fix(deps): resolve OpenShell digest lookup

[ralphbean]

Summary

• Fixes the Dependency Dashboard warning (Dependency Dashboard #2682): Could not determine new digest for update (github-releases package NVIDIA/OpenShell). Root cause: the customManager's extractVersionTemplate strips the leading v from OPENSHELL_VERSION so it matches the bare-number value stored in the file, but Renovate's digest lookup for github-releases compares that stripped value against raw GitHub tag names (e.g. v0.0.103) and never finds a match — so currentDigest/OPENSHELL_SHA tracking can never succeed. This is a structural incompatibility between extractVersionTemplate and digest tracking, not a config typo (confirmed by reading Renovate's findCommitOfTag source). PR fix(#5731): use github-releases datasource for OpenShell #5749 fixed a related-but-different problem (unreleased tags) by switching datasources; it didn't touch this.
• Fix: stop asking Renovate to resolve OPENSHELL_SHA as a digest. Track only OPENSHELL_VERSION, and add a postUpgradeTasks script (scripts/renovate/update-openshell-sha.sh) that looks up the release tag's commit SHA directly via the GitHub API and patches it in — the same pattern already used here for tirith/cosign.
• Removes the inert # renovate: magic comment from openshell-version.sh — no built-in Renovate manager scans .sh files for magic comments, so it did nothing (the customManager's explicit depNameTemplate/datasourceTemplate is what actually drives extraction).

Testing

• npx --yes --package renovate -- renovate-config-validator — config validated successfully
• LOG_LEVEL=debug npx --yes --package renovate -- renovate --dry-run=full fullsend-ai/fullsend against the unpatched main branch reproduced the exact reported warning (Could not determine new digest for update (github-releases package NVIDIA/OpenShell)), confirming the root-cause diagnosis
• Manually exercised update-openshell-sha.sh against a scratch git repo: version bump 0.0.83 -> 0.0.103 correctly resolves and writes OPENSHELL_SHA=c825b1f8efac457f3ca3c6f9e06fb068e8ce3ecc (verified independently against gh api repos/NVIDIA/OpenShell/commits/v0.0.103); unchanged-version and bad-tag cases exit cleanly/non-zero as expected
• Confirmed production Renovate's RENOVATE_ALLOWED_COMMANDS regex (.github/workflows/renovate.yml) already covers bash scripts/renovate/*.sh, so the new postUpgradeTask needs no additional allowlisting
• pre-commit run (shellcheck, check-json, etc.) passes on all changed files

Assisted-by: Claude Opus 4.6 noreply@anthropic.com

[qodo-code-review]

PR Summary by Qodo

Fix Renovate OpenShell SHA updates and automerge UBI digest bumps

🐞 Bug fix ⚙️ Configuration changes ✨ Enhancement 🕐 20-40 Minutes

AI Description

• Stop Renovate digest tracking for OpenShell SHA to fix persistent digest lookup failures.
• Add a post-upgrade script to resolve OpenShell tag commit SHAs via GitHub API.
• Automerge Red Hat UBI10 image digest bumps once required checks pass.

Diagram

graph TD
  A["Renovate"] --> B["renovate.json"] --> C["OpenShell regex customManager"] --> D["openshell-version.sh"]
  A --> E["postUpgradeTasks"] --> F["update-openshell-sha.sh"] --> G{{"GitHub API (tags/commits)"}} --> D
  A --> H["UBI digest packageRule"] --> I{{"registry.access.redhat.com"}}

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Store v-prefixed OPENSHELL_VERSION

• ➕ Would allow Renovate’s built-in tag/digest resolution to work without a post-upgrade script
• ➕ Avoids GitHub API calls during post-upgrade tasks
• ➖ Requires changing the on-disk version format and any downstream consumers expecting bare semver
• ➖ Still depends on Renovate datasource/tag matching semantics staying stable

2. Track SHA via a separate custom manager (no postUpgradeTasks)

• ➕ Keeps everything within Renovate’s extraction/update loop
• ➕ Potentially avoids shell scripting and curl/grep parsing
• ➖ Hard to reliably compute a commit SHA from a version string inside Renovate without tag lookup
• ➖ Likely reintroduces the same tag-name mismatch unless version format changes

3. Use GitHub CLI (gh) instead of curl+grep

• ➕ More robust JSON handling and authentication flow in CI environments
• ➕ Less brittle than grepping JSON
• ➖ Adds an extra runtime dependency that may not exist in Renovate execution context
• ➖ Requires allowing additional commands/binaries in Renovate config

Recommendation: The chosen approach (version-only tracking + postUpgradeTasks script to backfill OPENSHELL_SHA) is the best fit given the structural mismatch between extractVersionTemplate output and Renovate’s tag/digest resolution. It preserves the existing bare-semver file format while making SHA updates deterministic. The main thing to watch is API rate-limiting/unauthenticated requests; if that becomes an issue, consider adding authenticated requests or switching to a preexisting authenticated tool (e.g., gh) if available in the Renovate runtime.

