ci: verify Renovate preset and Codecov OIDC

.github/workflows/ci.yml

@@ -12,6 +12,9 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
@@ -43,5 +46,12 @@ jobs:
           path: coverage/
           if-no-files-found: error
 
+      - name: Upload coverage to Codecov with OIDC
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
+        with:
+          use_oidc: true
+          files: ./coverage/lcov.info
+          fail_ci_if_error: true
+
       - name: Verify sync outputs
         run: npm run check:sync

conductor/index.md

@@ -19,6 +19,7 @@ than guessing paths.
 
 - [Roadmap](./roadmap.md)
 - [Tracks Registry](./tracks.md)
+- [Active Renovate and Codecov Track](./tracks/renovate-codecov-verification_20260801/index.md)
 - [Archived Security and Quality Track](./tracks/archive/post-release-security-quality-frontier_20260801/index.md)
 - [Released Bleeding-Edge Track](./tracks/archive/bleeding-edge-agent-skills-conductor_20260731/index.md)
 - [GitHub Issue Mapping](./github-mapping.json)

conductor/tracks.md

@@ -8,7 +8,10 @@ This file tracks all major tracks for the project. Each track has its own detail
 
 ## Active Tracks
 
-No active tracks.
+- [~] **renovate-codecov-verification_20260801** (P1) - Verify shared Renovate
+  onboarding and Codecov OIDC without removing repository-controlled
+  fallbacks. See
+  [`tracks/renovate-codecov-verification_20260801/`](./tracks/renovate-codecov-verification_20260801/index.md).
 
 ---
 

conductor/tracks/renovate-codecov-verification_20260801/design.md

@@ -0,0 +1,12 @@
+# Design: Renovate and Codecov Verification
+
+```mermaid
+flowchart LR
+  P["Shared Renovate preset"] --> R["Renovate GitHub App"]
+  R --> V{"Hosted run verified?"}
+  V -->|No| D["Retain Dependabot"]
+  V -->|Yes| C["Remove competing bot in later evidence commit"]
+  T["Native coverage thresholds"] --> L["LCOV and JSON"]
+  L --> A["CI artifact"]
+  L --> O["Codecov v5 with OIDC"]
+```

conductor/tracks/renovate-codecov-verification_20260801/index.md

@@ -0,0 +1,7 @@
+# Renovate and Codecov Verification
+
+- [Specification](./spec.md)
+- [MoSCoW requirements](./requirements.md)
+- [Design](./design.md)
+- [Plan](./plan.md)
+- [Metadata](./metadata.json)

conductor/tracks/renovate-codecov-verification_20260801/metadata.json

@@ -0,0 +1,10 @@
+{
+  "track_id": "renovate-codecov-verification_20260801",
+  "title": "Renovate and Codecov Verification",
+  "type": "maintenance",
+  "priority": "P1",
+  "status": "in_progress",
+  "created_at": "2026-08-01",
+  "updated_at": "2026-08-01",
+  "current_phase": "Phase 1: Repository integration"
+}

conductor/tracks/renovate-codecov-verification_20260801/plan.md

@@ -0,0 +1,18 @@
+# Plan: Renovate and Codecov Verification
+
+## Phase 1: Repository integration
+
+- [x] Add failing integrity tests for Renovate fallback and Codecov OIDC.
+- [x] Inherit the shared Renovate preset and remove obsolete legacy rules.
+- [x] Add pinned Codecov OIDC upload without replacing native evidence.
+- [x] Run validation, coverage, audit, and full tests.
+- [ ] Phase verification and checkpoint per `conductor/workflow.md`.
+
+## Phase 2: Hosted verification
+
+- [ ] Verify the pull-request matrix and Codecov upload result.
+- [ ] Verify Renovate app access and a Dashboard or pull request.
+- [ ] Remove Dependabot only if Renovate is proven healthy.
+- [ ] Record external authorization blockers without overstating completion.
+- [ ] Formal review and governed archive.
+- [ ] Phase verification and checkpoint per `conductor/workflow.md`.

