Skip to content

chore: record Renovate App installation state #241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edithatogo merged 1 commit into from
Aug 1, 2026
+11 −6
Merged

chore: record Renovate App installation state #241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions conductor/tracks/renovate-codecov-verification_20260801/evidence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,11 @@ Verified on 2026-08-01 against `edithatogo/authentext`.
- `renovate.json` inherits the public
[`github>edithatogo/renovate-config`](https://github.com/edithatogo/renovate-config)
preset and enables the Dependency Dashboard.
- On 2026-08-01 the repository owner reported that the Renovate GitHub App had
been installed. The repository API now reaches the GitHub-App installation
boundary, but a normal repository token cannot enumerate the installation or
prove bot execution; GitHub returns the expected JWT-authentication error for
that endpoint.
- A paginated search of all repository issues and pull requests found no item
authored by `renovate[bot]` or another Renovate bot identity.
- The authenticated GitHub CLI token can administer the repository but cannot
Expand All @@ -41,9 +46,7 @@ Verified on 2026-08-01 against `edithatogo/authentext`.

## Remaining gate

The repository owner must install or grant the Renovate GitHub App access to
`edithatogo/authentext` at
<https://github.com/apps/renovate/installations/new>. After installation,
trigger Renovate if offered and verify a Renovate-authored Dependency Dashboard
or pull request. Until that evidence exists, `.github/dependabot.yml` remains
the fail-closed update path and this track remains in progress.
The remaining hosted gate is first-run proof: wait for or trigger Renovate's
onboarding and verify a Renovate-authored Dependency Dashboard or pull request.
Until that evidence exists, `.github/dependabot.yml` remains the fail-closed
update path and this track remains in progress.
2 changes: 2 additions & 0 deletions conductor/tracks/renovate-codecov-verification_20260801/plan.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@
## Phase 2: Hosted verification

- [x] Verify the pull-request matrix and Codecov upload result.
- [x] Record owner-reported Renovate App installation and repository onboarding
state.
- [ ] Verify Renovate app access and a Dashboard or pull request.
- [x] Retain Dependabot because Renovate is not yet proven healthy.
- [x] Record external authorization blockers without overstating completion.
Expand Down
Loading