From c05febc501595ac2c5c6b81b9f0bdbfc4ebb94ff Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Fri, 7 Aug 2026 12:12:23 +0100 Subject: [PATCH 01/11] ci: Add Renovate configuration --- renovate.json | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..177d53d --- /dev/null +++ b/renovate.json @@ -0,0 +1,21 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "security:only-security-updates", + ":semanticCommitTypeAll(deps)" + ], + "semanticCommitScope": "", + "packageRules": [ + { + "description": "Eagerly bump flagsmith-go-client on every version release", + "matchPackageNames": ["flagsmith-go-client"], + "enabled": true, + "rangeStrategy": "bump", + "matchUpdateTypes": ["minor", "major"] + }, + { + "matchManagers": ["go"], + "addLabels": ["cli", "dependencies"] + } + ] +} From 8ab7dae6a000591845a4bcf53a4eb7307aa29817 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 13:44:39 +0100 Subject: [PATCH 02/11] ci: drop the update-type filter that makes the Renovate config invalid MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `renovate-config-validator` rejects the whole file: packageRules[0]: packageRules cannot combine both matchUpdateTypes and rangeStrategy `rangeStrategy` is a pre-lookup option — Renovate needs it before it has resolved which updates exist, so it cannot be gated on an update type that only exists after the lookup. A config error is fatal: Renovate opens a Config Validation issue and skips the repository, so nothing in here took effect. Dropping `matchUpdateTypes` is also what the rule wants. It described itself as eagerly bumping "on every version release" while listing only minor and major, so a patch release of flagsmith-go-client stayed disabled by the `security:only-security-updates` preset. Unfiltered, the rule re-enables every update type, which is the stated intent — and it matches the equivalent rule in Flagsmith/flagsmith, which carries `rangeStrategy` with no update-type filter. beep boop --- renovate.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/renovate.json b/renovate.json index 177d53d..33c6bec 100644 --- a/renovate.json +++ b/renovate.json @@ -10,8 +10,7 @@ "description": "Eagerly bump flagsmith-go-client on every version release", "matchPackageNames": ["flagsmith-go-client"], "enabled": true, - "rangeStrategy": "bump", - "matchUpdateTypes": ["minor", "major"] + "rangeStrategy": "bump" }, { "matchManagers": ["go"], From e959c961f3d7a6346cc92f00f7fd45cb9c7f312e Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 13:45:00 +0100 Subject: [PATCH 03/11] ci: match flagsmith-go-client by its Go module path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `matchPackageNames` entries are minimatch patterns tested against the dependency name, and for the gomod manager that name is the full module path — `github.com/Flagsmith/flagsmith-go-client/v5`. A bare `flagsmith-go-client` has no wildcard, so it was an exact-string pattern that matched nothing: the rule never fired and the eager bump never happened. The bare name is what Flagsmith/flagsmith uses, but there the manager is pep621, where the dependency name really is the bare package. The glob keeps matching across a major bump. Pinning `/v5` would work today and then silently stop matching at v6 — losing the eager bump at exactly the release the rule exists to pick up, and losing it quietly, since an unmatched pattern is not an error. The brace also keeps the pattern from reaching past the module: it matches the bare path and any `/vN` suffix, but not a neighbour like `flagsmith-go-client-extra`. beep boop --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 33c6bec..31e81bb 100644 --- a/renovate.json +++ b/renovate.json @@ -8,7 +8,7 @@ "packageRules": [ { "description": "Eagerly bump flagsmith-go-client on every version release", - "matchPackageNames": ["flagsmith-go-client"], + "matchPackageNames": ["github.com/Flagsmith/flagsmith-go-client{,/**}"], "enabled": true, "rangeStrategy": "bump" }, From 6bf3a2874859292a8cf380a8807758322164b292 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 13:45:29 +0100 Subject: [PATCH 04/11] ci: name Renovate's Go manager gomod `go` is not a manager. Renovate's only Go module manager is `gomod`; the closest thing to `go` is the datasource of the same name, which is what `matchManagers` does not take. Renovate does not validate the contents of `matchManagers` against the manager list, so this failed the quiet way: the rule matched nothing and dependency PRs arrived unlabelled, with no error to explain why. beep boop --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 31e81bb..0ab2a89 100644 --- a/renovate.json +++ b/renovate.json @@ -13,7 +13,7 @@ "rangeStrategy": "bump" }, { - "matchManagers": ["go"], + "matchManagers": ["gomod"], "addLabels": ["cli", "dependencies"] } ] From 56fa9ab9f02ea79cde96ff593ce9639d01f42d77 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 