From 991d8b986e7f1f6777b63c65b6048ae5c5101bbc Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 16:19:22 +1000 Subject: [PATCH 1/2] chore(conductor): initialize track 'renovate-codecov-verification_20260801' --- conductor/index.md | 1 + conductor/tracks.md | 5 +++- .../design.md | 12 +++++++++ .../index.md | 7 +++++ .../metadata.json | 10 +++++++ .../plan.md | 18 +++++++++++++ .../requirements.md | 19 +++++++++++++ .../spec.md | 27 +++++++++++++++++++ 8 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 conductor/tracks/renovate-codecov-verification_20260801/design.md create mode 100644 conductor/tracks/renovate-codecov-verification_20260801/index.md create mode 100644 conductor/tracks/renovate-codecov-verification_20260801/metadata.json create mode 100644 conductor/tracks/renovate-codecov-verification_20260801/plan.md create mode 100644 conductor/tracks/renovate-codecov-verification_20260801/requirements.md create mode 100644 conductor/tracks/renovate-codecov-verification_20260801/spec.md diff --git a/conductor/index.md b/conductor/index.md index cf3b661..4248c71 100644 --- a/conductor/index.md +++ b/conductor/index.md @@ -19,6 +19,7 @@ than guessing paths. - [Roadmap](./roadmap.md) - [Tracks Registry](./tracks.md) +- [Active Renovate and Codecov Track](./tracks/renovate-codecov-verification_20260801/index.md) - [Archived Security and Quality Track](./tracks/archive/post-release-security-quality-frontier_20260801/index.md) - [Released Bleeding-Edge Track](./tracks/archive/bleeding-edge-agent-skills-conductor_20260731/index.md) - [GitHub Issue Mapping](./github-mapping.json) diff --git a/conductor/tracks.md b/conductor/tracks.md index a3f1830..4891c1a 100644 --- a/conductor/tracks.md +++ b/conductor/tracks.md @@ -8,7 +8,10 @@ This file tracks all major tracks for the project. Each track has its own detail ## Active Tracks -No active tracks. +- [ ] **renovate-codecov-verification_20260801** (P1) - Verify shared Renovate + onboarding and Codecov OIDC without removing repository-controlled + fallbacks. See + [`tracks/renovate-codecov-verification_20260801/`](./tracks/renovate-codecov-verification_20260801/index.md). --- diff --git a/conductor/tracks/renovate-codecov-verification_20260801/design.md b/conductor/tracks/renovate-codecov-verification_20260801/design.md new file mode 100644 index 0000000..689f71a --- /dev/null +++ b/conductor/tracks/renovate-codecov-verification_20260801/design.md @@ -0,0 +1,12 @@ +# Design: Renovate and Codecov Verification + +```mermaid +flowchart LR + P["Shared Renovate preset"] --> R["Renovate GitHub App"] + R --> V{"Hosted run verified?"} + V -->|No| D["Retain Dependabot"] + V -->|Yes| C["Remove competing bot in later evidence commit"] + T["Native coverage thresholds"] --> L["LCOV and JSON"] + L --> A["CI artifact"] + L --> O["Codecov v5 with OIDC"] +``` diff --git a/conductor/tracks/renovate-codecov-verification_20260801/index.md b/conductor/tracks/renovate-codecov-verification_20260801/index.md new file mode 100644 index 0000000..ff044d9 --- /dev/null +++ b/conductor/tracks/renovate-codecov-verification_20260801/index.md @@ -0,0 +1,7 @@ +# Renovate and Codecov Verification + +- [Specification](./spec.md) +- [MoSCoW requirements](./requirements.md) +- [Design](./design.md) +- [Plan](./plan.md) +- [Metadata](./metadata.json) diff --git a/conductor/tracks/renovate-codecov-verification_20260801/metadata.json b/conductor/tracks/renovate-codecov-verification_20260801/metadata.json new file mode 100644 index 0000000..1ea9c6d --- /dev/null +++ b/conductor/tracks/renovate-codecov-verification_20260801/metadata.json @@ -0,0 +1,10 @@ +{ + "track_id": "renovate-codecov-verification_20260801", + "title": "Renovate and Codecov Verification", + "type": "maintenance", + "priority": "P1", + "status": "new", + "created_at": "2026-08-01", + "updated_at": "2026-08-01", + "current_phase": "Phase 1: Repository integration" +} diff --git a/conductor/tracks/renovate-codecov-verification_20260801/plan.md b/conductor/tracks/renovate-codecov-verification_20260801/plan.md new file mode 100644 index 0000000..e0f1033 --- /dev/null +++ b/conductor/tracks/renovate-codecov-verification_20260801/plan.md @@ -0,0 +1,18 @@ +# Plan: Renovate and Codecov Verification + +## Phase 1: Repository integration + +- [ ] Add failing integrity tests for Renovate fallback and Codecov OIDC. +- [ ] Inherit the shared Renovate preset and remove obsolete legacy rules. +- [ ] Add pinned Codecov OIDC upload without replacing native evidence. +- [ ] Run validation, coverage, audit, and full tests. +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. + +## Phase 2: Hosted verification + +- [ ] Verify the pull-request matrix and Codecov upload result. +- [ ] Verify Renovate app access and a Dashboard or pull request. +- [ ] Remove Dependabot only if Renovate is proven healthy. +- [ ] Record external authorization blockers without overstating completion. +- [ ] Formal review and governed archive. +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. diff --git a/conductor/tracks/renovate-codecov-verification_20260801/requirements.md b/conductor/tracks/renovate-codecov-verification_20260801/requirements.md new file mode 100644 index 0000000..229a148 --- /dev/null +++ b/conductor/tracks/renovate-codecov-verification_20260801/requirements.md @@ -0,0 +1,19 @@ +# Requirements: Renovate and Codecov Verification + +## Must + +- **M-001:** Use the shared Renovate preset. +- **M-002:** Keep Dependabot until Renovate is hosted-verified. +- **M-003:** Use pinned Codecov v5 with OIDC and `id-token: write`. +- **M-004:** Preserve native LCOV, JSON, thresholds, and artifact evidence. +- **M-005:** Verify hosted runs before closing the track. + +## Should + +- **S-001:** Avoid repository secrets for coverage upload. +- **S-002:** Remove obsolete Renovate rules for frozen legacy paths. + +## Won't in this track + +- Release or registry publication. +- Removing Dependabot without a Renovate Dashboard or pull request. diff --git a/conductor/tracks/renovate-codecov-verification_20260801/spec.md b/conductor/tracks/renovate-codecov-verification_20260801/spec.md new file mode 100644 index 0000000..1c7b57f --- /dev/null +++ b/conductor/tracks/renovate-codecov-verification_20260801/spec.md @@ -0,0 +1,27 @@ +# Specification: Renovate and Codecov Verification + +## Outcome + +Convert the two external options left by the security frontier into verified +integrations or explicit hosted blockers without creating an update-coverage +gap or weakening repository-controlled coverage evidence. + +## Requirements + +- Inherit `github>edithatogo/renovate-config` using a current valid repository + configuration. +- Retain Dependabot until Renovate proves access with a Dependency Dashboard or + pull request. +- Upload existing LCOV through pinned Codecov v5 using GitHub OIDC and minimum + job permissions, while retaining local thresholds and CI artifacts. +- Treat app installation, organization authorization, and hosted onboarding as + external state that must be verified before completion. +- Do not release or publish the Authentext skill. + +## Acceptance + +- Tests fail if OIDC, the pinned action, the inherited preset, or the fallback + update bot is removed prematurely. +- Local validation, audit, coverage, and hosted CI pass. +- Renovate and Codecov hosted state is evidenced, or the exact remaining UI + authorization step is recorded without a false completion claim. From ed741b84d93b9027175bca70db9b78802ae3cdf8 Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 16:23:31 +1000 Subject: [PATCH 2/2] ci: verify Renovate preset and Codecov OIDC --- .github/workflows/ci.yml | 10 ++++++++++ conductor/tracks.md | 8 ++++---- .../metadata.json | 2 +- .../plan.md | 8 ++++---- renovate.json | 20 ++----------------- test/workflow-integrity.test.js | 15 ++++++++++++++ 6 files changed, 36 insertions(+), 27 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aedf46f..4f54a78 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,9 @@ permissions: jobs: test: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: @@ -43,5 +46,12 @@ jobs: path: coverage/ if-no-files-found: error + - name: Upload coverage to Codecov with OIDC + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 + with: + use_oidc: true + files: ./coverage/lcov.info + fail_ci_if_error: true + - name: Verify sync outputs run: npm run check:sync diff --git a/conductor/tracks.md b/conductor/tracks.md index 4891c1a..e389b88 