chore(deps): update dependency dotnet.reproduciblebuilds to v2 by renovate[bot] · Pull Request #883 · rjmurillo/moq.analyzers

renovate · 2026-01-22T00:35:04Z

This PR contains the following updates:

Package	Change	Age	Confidence
DotNet.ReproducibleBuilds	`1.2.39` → `2.0.2`

Release Notes

dotnet/reproducible-builds (DotNet.ReproducibleBuilds)

`v2.0.2`

What's Changed

Fix hostfxr probing path for musl-based runtimes by @MattKotsenas in #75

Full Changelog: dotnet/reproducible-builds@v2.0.1...v2.0.2

`v2.0.1`

What's Changed

Warn if missing global.json to enforce consistent SDK versions by @MattKotsenas in #73

Full Changelog: dotnet/reproducible-builds@v1.2.39...v2.0.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-01-22T00:35:11Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

deepsource-io · 2026-01-22T00:35:32Z

DeepSource Code Review

DeepSource reviewed changes in the commit range 894313b...b673c8f on this pull request. Below is the summary for the review, and you can see the individual issues we found as review comments.

For detailed review results, please see the PR on DeepSource ↗

PR Report Card

Security	× 0 issues	Overall PR Quality
Reliability	× 0 issues
Complexity	× 0 issues
Hygiene	× 0 issues

Code Review Summary

Analyzer	Status	Summary	Details
C#		No new issues detected.	Review ↗

How are these analyzer statuses calculated?

Administrators can configure which issue categories are reported and cause analysis to be marked as failed when detected. This helps prevent bad and insecure code from being introduced in the codebase. If you're an administrator, you can modify this in the repository's settings.

diffray · 2026-01-22T00:36:22Z

Changes Summary

This PR updates the DotNet.ReproducibleBuilds package from version 1.2.39 to 2.0.1, a major version upgrade. This package is used to ensure deterministic and reproducible builds in the .NET project. The major version bump may include breaking changes or new build behavior that should be validated.

Type: config

Components Affected: build-system, reproducible-builds

Files Changed

File	Summary	Change	Impact
`...space/build/targets/reproducible/Packages.props`	Updated DotNet.ReproducibleBuilds package version from 1.2.39 to 2.0.1	✏️	🟡

Architecture Impact

Dependencies: updated: DotNet.ReproducibleBuilds from 1.2.39 to 2.0.1

Risk Areas: Build determinism and reproducibility may be affected by v2 changes, Major version upgrades typically include breaking changes or behavior modifications, Build outputs, hashing, or artifact generation could change

Suggestions

Verify that builds remain reproducible after the upgrade by comparing build outputs
Check the DotNet.ReproducibleBuilds v2 changelog for any breaking changes or new configuration requirements
Ensure CI/CD pipelines complete successfully with the new version
Validate that build artifacts maintain expected properties (source link, deterministic compilation, etc.)

🔗 See progress

_{Full review in progress... | Powered by diffray}

codacy-production · 2026-01-22T00:38:22Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.00% (target: -1.00%)	✅ ∅ (target: 95.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`894313b`)	2056	1831	89.06%
Head commit (`b673c8f`)	2056 (+0)	1831 (+0)	89.06% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#883)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

diffray · 2026-01-22T00:38:53Z

Review Summary

Validated 2 issues: 1 kept, 1 filtered (low confidence - common valid pattern)

Issues Found: 1

📋 Full issue list (click to expand)

🟡 MEDIUM - Duplicate CI/CD workflows for dependabot/renovate automation

Agent: architecture

Category: quality

Why this matters: Script duplication causes maintenance burden and sync errors. When one script is updated, developers must remember to update all variants, leading to inconsistencies and bugs.

File: .github/workflows/dependabot-approve-and-auto-merge.yml:1-33

Description: Four nearly-identical GitHub Actions workflows exist for approving and auto-merging dependency bot PRs. These workflows have significant overlap in functionality, duplicating logic across 95 total lines of YAML when a single parameterized workflow could handle all cases.

Suggestion: Consolidate these four workflows into a single reusable workflow that accepts parameters for bot name filtering, approval strategy, and merge conditions. Use workflow_call with inputs to parameterize the bot actor check, approval method, and merge strategy.

