Dependency updates: config
This repo has its own, scoped Renovate run: .forgejo/workflows/renovate.yml runs nightly at
01:47 UTC (03:47 CEST / 02:47 CET) and on demand (Actions → renovate → Run workflow) on the runner pi, processes only
this repo (RENOVATE_REPOSITORIES = github.repository) and uses renovate.json here
(secrets RENOVATE_TOKEN, RENOVATE_GITHUB_COM_TOKEN):
| Dependency | Pinned in | Commit type |
|---|---|---|
pi packages (npm:<name>@<x.y.z>) | agent/settings.json and the matching headings in docs/config-reference.md (changed together, so check-docs.sh stays green) | build(deps) → patch release |
| Release tooling (semantic-release + plugins) | package.json, package-lock.json | ci(deps) → no release |
| Forgejo actions, Node.js | .forgejo/workflows/*.yml | ci(deps) |
just, gitleaks (+ checksums via scripts/update-ci-checksums.sh) | scripts/ci-install-tools.sh | ci(deps) |
Every pull request runs .forgejo/workflows/check.yml: just check, and renovate.json is
validated with the pinned Renovate version (renovate-config-validator --strict, same pin as
renovate.yml), so a config error fails the PR instead of the nightly run. A new package version is
proposed the night after it is published (no minimum release age — bleeding edge, owner decision
2026-10-04). Review the PR — a package update changes what runs with the agent’s full
access in the sandbox (spec FR-024) — then merge.
The supply-chain job (scripts/check-npm-supply-chain.sh) runs on every PR as a counterweight
to the missing release age: it installs the release tooling (npm ci) and the pinned pi packages
(like pi: no peer installs) without running any script, verifies npm registry signatures and
provenance attestations (npm audit signatures), and fails if a package has an install script
that is not allowed in agent/npmrc. A failing signature or a new install script therefore stops
the PR before review, instead of reaching the sandbox.
Setup, tokens and the full table: pi-docker-sandbox/docs/dependencies.md.