ci(renovate): add custom manager to auto-bump tirith CLI version

[waynesun09]

Summary

• Add a Renovate custom regex manager to track the ARG TIRITH_VERSION= pin in images/sandbox/Containerfile against sheeki03/tirith GitHub releases
• Renovate will open a PR when a new tirith release is tagged, bumping the version number automatically
• SHA256 checksums (TIRITH_SHA256_{AMD64,ARM64}) must still be refreshed manually from the release's checksums.txt — the image build fails on checksum mismatch until they are

Test plan

• Verify renovate.json is valid JSON
• Confirm Renovate detects the new custom manager on the next dependency dashboard refresh
• Validate that the regex matches the existing ARG TIRITH_VERSION=0.3.1 line in the Containerfile

[qodo-code-review]

PR Summary by Qodo

Add Renovate regex manager to auto-bump tirith CLI version pin

⚙️ Configuration changes ✨ Enhancement 🕐 Less than 10 minutes

AI Description

• Add a Renovate custom regex manager to track TIRITH_VERSION in the sandbox Containerfile.
• Source version updates from sheeki03/tirith GitHub releases and open bump PRs automatically.
• Document that per-arch SHA256 pins still require manual refresh from release checksums.

Diagram

graph TD
  Renovate(["Renovate Bot"]) --> Config["renovate.json"] --> Regex["Custom regex manager"] --> CF["images/sandbox/Containerfile"]
  Regex --> GH{{"GitHub releases: sheeki03/tirith"}}
  subgraph Legend
    direction LR
    _svc(["Service"]) ~~~ _file["Config/File"] ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Move version pin into a dedicated versions file

• ➕ Makes regex matching more stable (no Containerfile syntax coupling)
• ➕ Allows co-locating version + checksums in one structured place
• ➖ Requires refactoring the image build to read the versions file
• ➖ Adds an extra artifact to maintain and document

2. Extend the custom manager to also bump SHA256 values

• ➕ Produces fully buildable PRs without manual checksum refresh
• ➕ Reduces CI breakage caused by version/checksum mismatch
• ➖ More complex parsing (checksums.txt format, per-arch selection)
• ➖ Higher risk of incorrect checksum updates if upstream formatting changes

3. Use github-tags datasource (if tags are the authoritative source)

• ➕ Simpler update signal if releases/tags ever diverge
• ➕ May avoid edge cases where a release is drafted but tag exists
• ➖ If releases are the intended contract, tags may include non-release tags
• ➖ May require extra filtering to avoid pre-releases

Recommendation: The current approach (regex manager + github-releases) is appropriate for minimizing build changes while enabling automated version bumps. If checksum-related CI failures become frequent, consider the follow-up improvement of also updating SHA256 pins (or moving pins into a dedicated versions file for easier automation).

Files changed (1) +11 / -0

Other (1) +11 / -0

renovate.jsonAdd regex manager to update sandbox tirith version pin +11/-0

Add regex manager to update sandbox tirith version pin

• Introduces a Renovate custom regex manager that extracts 'ARG TIRITH_VERSION=x.y.z' from 'images/sandbox/Containerfile' and tracks it against 'sheeki03/tirith' GitHub releases. Adds guidance that architecture-specific SHA256 pins must be manually refreshed from the upstream checksums file.

renovate.json

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:18 PM UTC · Ended 6:20 PM UTC
Commit: 7f3e2f5 · View workflow run →

[github-actions]

Site preview

Preview: https://7193df5f-site.fullsend-ai.workers.dev

Commit: 7ed3f298f14490b2043bb4216a7acd5c60aaf671

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 54 rules

✅ Skills: writing-user-docs, writing-adrs

1. Checksum pins left stale ✗ Dismissed 🐞 Bug ☼ Reliability

Description

The new Renovate regex manager updates only ARG TIRITH_VERSION in images/sandbox/Containerfile,
but the build verifies the downloaded tirith tarball with TIRITH_SHA256_{AMD64,ARM64}, so Renovate
PRs that bump the version will fail the image build until checksums are manually refreshed.

Code

renovate.json[R76-84]

+      "customType": "regex",
+      "description": "Track tirith CLI version pin in the sandbox image. TIRITH_SHA256_{AMD64,ARM64} must be refreshed manually from the release checksums.txt at https://github.com/sheeki03/tirith/releases — the image build fails on checksum mismatch until they are.",
+      "managerFilePatterns": ["/^images/sandbox/Containerfile$/"],
+      "matchStrings": [
+        "ARG TIRITH_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
+      ],
+      "depNameTemplate": "sheeki03/tirith",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"

Relevance

⭐⭐⭐ High

Team updates version+SHA pins together to keep image builds green; avoid Renovate PRs that
deterministically fail CI.

