Replace renovate agent digest tracking with sync workflow

[ggallen]

Summary

• Adds a scheduled workflow (sync-agent-digests.yml) that updates fullsend-ai/agents commit digests and sha256 content hashes across all fullsend-ai repos — both the per-org config (config.yaml) and per-repo installs (.fullsend/config.yaml in experiments, metrics, agents, fullsend)
• Replaces the Renovate custom regex manager, which only covered .fullsend itself — the migrated per-repo repos had no digest tracking and were already drifting
• Uses the new fullsend-ai-sync GitHub App (bypass actor on all repo rulesets) to push directly
• Runs twice daily on schedule, also supports repository_dispatch and manual workflow_dispatch
• Updates hack/update-agent-hashes.sh to accept an optional config file path argument
• Strips the agent-specific customManagers, packageRules, and RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS from renovate config (Renovate remains for standard dep tracking via config:recommended)

Prerequisites

• fullsend-ai-sync GitHub App created and installed org-wide
• App added as bypass actor on fullsend, agents, experiments rulesets
• Ruleset created on metrics with App as bypass actor
• SYNC_APP_ID variable set on this repo
• SYNC_PRIVATE_KEY secret set on this repo

Test plan

• Verify SYNC_APP_ID and SYNC_PRIVATE_KEY are configured
• Trigger workflow manually via workflow_dispatch
• Confirm .fullsend/config.yaml in experiments, metrics, agents all converge to the same agents commit
• Confirm config.yaml in .fullsend also updates
• Verify renovate still runs for standard deps (no regression from removing the custom manager)

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Synchronize agent digests across fullsend-ai repositories

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Synchronizes agent digests and content hashes across organization and repository configurations.
• Uses a scheduled GitHub App workflow with manual and event-driven triggers.
• Retains Renovate only for standard dependency updates.

Diagram

graph TD
  A["Workflow Triggers"] -->|starts| B["Sync Workflow"] -->|creates| C["App Token"] -->|reads SHA| D["Agents API"]
  B -->|runs| E["Hash Updater"] -->|rewrites| F["Org Config"]
  E -->|rewrites| G["Repo Configs"]
  C -.->|authorizes push| F
  C -.->|authorizes pushes| G

Loading

High-Level Assessment

The centralized GitHub App workflow is the best fit for keeping a small, known repository set synchronized. Retaining Renovate would preserve its limited single-repository coverage, while separate workflows in every repository would duplicate logic and credentials; both were appropriately avoided.

Files changed (4) +103 / -30

Enhancement (1) +3 / -3

update-agent-hashes.shSupport updating an explicitly selected configuration file +3/-3

Support updating an explicitly selected configuration file

• Adds an optional configuration path argument while preserving config.yaml as the default. It also validates that the selected file exists before rewriting agent URLs and content hashes.

hack/update-agent-hashes.sh

Other (3) +100 / -27

renovate.ymlRemove agent hash post-upgrade command permission +0/-1

Remove agent hash post-upgrade command permission

• Removes the environment allowlist for the agent hash-update script because Renovate no longer manages agent digests. Standard Renovate dependency processing remains unchanged.

.github/workflows/renovate.yml

sync-agent-digests.ymlAdd organization-wide agent digest synchronization workflow +99/-0

Add organization-wide agent digest synchronization workflow

• Adds twice-daily, event-driven, and manual synchronization of the latest agents commit across the organization config and four per-repository installations. The workflow uses a GitHub App token to recalculate hashes, commit changes, and push through repository rulesets.

.github/workflows/sync-agent-digests.yml

renovate.jsonRemove custom agent digest management +1/-26

Remove custom agent digest management

• Removes the agents regex manager, automerge rule, and post-upgrade task. Renovate now uses only its recommended configuration for standard dependencies.

renovate.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (3) 📘 Rule violations (0) 📜 Skill insights (0)

1. Presence check skips stale entries 🐞 Bug ≡ Correctness

Description

The grep -q "$NEW_SHA" guards skip an entire configuration when any one occurrence matches,
leaving other agent entries on older commits in mixed configurations. They also skip recalculating
incorrect sha256 values when the source SHA is already current, despite hash synchronization being a
stated responsibility of the workflow.