Files changed (3) +69 / -5

Enhancement (1) +47 / -0

update-openshell-sha.shAdd post-upgrade script to resolve OpenShell tag commit SHA +47/-0

Add post-upgrade script to resolve OpenShell tag commit SHA

• Introduces a bash script invoked by Renovate to detect OpenShell version changes, fetch the corresponding tag commit SHA from the GitHub API, and patch OPENSHELL_SHA in openshell-version.sh. Includes validation and clean failure behavior for missing/invalid versions or SHAs.

scripts/renovate/update-openshell-sha.sh

Documentation (1) +6 / -1

openshell-version.shDocument Renovate ownership and remove inert magic comment +6/-1

Document Renovate ownership and remove inert magic comment

• Adds comments clarifying that OPENSHELL_VERSION is managed via renovate.json customManager and OPENSHELL_SHA is updated by a post-upgrade script. Removes the ineffective inline '# renovate:' comment from the shell script.

.github/scripts/openshell-version.sh

Other (1) +16 / -4

renovate.jsonStop OpenShell SHA digest tracking; add UBI10 digest automerge and postUpgradeTasks +16/-4

Stop OpenShell SHA digest tracking; add UBI10 digest automerge and postUpgradeTasks

• Updates the OpenShell packageRule to run a postUpgradeTasks script after version bumps and disables automerge for that group. Adjusts the OpenShell customManager to track only the version (not currentDigest/SHA), and adds a new rule to automerge digest-only updates for registry.access.redhat.com/ubi10/*.

renovate.json

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:59 PM UTC · Completed 5:17 PM UTC

Commit: c9522b2 · View workflow run →

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

1. Unchecked SHA replacement ✓ Resolved 🐞 Bug ☼ Reliability

Description

update-openshell-sha.sh uses sed -i to update OPENSHELL_SHA but never verifies that the
substitution matched a line, yet prints a success message regardless. If the file format changes (or
the line is missing), Renovate can leave a stale OPENSHELL_SHA while reporting it was updated.

Code

scripts/renovate/update-openshell-sha.sh[R45-47]

+sed -i "s/^OPENSHELL_SHA=.*/OPENSHELL_SHA=${SHA}/" "${FILE}"
+
+echo "updated OPENSHELL_SHA to ${SHA} for v${NEW_VERSION}"

Relevance

●●● Strong

Verifying sed substitution success is a small deterministic reliability hardening, consistent with
prior script robustness changes.

PR-#2106

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The script updates OPENSHELL_SHA with sed and then prints an unconditional success message;
OPENSHELL_SHA is then exported/consumed elsewhere to fetch the installer at that commit SHA.

scripts/renovate/update-openshell-sha.sh[45-47]
.github/scripts/openshell-version.sh[17-25]
.github/scripts/install-openshell.sh[14-16]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The script prints a success message even if `sed` didn’t actually replace an `OPENSHELL_SHA=...` line (GNU `sed` can exit 0 with zero substitutions). This can leave a stale pin while the automation reports success.

### Issue Context
`OPENSHELL_SHA` is exported by `.github/scripts/openshell-version.sh` and used to fetch the pinned installer in `.github/scripts/install-openshell.sh`.

### Fix Focus Areas
- scripts/renovate/update-openshell-sha.sh[45-47]

### Suggested fix
- Before editing, assert the target line exists exactly once:
 - `grep -q '^OPENSHELL_SHA=' "$FILE"` (or count matches and require `== 1`).
- After `sed`, verify the new value is present:
 - `grep -q "^OPENSHELL_SHA=${SHA}$" "$FILE"` and fail if not.
- Only print the "updated" message after the postcondition check passes.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Fragile SHA parsing ✓ Resolved 🐞 Bug ☼ Reliability

Description

update-openshell-sha.sh extracts the SHA by regex-grepping JSON instead of parsing the response’s
explicit top-level commit SHA field, making the result dependent on response formatting/ordering. A
valid-looking but incorrect 40-hex match would not be detected by the current validation and would
update OPENSHELL_SHA to an unintended ref.