13:45:50 +0100 Subject: [PATCH 05/11] ci: rewrite Go import paths on a major module bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The flagsmith-go-client rule opts into major updates, and a Go major is a new module path. Renovate only edits go.mod by default, so a v5 -> v6 bump would leave the sole importer, internal/cmd/evaluate.go, on flagsmith-go-client/v5 and the PR would not build. `gomodUpdateImportPaths` moves the imports with the requirement, and implies gomodTidy, which the lint job's `go mod tidy -diff` insists on. The PR still needs reading — a major usually carries API changes past the import path — but it arrives buildable rather than broken on arrival. beep boop --- renovate.json | 1 + 1 file changed, 1 insertion(+) diff --git a/renovate.json b/renovate.json index 0ab2a89..9dd57f2 100644 --- a/renovate.json +++ b/renovate.json @@ -5,6 +5,7 @@ ":semanticCommitTypeAll(deps)" ], "semanticCommitScope": "", + "postUpdateOptions": ["gomodUpdateImportPaths"], "packageRules": [ { "description": "Eagerly bump flagsmith-go-client on every version release", From b1a69c4d8ec4226385ccdf0fc78c6b0569371e19 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 13:49:07 +0100 Subject: [PATCH 06/11] ci: validate the Renovate config before pushing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The config landed with a fatal error in it, which is the failure mode worth a hook: Renovate answers an invalid file by opening an issue and skipping the repository, so the config silently does nothing and the next dependency PR that fails to arrive is the only symptom. Checked against the file as it was first committed — the validator exits 1 on the matchUpdateTypes/rangeStrategy conflict. Pre-push rather than pre-commit, matching go-test: renovate.json changes rarely and the hook installs Renovate to run. Also skipped on pre-commit.ci, as every pre-push hook here is. Follows Flagsmith/flagsmith, which added the same hook in #7657. beep boop --- .pre-commit-config.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 17f6954..a2f96fb 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -25,6 +25,12 @@ repos: - id: golangci-lint-fmt - id: golangci-lint-config-verify + - repo: https://github.com/renovatebot/pre-commit-hooks + rev: 44.28.0 + hooks: + - id: renovate-config-validator + stages: [pre-push] + - repo: local hooks: - id: go-mod-tidy @@ -42,4 +48,4 @@ repos: stages: [pre-push] ci: - skip: [golangci-lint-full, golangci-lint-config-verify, go-mod-tidy, go-test] + skip: [golangci-lint-full, golangci-lint-config-verify, go-mod-tidy, go-test, renovate-config-validator] From 305a109aefc4b8a0a95a66c41ea2a6fcbea6e72a Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 13:51:36 +0100 Subject: [PATCH 07/11] ci: label dependency PRs with only the label that exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `cli` is not a label in this repository — `dependencies` is the only one of the pair defined. The component labels it came from belong to Flagsmith/flagsmith, where `api`, `mcp` and `front-end` say which part of a monorepo a dependency PR touches. Here every PR is the CLI, so the label distinguishes nothing even once created. beep boop --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 9dd57f2..a3b7035 100644 --- a/renovate.json +++ b/renovate.json @@ -15,7 +15,7 @@ }, { "matchManagers": ["gomod"], - "addLabels": ["cli", "dependencies"] + "addLabels": ["dependencies"] } ] } From 906718a3828329a0ce7dbf44bc2ebbe956ca3296 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 14:05:47 +0100 Subject: [PATCH 08/11] ci: tidy go.sum on every Renovate update, not just majors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lint job runs `go mod tidy -diff` on every pull request, so a Renovate branch that leaves go.mod or go.sum untidy fails CI. `gomodUpdateImportPaths` alone does not cover this. Renovate gates the implied tidy on the update being major: isGoModTidyRequired = ... || (config.updateType === 'major' && isImportPathUpdateRequired) and `isImportPathUpdateRequired` is itself `gomodUpdateImportPaths && updateType === 'major'`. So the tidy I claimed in 56fa9ab was implied only for majors — every minor and patch branch ran `go get` alone. Those are the common case here: the eager flagsmith-go-client bumps and the security patches the rest of the config exists to raise. Naming `gomodTidy` explicitly makes the tidy unconditional. beep boop --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index a3b7035..58d4215 100644 --- a/renovate.json +++ b/renovate.json @@ -5,7 +5,7 @@ ":semanticCommitTypeAll(deps)" ], "semanticCommitScope": "", - "postUpdateOptions": ["gomodUpdateImportPaths"], + "postUpdateOptions": ["gomodUpdateImportPaths", "gomodTidy"], "packageRules": [ { "description": "Eagerly bump flagsmith-go-client on every version release", From 93ea7c0056089bc7e4e431417f33e2ab815c7617 