From f44b0fe4cc3854c6d09cc9138c95b7728e72c556 Mon Sep 17 00:00:00 2001 From: Wikid82 Date: Mon, 7 Sep 2026 15:25:31 -0400 Subject: [PATCH 1/2] ci: release on dependency bumps via deps: prefix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release-please cuts a release only for feat/fix/perf/deps/breaking commits, so the recent run of chore(deps) bumps landed without a new version. - .github/renovate.json: semanticCommitType "deps" (scope dropped) so dependency PRs merge as "deps: ...", a release-triggering prefix. Two carve-out packageRules force CI-only tooling back to chore: — the github-actions manager, and custom.regex trackers under .github/workflows, scripts, and .github/skills (golangci-lint, gotestsum, govulncheck, gopls, Syft, Grype, Semgrep image, CodeQL CLI, NODE_VERSION/GO_VERSION). Dependencies that ship in the container still cut a patch release. - CLAUDE.md: document the deps: convention and the CI-tooling carve-out. release-please-config.json is left as-is: skip-changelog is set, so a changelog-sections block would be inert, and deps: is release-triggering by default without it. --- .github/renovate.json | 21 +++++++++++++++++++++ CLAUDE.md | 3 ++- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/.github/renovate.json b/.github/renovate.json index a36218ea1..12df0cdf9 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -9,6 +9,8 @@ "baseBranchPatterns": [ "development" ], + "semanticCommitType": "deps", + "semanticCommitScope": null, "postUpdateOptions": [ "npmDedupe", "gomodTidy" @@ -473,6 +475,25 @@ ] }, "packageRules": [ + { + "description": "Release gating: bumps default to deps: (a release-triggering prefix for release-please) so a dependency that ships in the container cuts a patch release. CI-only tooling — GitHub Actions pins, and custom.regex trackers under .github/workflows, scripts, and .github/skills (golangci-lint, gotestsum, govulncheck, gopls, Syft, Grype, Semgrep image, CodeQL CLI, NODE_VERSION/GO_VERSION) — does not ship, so force it back to chore: (non-releasable).", + "matchManagers": [ + "github-actions" + ], + "semanticCommitType": "chore" + }, + { + "description": "See above: CI-only custom.regex trackers stay chore:, not deps:.", + "matchManagers": [ + "custom.regex" + ], + "matchFileNames": [ + ".github/workflows/**", + "scripts/**", + ".github/skills/**" + ], + "semanticCommitType": "chore" + }, { "description": "Group GitHub Actions non-major updates into one PR", "matchManagers": [ diff --git a/CLAUDE.md b/CLAUDE.md index 517d229d9..0029d8185 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -11,7 +11,7 @@ Every session should improve the codebase, not just add to it. Actively refactor - **CLEAN**: Delete dead code immediately. Remove unused imports, variables, functions, types, commented code, and console logs. - **LEVERAGE**: Use battle-tested packages over custom implementations. - **READABLE**: Maintain comments and clear naming for complex logic. Favor clarity over cleverness. -- **CONVENTIONAL COMMITS**: Write commit messages using `feat:`, `fix:`, `chore:`, `refactor:`, or `docs:` prefixes. +- **CONVENTIONAL COMMITS**: Write commit messages using `feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, or `deps:` prefixes. - **`(security)` SCOPE**: For genuinely security-relevant `feat`/`fix` commits (real vulnerability fixes, new protective mechanisms — not general bug fixes), use `feat(security): ` or `fix(security): `. This scope feeds a dedicated "Security" category in the What's New changelog, so it's reserved for real security work — overusing it for visibility on ordinary fixes dilutes the category's signal. **Vague by default**: the subject line must describe the *category* of issue and mitigation in general terms, and must NEVER reveal the specific vulnerability class, attack vector, or exact vulnerable code path — the changelog displays it verbatim to every self-hosted user, including ones running un-upgraded, still-vulnerable instances. Good: `fix(security): harden input validation in the API layer`. Bad: `fix(security): fix SQL injection in host search filter`. ## Governance & Precedence @@ -134,6 +134,7 @@ never affected by this. ## CI/CD & Commit Conventions - **Triggers**: Use `feat:`, `fix:`, or `perf:` to trigger Docker builds. `chore:` skips builds. +- **Dependency bumps**: Renovate emits `deps:` (`.github/renovate.json` → `semanticCommitType: deps`, scope dropped). `deps:` is a release-triggering prefix for release-please, so a bump of anything that ships in the container cuts a patch release. CI-only tooling — GitHub Actions pins and the `custom.regex` trackers under `.github/workflows`, `scripts`, and `.github/skills` (golangci-lint, gotestsum, govulncheck, gopls, Syft, Grype, Semgrep image, CodeQL CLI, `NODE_VERSION`/`GO_VERSION`) — is forced back to `chore:` by packageRules so it doesn't cut a release. - **Beta**: `feature/beta-release` always builds. - **Weekly Promotion PRs** (`nightly → main`): ALWAYS merge using **"Create a merge commit"** — NEVER squash or rebase. Squash merging collapses all commits into bullet lines that the `auto-versioning` workflow cannot parse, silently preventing minor version bumps and producing empty release notes. - **History-Rewrite PRs**: If a PR touches files in `scripts/history-rewrite/` or `docs/plans/history_rewrite.md`, the PR description MUST include the history-rewrite checklist from `.github/PULL_REQUEST_TEMPLATE/history-rewrite.md`. From 83ad03997e9858119a4af0a75f9413ffa67b44d5 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 20:05:40 +0000 Subject: [PATCH 2/2] chore(main): release 0.39.0 --- .release-please-manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index bc86e4a2f..418b49e99 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.38.0" + ".": "0.39.0" }