Repository navigation
feat(just): add renovate-risk to write per-PR dossiers for risk review - #531
Open
laurigates wants to merge 1 commit into
Open
laurigates wants to merge 1 commit into
laurigates wants to merge 1 commit into
Conversation
renovate-triage sorts open Renovate PRs into SAFE and HOLD buckets. The HOLD side, security PRs especially, still needs each PR's release notes, advisories and check state read before merging. Done by hand, that means re-fetching every PR body. renovate-risk writes one markdown dossier per open Renovate PR whose title matches a pattern (default: security advisories): repo archived or private, last default-branch commit, merge state, files, every check with its conclusion, and the Renovate body. Archived-repo PRs go to an archived/ subdirectory, since they cannot be merged. The dossiers are the input for an extraction pass (cheap-model readers quoting CVEs and breaking changes verbatim); the recipe itself makes no risk judgement. First used on 2026-10-27 for 41 ForumViriumHelsinki security PRs (14 in archived repos), from which 10 were merged as low risk. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LDMi9sT6VJh47Vur7G7cQ8
github-actions
Bot
added
documentation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the global recipe
just -g renovate-risk [out] [pattern] [owners] [authors] [jobs]. It writes one markdown dossier per open Renovate PR whose title matchespattern(default(?i)security|vulnerab|cve) intoout(defaulttmp/renovate-risk). The recipe header injustfileand the recipe list inexact_dot_claude/CLAUDE.mdnow name it.Each dossier holds:
PRs in archived repos go to
out/archived/, because they cannot be merged.Why
renovate-triagesorts PRs into SAFE and HOLD. The HOLD side, security PRs especially, still needs each PR's release notes, advisories and checks read before anything merges. The dossiers are the input to that read. In the session that produced this, five Haikulean-readeragents extracted CVEs and breaking changes from them verbatim, and the risk rating was done afterwards. The recipe only gathers; it makes no risk judgement.Verification
just --justfile private_dot_config/just/justfile renovate-risk <dir> "(?i)security|vulnerab|cve" ForumViriumHelsinki app/fvh-renovate-botfrom this branch gaveMATCHED=33 LIVE=19 ARCHIVED=14. Diffed against the prototype's file set: the 10 merged PRs are gone, and two new ones are present (FVHIoT-python#73, Spotted-Cesium-Viewer#47), opened by Renovate after CI resumed. 41 − 10 + 2 = 33.MATCHED=72 LIVE=58 ARCHIVED=14.just --listparses the file and lists the recipe; the pre-commit hooks passed on the commit.🤖 Generated with Claude Code
https://claude.ai/code/session_01LDMi9sT6VJh47Vur7G7cQ8