Confidence: 70%

Rule: cicd_parameterize_scripts

ℹ️ 1 issue(s) outside PR diff (click to expand)

These issues were found in lines not modified in this PR.

🟡 MEDIUM - Duplicate CI/CD workflows for dependabot/renovate automation

Agent: architecture

Category: quality

Why this matters: Script duplication causes maintenance burden and sync errors. When one script is updated, developers must remember to update all variants, leading to inconsistencies and bugs.

File: .github/workflows/dependabot-approve-and-auto-merge.yml:1-33

Description: Four nearly-identical GitHub Actions workflows exist for approving and auto-merging dependency bot PRs. These workflows have significant overlap in functionality, duplicating logic across 95 total lines of YAML when a single parameterized workflow could handle all cases.

Suggestion: Consolidate these four workflows into a single reusable workflow that accepts parameters for bot name filtering, approval strategy, and merge conditions. Use workflow_call with inputs to parameterize the bot actor check, approval method, and merge strategy.

Confidence: 70%

Rule: cicd_parameterize_scripts

🔗 View full review details

_{Review ID: c05678f5-b64e-473f-91bd-6c05cc2ad372}
_{Rate it 👍 or 👎 to improve future reviews | Powered by diffray}

rjmurillo

DotNet.ReproducibleBuilds 1.2.39 to 2.0.2: major version bump. Only breaking change is new RPB0003 warning when global.json is missing, which does not apply (project has global.json with pinned SDK version). All CI checks pass.

…v2 (#884) DotNet.ReproducibleBuilds.Isolated 1.2.39 to 2.0.2. Companion to #883. All CI checks pass.

…915) ## Summary - Disable dependabot for NuGet, consolidate to renovate-only - Consolidate 4 overlapping auto-approve/merge workflows into 1 - Update renovate.json with proper package grouping and exclusion rules - Add `docs/dependency-management.md` documenting package categories and upgrade policies ## Problem Both dependabot and renovate created duplicate PRs for every NuGet update. Dependabot NuGet PRs used "Bump X from A to B" titles that failed the required "Validate PR title" check (conventional commits required), so they could never auto-merge. Four overlapping auto-approve/merge workflows competed with each other, one of which had a broken step referencing a nonexistent step output (`steps.cpr.outputs`). ## Changes ### Dependabot config (`.github/dependabot.yml`) Removed the `nuget` ecosystem. Retained `github-actions` ecosystem (dependabot's fetch-metadata action provides update-type classification for major version gating). ### Workflow consolidation Deleted 3 workflows, kept and expanded 1: - **Deleted:** `auto-approve-and-merge-renovate.yml`, `dependabot-auto-approve.yml`, `dependabot-auto-merge.yml` - **Kept:** `dependabot-approve-and-auto-merge.yml` with separate jobs for dependabot and renovate ### Renovate config (`renovate.json`) - Added `ignoreDeps` for `Microsoft.CodeAnalysis.*` core packages (same policy as former dependabot ignore list) - Grouped `BenchmarkDotNet` + `Perfolizer` as `benchmark-tooling` with `automerge: false` (coordinated updates required due to transitive dependency constraints) - Disabled `System.CommandLine` and `System.CommandLine.Rendering` updates until PerfDiff rewrite (#914) ### Documentation New `docs/dependency-management.md` covers: - Package categories (shipped, build-time, test, benchmark, tools, infrastructure) - Upgrade policies per category - The VersionOverride pattern for non-shipped projects - Lessons from the CS8032/SCI incident (#850) ## Bot PR cleanup performed | Action | PRs | |--------|-----| | Closed (dependabot duplicates) | #903, #902, #890, #880, #909 | | Closed (superseded) | #877 (Meziantou 2.0.302, superseded by 3.x) | | Closed (build failures) | #834 (BenchmarkDotNet), #832 (Perfolizer) | | Closed (PerfDiff breakage) | #821 (dotnet monorepo) | | Merged | #878, #882, #881, #879, #883, #884 | ## Validation - `dotnet build /p:PedanticMode=true`: 0 warnings, 0 errors - `dotnet format`: no changes needed - Tests cannot run locally (machine has .NET 10 only, test TFM is net8.0); CI will validate ## Test plan - [ ] CI build passes - [ ] All tests pass - [ ] No new bot PRs from dependabot for NuGet packages - [ ] Renovate correctly picks up future dependency updates - [ ] Auto-approve/merge workflow fires for new renovate PRs 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Chores** * Consolidated dependency-update process: moved NuGet management to Renovate, removed several automated auto-approve/auto-merge workflows for bot PRs, and adjusted automerge/approval behavior and rules. * Renovate configuration updated with new groups, ignore lists, and automerge adjustments. * **Documentation** * Added a dependency management guide detailing categories, upgrade policies, configuration patterns, and workflow recommendations.  --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

