feat: monitor Renovate hosted evidence - #242
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR adds a scheduled monitor for Renovate hosted evidence through GitHub API checks. The implementation is generally solid with good test coverage.
Critical Issues Found (3)
- Logic Error: Missing validation for repository format before splitting - could cause silent failures or incorrect API calls
- Crash Risk: Missing error handling in workflow step for JSON parsing failures
- Potential Data Loss: Limited to 100 items per API call may miss Renovate evidence in large repositories
Verification
The PR description indicates 82 tests passed with full pre-commit suite validation. The code structure follows good practices with separation of concerns between entry point, library, and tests.
Please address the critical validation and error handling issues before merging.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| export async function runRenovateHostedCheck({ repository, token }) { | ||
| if (!repository || !token) throw new Error('GITHUB_REPOSITORY and GITHUB_TOKEN are required'); | ||
| const [owner, repo] = repository.split('/'); |
There was a problem hiding this comment.
🛑 Logic Error: Add validation for repository format before splitting. If repository doesn't contain a slash or has an invalid format (e.g., "myrepo" instead of "owner/repo"), the split operation will produce incorrect values, causing API calls to fail silently or target wrong repositories.
| export async function runRenovateHostedCheck({ repository, token }) { | |
| if (!repository || !token) throw new Error('GITHUB_REPOSITORY and GITHUB_TOKEN are required'); | |
| const [owner, repo] = repository.split('/'); | |
| export async function runRenovateHostedCheck({ repository, token }) { | |
| if (!repository || !token) throw new Error('GITHUB_REPOSITORY and GITHUB_TOKEN are required'); | |
| if (!repository.includes('/')) throw new Error('GITHUB_REPOSITORY must be in owner/repo format'); | |
| const [owner, repo] = repository.split('/'); |
| const [issues, pulls] = await Promise.all([ | ||
| fetchGitHub(`/repos/${owner}/${repo}/issues?state=all&per_page=100`, token), | ||
| fetchGitHub(`/repos/${owner}/${repo}/pulls?state=all&per_page=100`, token), | ||
| ]); |
There was a problem hiding this comment.
Fetching only 100 items per endpoint may miss Renovate evidence in repositories with many issues or PRs. Consider implementing pagination to retrieve all items, or at minimum increase the limit and add sorting to ensure most recent items are checked first.
| - name: Publish evidence summary | ||
| shell: bash | ||
| run: | | ||
| cat renovate-hosted.json >> "$GITHUB_STEP_SUMMARY" | ||
| if jq -e '.healthy == false' renovate-hosted.json >/dev/null; then | ||
| echo '::warning::No Renovate Dashboard or bot pull request is visible yet; Dependabot fallback remains required.' | ||
| fi |
There was a problem hiding this comment.
🛑 Crash Risk: Missing error handling for JSON parsing. If renovate-hosted.json is empty or contains invalid JSON, the jq command will fail but the step will continue. Add error handling or use set -e to fail on errors.
| - name: Publish evidence summary | |
| shell: bash | |
| run: | | |
| cat renovate-hosted.json >> "$GITHUB_STEP_SUMMARY" | |
| if jq -e '.healthy == false' renovate-hosted.json >/dev/null; then | |
| echo '::warning::No Renovate Dashboard or bot pull request is visible yet; Dependabot fallback remains required.' | |
| fi | |
| - name: Publish evidence summary | |
| shell: bash | |
| run: | | |
| set -e | |
| cat renovate-hosted.json >> "$GITHUB_STEP_SUMMARY" | |
| if jq -e '.healthy == false' renovate-hosted.json >/dev/null; then | |
| echo '::warning::No Renovate Dashboard or bot pull request is visible yet; Dependabot fallback remains required.' | |
| fi |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Summary
Safety
Dependabot remains enabled until Renovate activity is proven. The monitor never marks Conductor work complete automatically.
Verification
Relates #234 and #236.