Bump limen to v0.3.0 and apply its remediation - #8
Merged
Merged
Conversation
The pin moves from v0.0.16, five releases. What changes for this repository: Renovate's per-repository configuration becomes `renovate.json`, plain JSON, and gains `forkProcessing: "enabled"`. Renovate skips forked repositories by default under an all-repositories App installation, and it decides that from the onboarding config file name — renovate.json — read through the platform API before any preset is resolved, so the setting can live neither in the shared preset nor in a renovate.json5. This repository is not a fork, so the setting changes nothing here today; it is canonical because the seed cannot know which repositories will be. The file also gains the `extends` reference to the shared preset, which it never carried: it predates the preset, and had been drifting with a private copy of the canonical configuration ever since — config:recommended, the aqua preset, minimumReleaseAge, vulnerabilityAlerts and commitBody are all in the preset now, so the local copies go. Nothing in the old file was this repository's own. The Go-built tools leave aqua for tools/go.mod tool directives, and the canonical `.limen/` modules, the setup-aqua action and the checksum workflow reset to the v0.3.0 baseline — including the fix for the workflow's commit payload, which was built on a command line and died on any convergence past 128 kB. A five-release gap is exactly the size that would have hit it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: closer-claudio <claudio@farcloser.world>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin moves v0.0.16 → v0.3.0 — five releases.
Renovate config becomes
renovate.json, plain JSON, with"forkProcessing": "enabled". Renovate skips forks by default under an all-repositories App installation and decides that from the onboarding config file name, read through the platform API before any preset resolves. This repository is not a fork, so the setting changes nothing here today — it is canonical because the seed cannot know which repositories will be.It also gains the
extendsreference to the shared preset, which it never carried: this file predates the preset and had been drifting with a private copy of the canonical configuration.config:recommended, the aqua preset,minimumReleaseAge,vulnerabilityAlertsandcommitBodyare all in the preset now, so the local copies go. Nothing in the old file was this repository's own.Baseline: Go-built tools leave aqua for
tools/go.moddirectives;.limen/, setup-aqua and the checksum workflow reset to v0.3.0 — including the fix for the workflow's commit payload, which was assembled on a command line and died on any convergence past 128 kB. A five-release gap is exactly the size that would have hit it.just lintandjust testgreen locally.