100644 --- a/conductor/tracks.md +++ b/conductor/tracks.md @@ -8,10 +8,10 @@ This file tracks all major tracks for the project. Each track has its own detail ## Active Tracks -- [ ] **renovate-codecov-verification_20260801** (P1) - Verify shared Renovate - onboarding and Codecov OIDC without removing repository-controlled - fallbacks. See - [`tracks/renovate-codecov-verification_20260801/`](./tracks/renovate-codecov-verification_20260801/index.md). +- [~] **renovate-codecov-verification_20260801** (P1) - Verify shared Renovate + onboarding and Codecov OIDC without removing repository-controlled + fallbacks. See + [`tracks/renovate-codecov-verification_20260801/`](./tracks/renovate-codecov-verification_20260801/index.md). --- diff --git a/conductor/tracks/renovate-codecov-verification_20260801/metadata.json b/conductor/tracks/renovate-codecov-verification_20260801/metadata.json index 1ea9c6d..abccfdb 100644 --- a/conductor/tracks/renovate-codecov-verification_20260801/metadata.json +++ b/conductor/tracks/renovate-codecov-verification_20260801/metadata.json @@ -3,7 +3,7 @@ "title": "Renovate and Codecov Verification", "type": "maintenance", "priority": "P1", - "status": "new", + "status": "in_progress", "created_at": "2026-08-01", "updated_at": "2026-08-01", "current_phase": "Phase 1: Repository integration" diff --git a/conductor/tracks/renovate-codecov-verification_20260801/plan.md b/conductor/tracks/renovate-codecov-verification_20260801/plan.md index e0f1033..f0b1bc0 100644 --- a/conductor/tracks/renovate-codecov-verification_20260801/plan.md +++ b/conductor/tracks/renovate-codecov-verification_20260801/plan.md @@ -2,10 +2,10 @@ ## Phase 1: Repository integration -- [ ] Add failing integrity tests for Renovate fallback and Codecov OIDC. -- [ ] Inherit the shared Renovate preset and remove obsolete legacy rules. -- [ ] Add pinned Codecov OIDC upload without replacing native evidence. -- [ ] Run validation, coverage, audit, and full tests. +- [x] Add failing integrity tests for Renovate fallback and Codecov OIDC. +- [x] Inherit the shared Renovate preset and remove obsolete legacy rules. +- [x] Add pinned Codecov OIDC upload without replacing native evidence. +- [x] Run validation, coverage, audit, and full tests. - [ ] Phase verification and checkpoint per `conductor/workflow.md`. ## Phase 2: Hosted verification diff --git a/renovate.json b/renovate.json index 6542780..b72f270 100644 --- a/renovate.json +++ b/renovate.json @@ -1,21 +1,5 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:base", - "group:monorepos" - ], - "additionalBranchPrefix": "deps-", - "packageRules": [ - { - "matchUpdateTypes": ["minor", "patch"], - "matchCurrentVersion": "!/^0/", - "automerge": true - }, - { - "matchPaths": ["skills/**/package.json"], - "groupName": "humanizer-skills-dependencies", - "commitMessagePrefix": "chore(deps-skills):", - "additionalBranchPrefix": "deps-skills-" - } - ] + "extends": ["github>edithatogo/renovate-config"], + "dependencyDashboard": true } diff --git a/test/workflow-integrity.test.js b/test/workflow-integrity.test.js index f1a17e1..70251e4 100644 --- a/test/workflow-integrity.test.js +++ b/test/workflow-integrity.test.js @@ -168,3 +168,18 @@ test('solo-maintainer contribution context is current and reviewer-neutral', () assert.match(security, /edithatogo\/authentext\/security\/advisories\/new/); assert.doesNotMatch(security, /authentext-next/); }); + +test('external dependency and coverage integrations fail closed', () => { + const renovate = JSON.parse(fs.readFileSync(path.join(ROOT, 'renovate.json'), 'utf8')); + assert.ok(renovate.extends.includes('github>edithatogo/renovate-config')); + assert.ok(fs.existsSync(path.join(ROOT, '.github', 'dependabot.yml'))); + + const ci = parseYaml(fs.readFileSync(path.join(WORKFLOW_DIR, 'ci.yml'), 'utf8')); + assert.equal(ci.jobs.test.permissions?.['id-token'], 'write'); + const upload = ci.jobs.test.steps.find( + (step) => typeof step.uses === 'string' && step.uses.startsWith('codecov/codecov-action@') + ); + assert.equal(upload?.uses, 'codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac'); + assert.equal(upload?.with?.use_oidc, true); + assert.equal(upload?.with?.files, './coverage/lcov.info'); +});