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 14:07:04 +0100 Subject: [PATCH 09/11] ci: validate renovate.json as a repo config, not a global one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Given a file to check, `renovate-config-validator` assumes it is a self-hosted global config; `--no-global` is how you say otherwise. The hook was reporting `Validating renovate.json as global config` and grading this file against the wrong schema — repo and global config accept different options, so a mismatch could pass here and still be rejected by the bot. Re-checked both ways: the original file still fails on the matchUpdateTypes/rangeStrategy conflict, and the current one passes, now as `Validating renovate.json as repo config`. beep boop --- .pre-commit-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index a2f96fb..1bf560b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -29,6 +29,7 @@ repos: rev: 44.28.0 hooks: - id: renovate-config-validator + args: [--no-global] stages: [pre-push] - repo: local From b84cb2ca56a34359b1411323de5f4b716d2bf67c Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 14:08:33 +0100 Subject: [PATCH 10/11] ci: enforce the Renovate config check on pull requests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit b1a69c4 left the check local-only: pre-commit.ci was told to skip it, and no workflow runs it, so it only ever fired for someone who had installed the pre-push hook. Dropping it from `ci.skip` is not enough on its own. pre-commit.ci runs the pre-commit stage, so a hook staged `pre-push` stays skipped whatever `ci.skip` says. Both had to go. Moving off pre-push costs nothing on ordinary commits: the hook carries its own `files` pattern for renovate config files, so it reports "no files to check" and skips unless renovate.json is in the commit. Verified at the new stage — it still fails the original file and passes this one. beep boop --- .pre-commit-config.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1bf560b..df182d0 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -30,7 +30,6 @@ repos: hooks: - id: renovate-config-validator args: [--no-global] - stages: [pre-push] - repo: local hooks: @@ -49,4 +48,4 @@ repos: stages: [pre-push] ci: - skip: [golangci-lint-full, golangci-lint-config-verify, go-mod-tidy, go-test, renovate-config-validator] + skip: [golangci-lint-full, golangci-lint-config-verify, go-mod-tidy, go-test] From fc13d1e511c1193641ca891ecd15fa2df7b29206 Mon Sep 17 00:00:00 2001 From: Kim Gustyr Date: Thu, 13 Aug 2026 14:15:53 +0100 Subject: [PATCH 11/11] ci: run the Renovate config check via prek in the lint job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit b84cb2c tried to enforce this on pre-commit.ci and broke the build: build of renovatebot/pre-commit-hooks:renovate@44.28.0 for node@lts exceeds tier max size 250MiB: 402.6MiB The hook cannot run there at any stage, so `ci.skip` and `stages: pre-push` both go back, and GitHub Actions takes the check instead. prek runs the hook straight from .pre-commit-config.yaml, which keeps the pinned rev in one place — an `npx renovate-config-validator` step would have been a second version to hold in step with the hook, the problem the golangci-lint pin already has. Only this hook, not the rest of `ci.skip`: golangci-lint, go mod tidy and go test already have their own steps, and go test's runs across three operating systems that one prek invocation would narrow to Linux. Verified with the invocation the job uses: passes on this file, exits 1 on the file as first committed, and reports `Validating renovate.json as repo config`, so --no-global survives the trip through prek. beep boop --- .github/workflows/pull-request.yml | 3 +++ .pre-commit-config.yaml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index cad9718..993af2b 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -43,6 +43,9 @@ jobs: with: version: v2.11.4 # keep in step with the hook rev in .pre-commit-config.yaml - run: go mod tidy -diff + - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0 + with: + extra-args: --all-files --hook-stage pre-push renovate-config-validator install-ps1: name: install.ps1 lint diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index df182d0..3a69558 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -28,8 +28,11 @@ repos: - repo: https://github.com/renovatebot/pre-commit-hooks rev: 44.28.0 hooks: + # The lint workflow runs this too. It cannot run on pre-commit.ci, whose + # 250MiB tier limit this hook's 400MiB node environment does not fit. - id: renovate-config-validator args: [--no-global] + stages: [pre-push] - repo: local hooks: @@ -48,4 +51,4 @@ repos: stages: [pre-push] ci: - skip: [golangci-lint-full, golangci-lint-config-verify, go-mod-tidy, go-test] + skip: [golangci-lint-full, golangci-lint-config-verify, go-mod-tidy, go-test, renovate-config-validator]