renovate bot requested a review from rjmurillo as a code owner January 22, 2026 00:35

diffray bot added the diffray-review-started diffray review status: started label Jan 22, 2026

traycerai bot mentioned this pull request Jan 22, 2026

Dependency Dashboard #477

Open

2 tasks

diffray bot added diffray-review-completed diffray review status: completed and removed diffray-review-started diffray review status: started labels Jan 22, 2026

renovate bot force-pushed the renovate/dotnet.reproduciblebuilds-2.x branch from 9d4ba72 to 87c0296 Compare January 27, 2026 21:53

renovate bot force-pushed the renovate/dotnet.reproduciblebuilds-2.x branch 10 times, most recently from fbe359a to 5a94570 Compare February 19, 2026 02:51

chore(deps): update dependency dotnet.reproduciblebuilds to v2

b673c8f

renovate bot force-pushed the renovate/dotnet.reproduciblebuilds-2.x branch from 5a94570 to b673c8f Compare February 20, 2026 21:15

rjmurillo approved these changes Feb 21, 2026

View reviewed changes

rjmurillo merged commit 3108914 into main Feb 21, 2026
32 of 35 checks passed

rjmurillo deleted the renovate/dotnet.reproduciblebuilds-2.x branch February 21, 2026 01:28

rjmurillo mentioned this pull request Feb 21, 2026

chore(deps): update dependency dotnet.reproduciblebuilds.isolated to v2 #884

Merged

1 task

rjmurillo pushed a commit that referenced this pull request Feb 21, 2026

chore(deps): update dependency dotnet.reproduciblebuilds.isolated to …

c8adddb

…v2 (#884) DotNet.ReproducibleBuilds.Isolated 1.2.39 to 2.0.2. Companion to #883. All CI checks pass.

rjmurillo mentioned this pull request Feb 21, 2026

chore: consolidate dependency management workflows and documentation #915

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency dotnet.reproduciblebuilds to v2#883

chore(deps): update dependency dotnet.reproduciblebuilds to v2#883
rjmurillo merged 1 commit intomainfrom
renovate/dotnet.reproduciblebuilds-2.x

renovate bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 22, 2026 •

edited

Loading

Review skipped

Uh oh!

deepsource-io bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

diffray bot commented Jan 22, 2026

Uh oh!

codacy-production bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

diffray bot commented Jan 22, 2026

🟡 MEDIUM - Duplicate CI/CD workflows for dependabot/renovate automation

🟡 MEDIUM - Duplicate CI/CD workflows for dependabot/renovate automation

Uh oh!

rjmurillo left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.0.2

What's Changed

v2.0.1

What's Changed

Configuration

Uh oh!

coderabbitai bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

deepsource-io bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

diffray bot commented Jan 22, 2026

Changes Summary

Uh oh!

codacy-production bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

Uh oh!

diffray bot commented Jan 22, 2026

Review Summary

Issues Found: 1

🟡 MEDIUM - Duplicate CI/CD workflows for dependabot/renovate automation

🟡 MEDIUM - Duplicate CI/CD workflows for dependabot/renovate automation

Uh oh!

rjmurillo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Jan 22, 2026 •

edited

Loading

`v2.0.2`

`v2.0.1`

coderabbitai bot commented Jan 22, 2026 •

edited

Loading

deepsource-io bot commented Jan 22, 2026 •

edited

Loading

codacy-production bot commented Jan 22, 2026 •

edited

Loading