Code

scripts/renovate/update-openshell-sha.sh[R36-38]

+curl -fsSL "https://api.github.com/repos/NVIDIA/OpenShell/commits/v${NEW_VERSION}" \
+  -o "${WORKDIR}/commit.json"
+SHA=$(grep -m1 -oP '"sha":\s*"\K[0-9a-f]{40}' "${WORKDIR}/commit.json" || true)

Relevance

●●● Strong

Team has accepted hardening GitHub API JSON handling using jq/null-safety; regex JSON parsing is a
common reliability fix.

PR-#2106

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The script currently extracts the SHA with a generic regex over the whole JSON payload, not by
parsing a specific JSON field. That SHA is then used as the immutable ref for fetching the installer
script, so a wrong pin affects installs.

scripts/renovate/update-openshell-sha.sh[36-41]
.github/scripts/install-openshell.sh[14-16]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`scripts/renovate/update-openshell-sha.sh` scrapes the commit SHA out of the GitHub API JSON with `grep`, which is brittle and implicitly depends on JSON formatting/field ordering.

### Issue Context
The updated `OPENSHELL_SHA` is used downstream to fetch and run the installer pinned to that commit.

### Fix Focus Areas
- scripts/renovate/update-openshell-sha.sh[36-41]

### Suggested fix
- Replace the `grep`-based extraction with a deterministic JSON parse of the top-level `.sha` field.
 - Since Renovate runs in a Node-based environment, a safe option is:
   - `SHA=$(node -e 'const fs=require("fs"); const j=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); process.stdout.write(j.sha||"")' "${WORKDIR}/commit.json")`
 - Keep the existing `^[0-9a-f]{40}$` validation.
- (Optional hardening) add a small `curl --retry ...` policy for transient failures.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Direct GitHub API curl call 📘 Rule violation ⌂ Architecture

Description

The new Renovate post-upgrade script calls https://api.github.com/... directly from
scripts/renovate/update-openshell-sha.sh, which is outside internal/forge/github/. This violates
the requirement to keep GitHub API calls confined to the internal/forge/github abstraction
boundary.

Code

scripts/renovate/update-openshell-sha.sh[R36-37]

+curl -fsSL "https://api.github.com/repos/NVIDIA/OpenShell/commits/v${NEW_VERSION}" \
+  -o "${WORKDIR}/commit.json"

Relevance

● Weak

Similar requests to centralize GitHub API calls into internal/forge/github were previously rejected
in this repo.

PR-#4901
PR-#5578

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 1062054 requires that code constructing URLs containing api.github.com reside
under internal/forge/github/. The added script includes a curl call to
https://api.github.com/... from scripts/renovate/update-openshell-sha.sh, which is outside the
permitted directory.

Rule 1062054: Restrict direct GitHub API calls to internal/forge/github
scripts/renovate/update-openshell-sha.sh[36-37]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`scripts/renovate/update-openshell-sha.sh` makes a direct request to `api.github.com`, but compliance requires GitHub API calls to live under `internal/forge/github/` (or be routed through that layer).

## Issue Context
This script is executed by Renovate `postUpgradeTasks` and currently uses `curl` to hit `https://api.github.com/repos/NVIDIA/OpenShell/commits/v${NEW_VERSION}`.

## Fix Focus Areas
- scripts/renovate/update-openshell-sha.sh[36-37]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 54 rules

✅ Skills: writing-user-docs, writing-adrs

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/scripts/openshell-version.sh, images/README.md, scripts/renovate/update-openshell-sha.sh — PR modifies files under protected paths (.github/, images/, scripts/). The linked issue (Dependency Dashboard #2682) and PR description explain the rationale, but human approval is always required for protected-path changes.

Low

• [stale-pr-metadata] PR title and body — The PR title still reads "fix(deps): resolve OpenShell digest lookup and add UBI digest automerge" and the PR body still describes a UBI digest automerge rule, but the diff contains no UBI-related changes. Per COMMITS.md, GoReleaser uses PR titles to build release notes, so the current title would produce an inaccurate release-note entry.
  Remediation: Update the PR title to "fix(deps): resolve OpenShell digest lookup" (dropping the UBI automerge clause) and remove or strike through the UBI automerge section of the PR body.

• [API robustness] scripts/renovate/update-openshell-sha.sh:37 — The curl call to api.github.com does not pass an Authorization header. GitHub's unauthenticated rate limit is 60 requests/hour per IP. Unlike sibling scripts that download from release asset URLs (not the REST API), this is the only script in scripts/renovate/ that calls the GitHub REST API directly, making it uniquely susceptible to rate limiting. The Renovate runner likely has a GITHUB_TOKEN or GITHUB_COM_TOKEN available.