conductor/tracks/renovate-codecov-verification_20260801/requirements.md

@@ -0,0 +1,19 @@
+# Requirements: Renovate and Codecov Verification
+
+## Must
+
+- **M-001:** Use the shared Renovate preset.
+- **M-002:** Keep Dependabot until Renovate is hosted-verified.
+- **M-003:** Use pinned Codecov v5 with OIDC and `id-token: write`.
+- **M-004:** Preserve native LCOV, JSON, thresholds, and artifact evidence.
+- **M-005:** Verify hosted runs before closing the track.
+
+## Should
+
+- **S-001:** Avoid repository secrets for coverage upload.
+- **S-002:** Remove obsolete Renovate rules for frozen legacy paths.
+
+## Won't in this track
+
+- Release or registry publication.
+- Removing Dependabot without a Renovate Dashboard or pull request.

conductor/tracks/renovate-codecov-verification_20260801/spec.md

@@ -0,0 +1,27 @@
+# Specification: Renovate and Codecov Verification
+
+## Outcome
+
+Convert the two external options left by the security frontier into verified
+integrations or explicit hosted blockers without creating an update-coverage
+gap or weakening repository-controlled coverage evidence.
+
+## Requirements
+
+- Inherit `github>edithatogo/renovate-config` using a current valid repository
+  configuration.
+- Retain Dependabot until Renovate proves access with a Dependency Dashboard or
+  pull request.
+- Upload existing LCOV through pinned Codecov v5 using GitHub OIDC and minimum
+  job permissions, while retaining local thresholds and CI artifacts.
+- Treat app installation, organization authorization, and hosted onboarding as
+  external state that must be verified before completion.
+- Do not release or publish the Authentext skill.
+
+## Acceptance
+
+- Tests fail if OIDC, the pinned action, the inherited preset, or the fallback
+  update bot is removed prematurely.
+- Local validation, audit, coverage, and hosted CI pass.
+- Renovate and Codecov hosted state is evidenced, or the exact remaining UI
+  authorization step is recorded without a false completion claim.

renovate.json

@@ -1,21 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:base",
-    "group:monorepos"
-  ],
-  "additionalBranchPrefix": "deps-",
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch"],
-      "matchCurrentVersion": "!/^0/",
-      "automerge": true
-    },
-    {
-      "matchPaths": ["skills/**/package.json"],
-      "groupName": "humanizer-skills-dependencies",
-      "commitMessagePrefix": "chore(deps-skills):",
-      "additionalBranchPrefix": "deps-skills-"
-    }
-  ]
+  "extends": ["github>edithatogo/renovate-config"],
+  "dependencyDashboard": true
 }

test/workflow-integrity.test.js

@@ -168,3 +168,18 @@ test('solo-maintainer contribution context is current and reviewer-neutral', ()
   assert.match(security, /edithatogo\/authentext\/security\/advisories\/new/);
   assert.doesNotMatch(security, /authentext-next/);
 });
+
+test('external dependency and coverage integrations fail closed', () => {
+  const renovate = JSON.parse(fs.readFileSync(path.join(ROOT, 'renovate.json'), 'utf8'));
+  assert.ok(renovate.extends.includes('github>edithatogo/renovate-config'));
+  assert.ok(fs.existsSync(path.join(ROOT, '.github', 'dependabot.yml')));
+
+  const ci = parseYaml(fs.readFileSync(path.join(WORKFLOW_DIR, 'ci.yml'), 'utf8'));
+  assert.equal(ci.jobs.test.permissions?.['id-token'], 'write');
+  const upload = ci.jobs.test.steps.find(
+    (step) => typeof step.uses === 'string' && step.uses.startsWith('codecov/codecov-action@')
+  );
+  assert.equal(upload?.uses, 'codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac');
+  assert.equal(upload?.with?.use_oidc, true);
+  assert.equal(upload?.with?.files, './coverage/lcov.info');
+});