Code

.github/workflows/sync-agent-digests.yml[R52-54]

+          if grep -q "$NEW_SHA" config.yaml; then
+            echo "Already at $NEW_SHA"
+            exit 0

Relevance

●●● Strong

A broad grep guard can skip independent entries and stale hashes; this is a localized deterministic
correctness fix.

PR-#167

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Both guards only establish that the new SHA occurs somewhere. The config contains multiple
independent fullsend-ai/agents sources, while the updater would replace every old digest and fetch
each referenced harness to recalculate its hash if the guards did not bypass it.

.github/workflows/sync-agent-digests.yml[52-56]
.github/workflows/sync-agent-digests.yml[84-90]
config.yaml[33-40]
hack/update-agent-hashes.sh[14-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A single matching commit substring causes the workflow to treat the whole configuration as synchronized, even when other entries or content hashes remain stale.

## Issue Context
The updater already rewrites all matching agent sources and recalculates their content hashes. Invoke it unconditionally, then use `git diff --quiet` to decide whether a commit is needed, or implement complete per-entry digest and hash validation before skipping.

## Fix Focus Areas
- .github/workflows/sync-agent-digests.yml[52-62]
- .github/workflows/sync-agent-digests.yml[84-96]
- hack/update-agent-hashes.sh[14-26]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Manual sync targets wrong branch 🐞 Bug ≡ Correctness

Description

The checkout inherits the ref selected for workflow_dispatch, and the subsequent bare git push
sends the .fullsend commit to that branch rather than necessarily updating main. A manual run
from a tag can instead leave checkout detached and make the push fail.

Code

.github/workflows/sync-agent-digests.yml[29]

+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

Relevance

●● Moderate

Checkout-ref correctness concerns are accepted historically, but no close manual-dispatch push
precedent exists.

PR-#167

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow exposes unrestricted manual dispatch, checks out without a ref, then replaces
origin and performs a bare push. Therefore the selected dispatch ref, rather than the intended
default branch, controls where the per-org commit is sent.

.github/workflows/sync-agent-digests.yml[15-20]
.github/workflows/sync-agent-digests.yml[29-29]
.github/workflows/sync-agent-digests.yml[59-62]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Manual dispatches inherit the selected Git ref, so the per-org configuration can be pushed to the wrong branch or fail from a detached tag checkout.

## Issue Context
The workflow changes `origin` to the `.fullsend` repository and uses a bare `git push`, making the checked-out ref determine the destination. Force the source checkout to `main` and preferably use an explicit `HEAD:main` push refspec.

## Fix Focus Areas
- .github/workflows/sync-agent-digests.yml[29-29]
- .github/workflows/sync-agent-digests.yml[59-62]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Concurrent syncs race pushes 🐞 Bug ☼ Reliability

Description

Scheduled, repository-dispatch, and manual runs can overlap without concurrency serialization,
causing two jobs cloned from the same branch state to race their direct pushes. One push will then
be rejected as non-fast-forward, failing that run and potentially stopping its remaining repository
updates.

Code

.github/workflows/sync-agent-digests.yml[R18-20]

+  repository_dispatch:
+    types: [agents-updated]
+  workflow_dispatch: {}

Relevance

●●● Strong

Direct push race is a concrete reliability bug; analogous workflow serialization supports accepting
this fix.

PR-#167

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow defines three independent trigger paths but no concurrency group, and every run
directly pushes to .fullsend followed by four target repositories. The existing maintenance
workflow serializes analogous automation using a concurrency group with cancellation disabled.

.github/workflows/sync-agent-digests.yml[15-27]
.github/workflows/sync-agent-digests.yml[59-62]
.github/workflows/sync-agent-digests.yml[70-96]
.github/workflows/repo-maintenance.yml[12-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Independent workflow triggers can overlap and race while directly committing and pushing to the same branches.

## Issue Context
Add a workflow concurrency group with `cancel-in-progress: false` so later runs queue rather than canceling a run midway through its repository loop. This repository already applies that pattern to its maintenance workflow.

## Fix Focus Areas
- .github/workflows/sync-agent-digests.yml[15-27]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 4 rules

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