,
compare_commits, list_branches, get_tag, list_tags, get_release,
get_latest_release, list_releases, so 9 of the 20 enabled names matched
nothing and the prompt's compare_commits/list_commits steps had no tool.
The list now has the 1.13 names; a test keeps it read-only.
- prompt.md had no guidance for dependency updates. New "Dependency
updates" section: release notes between old and new version, the repo's
use of what they change (path:line), one line for digest-only rebuilds,
no unverified boilerplate. New mandatory check: CI status of the head
(pull_request_read get_status; Woodpecker reports commit statuses).
hermes-bot