fix(renovate): group OpenShell base image and version pin updates

[rh-hemartin]

Summary

• Add Renovate groupName rule so the OpenShell base image digest and version pin update in a single PR instead of two

Closes #2692

Test plan

• Verify next Renovate run produces one combined openshell PR
• Close stale PR chore(deps): update ghcr.io/nvidia/openshell-community/sandboxes/base docker digest to aeef1c6 #2685 after merge

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Group OpenShell base image + version pin updates in Renovate
🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

Description

• Add a Renovate grouping rule so OpenShell-related updates land in one PR.
• Prevent separate PRs for the OpenShell base image digest and version pin.
• Reduce churn and ensure coordinated updates for the OpenShell sandbox stack.

Diagram

graph TD
  R["Renovate bot"] --> C["renovate.json"] --> G["Package rule: groupName=openshell"]
  G --> I["OpenShell base image"] --> P["Single grouped PR"]
  G --> V["OpenShell version pin"] --> P

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use matchPackagePatterns (regex) for OpenShell identifiers

• ➕ Less brittle if package names change slightly
• ➕ Easier to extend to additional OpenShell artifacts later
• ➖ Higher risk of accidentally grouping unrelated packages
• ➖ Harder to reason about what exactly matches

2. Scope the rule by manager/datasource (e.g., docker + github-releases)

• ➕ Avoids grouping across unrelated dependency sources
• ➕ More predictable Renovate behavior if OpenShell appears in multiple ecosystems
• ➖ Requires deeper knowledge of how Renovate detects each dependency here
• ➖ More configuration surface area than necessary for the current problem

Recommendation: The explicit matchPackageNames list with groupName="openshell" is the best fit here: it is precise, low-risk, and directly fixes the split-PR behavior without expanding Renovate scope. Consider regex or manager scoping only if additional OpenShell-related dependencies appear and need to be grouped.

Files changed (1) +8 / -0

Other (1) +8 / -0

renovate.jsonGroup OpenShell image + repo updates under a single Renovate group +8/-0

Group OpenShell image + repo updates under a single Renovate group

• Adds a new packageRules entry that matches the OpenShell base image and NVIDIA/OpenShell version pin. Sets groupName to "openshell" so Renovate opens one combined PR instead of separate updates.

renovate.json

[github-actions]

Site preview

Preview: https://81a67068-site.fullsend-ai.workers.dev

Commit: 7aff63c45963ab5c0055c9a4042b294aa614b6f8

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:34 PM UTC · Completed 2:40 PM UTC
Commit: 7aff63c · View workflow run →

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 Renovate creates separate PRs for OpenShell base image and version pin

✅ Compliance rules (platform): 51 rules

✅ Skills: writing-user-docs, writing-adrs

1. Grouped PR may automerge 🐞 Bug ☼ Reliability

Description

The new OpenShell grouping rule doesn’t override the repo’s global “automerge patch/pin” rule, so an
OpenShell version patch bump could make the grouped PR eligible for automerge even though it also
contains a base image digest change. This can reduce review control over sandbox base-image changes
if automerge is enabled for that branch.

Code

renovate.json[R20-25]

+      "description": "Group OpenShell base image and version pin into one PR",
+      "matchPackageNames": [
+        "ghcr.io/nvidia/openshell-community/sandboxes/base",
+        "NVIDIA/OpenShell"
+      ],
+      "groupName": "openshell"

Relevance

⭐⭐ Medium

Only evidence: PR2546 enabled patch/pin automerge; no history addressing grouped digest+pin PR
automerge risk.

PR-#2546

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The config enables automerge for all patch/pin updates globally, and the new rule groups the
OpenShell base image dependency with the OpenShell version pin dependency; the repo also pins both
values (version and image digest), making them Renovate-updated dependencies that can land together
in one PR.

renovate.json[4-26]
.github/scripts/openshell-version.sh[11-13]
images/sandbox/Containerfile[26-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A new Renovate `packageRules` entry groups the OpenShell base image digest and the OpenShell version pin into a single PR, but it does not explicitly opt out of the repository’s existing global automerge policy for `patch`/`pin` updates. If the OpenShell tag update is a `patch` update, that global rule can make the *grouped* PR eligible for automerge, which may unintentionally automerge a base image digest update.

## Issue Context
The repository has `automergeType` + `platformAutomerge` enabled and a global packageRule that automerges all `patch` and `pin` updates.

## Fix Focus Areas
- renovate.json[7-26]

### Suggested change
Add an explicit override in the OpenShell grouping rule, e.g.:
- `"automerge": false` (and optionally `"platformAutomerge": false`) inside the OpenShell group rule.

Alternative: narrow the global automerge rule so it excludes OpenShell (e.g., add a preceding/following packageRule matching `NVIDIA/OpenShell` and the base image that sets `automerge: false`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Looks good to me

---

Labels: PR modifies Renovate dependency configuration for the OpenShell sandbox base image grouping.

[maruiz93]

I looked into this and wanted to clarify my understanding: the groupName rule doesn't prevent Renovate from creating PRs when only one of the two packages has an update. If only the CLI version pin has a new release (which is the common case — it updates daily), Renovate will still create a PR for just that update. The grouping only kicks in when both the base image digest and the CLI version pin have updates available in the same Renovate cycle — in that case they'll land in a single PR instead of two separate ones.

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 10:37 AM UTC · Completed 10:44 AM UTC
Commit: 7aff63c · View workflow run →

[fullsend-ai-retro]

PR #2693 was a small, clean workflow: a single 8-line addition to renovate.json grouping two OpenShell dependencies under one Renovate PR. The fullsend review agent approved with no findings. Human reviewer maruiz93 also approved, adding a clarification about how Renovate groupName behaves. Zero rework, merged cleanly.

One signal worth noting: Qodo's review bot flagged that the new grouping rule inherits the repo's global automerge setting for patch/pin updates, meaning a base image digest change could automerge when grouped. The fullsend review agent did not surface this interaction. However, neither the human reviewer nor the PR author acted on Qodo's finding, so it is unclear whether this is a genuine gap or acceptable risk.

Existing issue #2749 (skip retro when review verdict is clean approval with no findings) would have prevented this retro from running, saving tokens on a low-signal workflow.

Proposals filed: 1 — Review agent should analyze dependency manager config rule interactions.

Proposals filed

• Review agent should analyze dependency manager config rule interactions (in fullsend-ai/fullsend)