PR-#2085
PR-#1990
PR-#5057

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The Renovate manager matches and updates only the version line. The sandbox Containerfile verifies
the downloaded tarball’s SHA256 using the pinned TIRITH_SHA256_* ARGs, and CI builds the sandbox
image on PRs touching images/sandbox/**, so a version-only bump will cause a deterministic
checksum mismatch failure in CI.

renovate.json[75-85]
images/sandbox/Containerfile[133-150]
.github/workflows/sandbox-images.yml[1-72]
images/README.md[123-155]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A Renovate PR bumping only `TIRITH_VERSION` will break the sandbox image build because the Containerfile enforces `sha256sum -c` against `TIRITH_SHA256_{AMD64,ARM64}`.

## Issue Context
This PR adds a custom regex manager that matches only `ARG TIRITH_VERSION=...` and uses `github-releases` as the datasource.

## Fix Focus Areas
- renovate.json[75-85]

## Suggested fix
Choose one of the following (in Renovate config):
1. **Gate PR creation** for this dependency (e.g., require Dependency Dashboard approval) so Renovate doesn’t open an immediately-failing PR until a maintainer is ready to update checksums.
2. **Mark PRs as draft** and add a label (e.g., `needs-checksums`) for this custom manager via a `packageRules` entry matching `sheeki03/tirith`.
3. If your workflow supports it, **disable/skip the sandbox image build job** for Renovate PRs affecting only `TIRITH_VERSION` (less ideal because it weakens the supply-chain check).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:22 PM UTC · Completed 6:33 PM UTC
Commit: c0ba383 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Looks good to me

Previous run

Looks good to me

---

Labels: PR adds Renovate custom manager targeting the sandbox image Containerfile for tirith dependency tracking

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:42 PM UTC · Completed 4:50 PM UTC
Commit: 7ed3f29 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 4:53 PM UTC · Completed 5:04 PM UTC
Commit: 7ed3f29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #5374 -- ci(renovate): add custom manager to auto-bump tirith CLI version

This was a clean, human-authored, 16-line config-only change to renovate.json that added a Renovate custom regex manager for tirith CLI version tracking. The workflow functioned well overall, and no new proposals are warranted -- all improvement opportunities are covered by existing issues.

Timeline: PR created 2026-07-20T18:17Z. Review run 1 (29767138798) cancelled after ~3 min (superseded). Review run 2 (29767330365) approved in ~13 min with "Looks good to me" -- no findings above info severity. Human rh-hemartin approved ~13 hours later with no comments. Author force-pushed (rebase) at 16:40 UTC on 7/21, triggering review run 3 (29849702848), which detected the prior LGTM but re-evaluated because "69 commits since prior review." Same approve verdict, ~9.5 min. PR merged 3 seconds after the final agent approval.

Review quality: Good. The review agent correctly approved a straightforward config change. Notably, it avoided the false positive that Qodo raised ("Checksum pins left stale"), which the PR author explained was intentional design -- the same pattern used by the existing gcloud CLI manager, with automerge: false and deterministic CI failure as dual safety barriers. The fullsend agent's severity filtering correctly kept this at info level.

Evidence for existing issues (not filing new proposals):

• Skip or diff-gate re-review when PR changes are rebase-only #1287 / Skip re-review when PR diff is unchanged after rebase/reopen #1356 / Review agent should detect rebase-only force-pushes and skip re-review when the effective diff is unchanged #4401 / Skip redundant re-reviews when Renovate rebases a dependency PR without changing the diff #4652 (diff-based rebase dedup): Review run 3 re-evaluated the identical diff after a rebase. The agent's log shows it detected the prior review (SHA c0ba383, provenance app-verified, LGTM with no findings) but chose to re-evaluate because "69 commits since prior review -- renovate.json is in the changed set." Those 69 commits were on the base branch, not the PR branch -- the effective diff was unchanged. A diff-content comparison would have saved ~9.5 min of agent compute.

• Track autonomy readiness: review agent fully covered human review on config-only Renovate PR #1116 #4795 (config-only Renovate PR autonomy): This PR adds another data point -- the review agent's approval fully covered human review. The human reviewer (rh-hemartin) rubber-stamped with no comments, adding 13 hours of latency with no quality gain. The agent's dimensional analysis (correctness, security, metadata, protected paths) was strictly more thorough.

• Extend retro skip guard to human-authored PRs with no-finding reviews #1675 (extend retro skip to human-authored PRs with no-finding reviews): This retro itself illustrates the issue -- the review agent cleanly approved with zero findings, no fix cycles occurred, and no human-agent disagreements surfaced. The retro produces no new proposals, supporting the case for skipping retro on PRs matching this profile.

• Debounce review agent runs on rapid force-pushes to reduce token waste #4960 (debounce review runs): Review run 1 was cancelled after ~3 min, superseded by run 2 dispatched 3 minutes later. Minor token waste from the cancelled run.