fix(ci): allow verified Renovate pull requests in the queue

[ben-ranford]

Summary

Renovate PR #1658 is paused because the queue rejects its signed Renovate-to-GitHub commit as bot-authored. Accept verified Renovate commits on same-repository PRs opened by the Renovate app, so maintainers can use queue-me for dependency updates.

Closes #1663

Changes

• Add a per-commit exception for exact Renovate account IDs and Git identities with a valid verified signature. Accept Renovate or GitHub web-flow as committer.
• Require each bot commit SHA to match an authenticated Renovate push, force-push, or branch-creation record for the exact branch. Check the latest 100 activities and fail closed when evidence is absent.
• Preserve canonical human identity checks, complete-history auditing, current-base and head-race checks, queue order, and repository merge requirements.
• Explain how to refresh a stale Renovate PR and cover normal, spoofed, mixed-history, and paginated cases.

Scope firewall: a review item belongs here only if it directly prevents #1663 acceptance criteria and is an incremental correction in the queue controller or its focused regression tests. Other automation changes require a separate issue.

Validation

Commands and checks run:

node --check scripts/queue_me_controller.js
node --test scripts/queue_me_controller.test.js
go test ./scripts -run '^TestQueueMe' -count=1
git diff --check
make ci

Additional manual validation:

• Read-only replay of the real chore(deps): update docker/build-push-action action to v7.4.0 #1658 API comparison accepts its exact signed commit; GitHub mutations are mocked in controller tests.
• Independent review found no blocking issue.
• Adversarial UltraQA passes 58 controller tests and covers identity and push-actor spoofing, invalid signatures, mixed and paginated history, stale state, retries, and bounded harness failure. Full CI is running; results will be recorded before landing.

Regression-Test: ./scripts::TestQueueMeControllerRenovateIdentityRegression

Risk and compatibility

• Breaking changes: none. Only verified Renovate PRs receive the identity exception.
• Migration required: none. Stale PRs still need Renovate to rebase them.
• Performance impact: constant identity checks per commit.
• Memory benchmark impact: none expected; no application runtime changes.

Checklist

• Tests added/updated for behavior changes
• Docs updated (README/docs/schema) if needed
• memory-approved requested/applied if intentional memory benchmark regressions exceed CI thresholds
• No unrelated changes included
• Ready for review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T04:09:40.503516Z	6b5c6c8	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Memory Benchmarks

Thresholds: bytes/op <= +15.0%, allocs/op <= +10.0%

Base benchmarks: 5
Head benchmarks: 5

Benchmark	Base B/op	Head B/op	Delta B/op	Base allocs/op	Head allocs/op	Delta allocs/op	Status
github.com/ben-ranford/lopper/internal/lang/shared/BenchmarkCountUsage	25632.3	25632.0	-0.0%	375.0	375.0	+0.0%	ok
github.com/ben-ranford/lopper/internal/lang/shared/BenchmarkCountUsageLargeGroupedDeclaration	3615994.7	3615992.7	-0.0%	24747.0	24747.0	+0.0%	ok
github.com/ben-ranford/lopper/internal/lang/shared/BenchmarkCountUsageRegexPerIdentifier	395887.3	395887.3	+0.0%	3307.0	3307.0	+0.0%	ok
github.com/ben-ranford/lopper/internal/lang/shared/BenchmarkCountUsageUnicode	25648.3	25648.0	-0.0%	378.0	378.0	+0.0%	ok
github.com/ben-ranford/lopper/internal/report/BenchmarkFormatLargeTable	257751.7	257751.0	-0.0%	3079.0	3079.0	+0.0%	ok

Result: memory benchmark gate passed.

Approval: not required.

[github-actions]

Lopper (Delta)

Metric delta	Value
Dependency count	0
Used percent	0.0%
Waste percent	0.0%
Estimated unused bytes	0 B
Known licenses	0
Unknown licenses	0
Denied licenses	0
Reachable vulnerabilities	0

Changed	Regressions	Progressions	Added	Removed	Unchanged
0	0	0	0	0	13

No dependency-surface deltas detected.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04637919fd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ben-ranford]

Verification evidence

Head: 6b5c6c8da7588ab030d972adae99105518bd6207

SonarCloud Code Analysis passed for this head (check run 104661323017). Open issues: 0 from the live PR issue API. The current Sonar decoration reports 0 new issues, 0 accepted issues, and 0 security hotspots.

All 58 queue controller tests pass. The focused Go workflow tests and the base-fails/head-passes regression proof pass. UltraQA completed two cycles, including signed-author spoofing, authenticated push provenance, stale heads, mixed and paginated history, and bounded harness failures. A read-only replay of PR #1658 passes with its actual Renovate force-push record. Copilot returned its authenticated exhausted-quota response; exact-head UltraQA evidence is recorded locally as the allowed fallback.

The code review thread is resolved, and the automatic Codex review added a fresh positive verdict at 2026-09-16T04:09:43Z. Local make ci passed (exit 0), including lint, security, normal/leak/race tests, build, memory benchmarks and 98.2% coverage (98% minimum). Hosted GitHub CI is still running; this is not a merge approval.