fix(#5731): use github-releases datasource for OpenShell

[fullsend-ai-coder]

Summary

Change the OpenShell custom manager datasource from github-tags to github-releases so Renovate only proposes updates for tags that have a published GitHub release. Several NVIDIA/OpenShell tags (e.g. v0.0.94, v0.0.93, v0.0.87) have no release, causing Renovate to suggest bumps to unpublished versions — PR #5597 is a live example.

Related Issue

Fixes #5731

Changes

• renovate.json: Change datasourceTemplate from "github-tags" to "github-releases" in the OpenShell custom manager
• .github/scripts/openshell-version.sh: Update the inline # renovate: annotation comment to match (datasource=github-releases)

Testing

• make lint passes (stage changes first, then run)
• Verified JSON is valid
• After merge, check the Renovate Dependency Dashboard — OpenShell should show v0.0.92 (latest release), not v0.0.94 (latest tag)

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• No secrets or sensitive data committed

---

Closes #5731

Post-script verification

• Branch is not main/master (agent/5731-openshell-datasource)
• Secret scan passed (gitleaks — e534f24afc2e47097de4d2f68ba2c5b6f1efdce3..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:21 AM UTC · Completed 6:32 AM UTC
Commit: 35e1e2b · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/scripts/openshell-version.sh — This PR modifies a file under the .github/ protected path. The change is authorized by issue fix(renovate): track OpenShell releases instead of tags #5731 and the rationale is clear (switching Renovate datasource from github-tags to github-releases to prevent proposing unreleased versions). Human approval is always required for protected-path changes, regardless of context.

---

Labels: PR modifies CI scripts (.github/scripts/) and dependency management config (renovate.json)

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:54 AM UTC · Completed 7:10 AM UTC
Commit: 35e1e2b · View workflow run →

[fullsend-ai-retro]

Retro: PR #5749 — use github-releases datasource for OpenShell

This workflow executed cleanly with no rework cycles. The code agent produced the correct fix on its first attempt, the review agent flagged the protected-path change appropriately, and the human approved and merged within 38 minutes of the /fs-code trigger.

Timeline

1. 2026-07-29 15:57 — Issue #5731 filed by rh-hemartin: change OpenShell Renovate datasource from github-tags to github-releases.
2. 2026-07-29 15:57–16:02 — Triage agent (run 30468399011) ran in ~5 min, correctly identified root cause, recommended exact fix, added ready-to-code.
3. 2026-07-30 06:13 — Human triggered /fs-code.
4. 2026-07-30 06:14–06:20 — Code agent (run 30518940639) ran in ~6 min, made the 2-file fix ($1.39, single commit).
5. 2026-07-30 06:20–06:32 — Review agent (run 30519251155) ran in ~12 min, flagged protected-path finding (informational), verdict: comment ($2.20).
6. 2026-07-30 06:41 — Human (rh-hemartin) approved.
7. 2026-07-30 06:51 — PR merged.

What went well

• Code agent quality: Excellent. After making the primary fix to renovate.json, the agent searched for related references and independently discovered the matching inline annotation in .github/scripts/openshell-version.sh, updating it for consistency. This followed the skill's guidance to search for old literal values when changing constants — a quality move that many agents would miss.
• Review agent calibration: Correctly classified the PR as trivial, set sub-agents to minimal scope (max 5 tool calls each), and all four review sub-agents made 0 tool calls — answering directly from injected context. Good efficiency for a 4-line mechanical change.
• Zero rework: First attempt was correct. No fix cycles needed.
• Triage accuracy: The triage agent's recommended fix exactly matched what the code agent implemented.

Evidence for existing issues (not filing new proposals)

• Review latency on trivial PRs (agents#301, fullsend#2639, fullsend#3240, fullsend#4060, agents#257): The review agent took 12 min and $2.20 for a 4-line config change. Although it correctly classified the PR as trivial and scoped sub-agents minimally, it still dispatched all 5 sub-agents (correctness, style, intent-coherence, security, challenger). All made 0 tool calls. This is further evidence that a lightweight path should skip sub-agent fan-out entirely for trivial/mechanical changes, which is exactly what agents#301 proposes.
• Output directory race condition (fullsend#3012): The review agent's transcript shows it attempted to write agent-result.json before the output directory existed, requiring a recovery mkdir -p and retry. This confirms the issue described in fullsend#3012.
• Autonomy readiness for config-only Renovate changes (fullsend#4795, fullsend#5118): The review agent's only finding was an informational protected-path flag on a comment-only annotation change in a CI script. The human approved without comments. This adds another data point to the autonomy evidence base for config-only Renovate PRs, consistent with the pattern documented in fullsend#4795 and fullsend#5118.

No new proposals

All improvement opportunities identified in this workflow are well-covered by existing open issues. The workflow was clean, efficient, and correct.