• [supply-chain integrity] scripts/renovate/update-openshell-sha.sh:38 — The script resolves OPENSHELL_SHA via the GitHub API without cryptographic verification. Unlike sibling cosign/tirith scripts that verify sigstore signatures, this trusts a single unauthenticated GitHub API response. Mitigated by HTTPS, SHA format validation, automerge: false requiring human review, and the upstream repo needing to be compromised to host a malicious commit.

Previous run

Review

Findings

Medium

• [scope-creep] renovate.json:39 — The UBI digest automerge rule is not authorized by the linked issue Dependency Dashboard #2682, which reports only the OpenShell digest lookup failure. The PR body cites 'SEC-PATCH-REQ-2' as justification, but this is an opaque internal reference without a linked issue or ADR. Adding a new automerge policy for an unrelated package group is a distinct feature that changes the project's dependency automation posture and warrants its own tracked authorization.
  Remediation: Either (a) file a separate issue for UBI digest automerge referencing the security requirement, link it from the PR, and add the issue number to the PR body/title, or (b) split the UBI automerge rule into its own PR with proper authorization traceability.

• [protected-path] .github/scripts/openshell-version.sh, images/README.md, scripts/renovate/update-openshell-sha.sh — PR modifies files under protected paths (.github/, images/, scripts/). The linked issue (Dependency Dashboard #2682) and PR description explain the rationale, but human approval is always required for protected-path changes.

Low

• [API robustness] scripts/renovate/update-openshell-sha.sh:37 — The curl call to api.github.com does not pass an Authorization header. GitHub's unauthenticated rate limit is 60 requests/hour per IP. Unlike sibling scripts that download from release URLs (not the REST API), this is the only script in scripts/renovate/ that calls the GitHub REST API directly, making it uniquely susceptible to rate limiting. The Renovate runner likely has a GITHUB_TOKEN or GITHUB_COM_TOKEN available.

• [supply-chain integrity] scripts/renovate/update-openshell-sha.sh:38 — The script resolves OPENSHELL_SHA via the GitHub API without cryptographic verification. Unlike sibling cosign/tirith scripts that verify sigstore signatures, this trusts a single API response. Mitigated by HTTPS, SHA format validation, automerge: false requiring human review, and the upstream repo needing to be compromised to host a malicious commit.

Previous run (2)

Review

Findings

Medium

• [scope-creep] renovate.json:39 — The UBI digest automerge rule is not authorized by the linked issue Dependency Dashboard #2682, which reports only the OpenShell digest lookup failure. Adding a new automerge policy is a distinct feature change.
  Remediation: Split into a separate PR with its own authorization, or update the linked issue to cover both changes.

• [protected-path] .github/scripts/openshell-version.sh, scripts/renovate/update-openshell-sha.sh — PR modifies files under protected paths (.github/, scripts/). The linked issue (Dependency Dashboard #2682) and PR description explain the rationale, but human approval is always required for protected-path changes.

Low

• [supply-chain integrity] scripts/renovate/update-openshell-sha.sh:36 — The script resolves OPENSHELL_SHA via the GitHub API without cross-verification. Unlike sibling cosign/tirith scripts that verify binary signatures, this trusts a single API response. Mitigated by HTTPS, SHA format validation, and automerge: false requiring human review.

• [API robustness] scripts/renovate/update-openshell-sha.sh:36 — The curl call to api.github.com does not pass an Authorization header. GitHub's unauthenticated rate limit is 60 requests/hour per IP. Consider using GITHUB_COM_TOKEN or GITHUB_TOKEN if available in the Renovate runner environment.

• [fragile parsing] scripts/renovate/update-openshell-sha.sh:38 — SHA extracted from JSON using grep -m1 -oP relies on pretty-printed output. Using jq '.sha' would be more robust, though the existing approach fails safely (SHA validation rejects bad extractions).

• [missing-documentation] images/README.md:140 — The "Updating pinned versions" section does not mention that OpenShell SHA resolution is now automated via postUpgradeTasks.

---

Labels: PR modifies Renovate dependency config and OpenShell sandbox version-tracking scripts.

[ralphbean]

Going through these one at a time:

• protected-path: intentional — the whole point of this PR is to touch .github/scripts/openshell-version.sh and scripts/renovate/update-openshell-sha.sh, so this one's expected.
• missing-documentation: fixed in 2137bff, added a note to the "Updating pinned versions" section in images/README.md.
• scope-creep, supply-chain integrity, API robustness, fragile-parsing: these are duplicates of the individual review-thread comments below, replied to each of those separately.

[waynesun09]

@ralphbean the commit 2137bff is missing

[ralphbean]

On the internal/forge/github rule flag (#6110 (comment)) — I think that boundary's meant for Go app code calling the GitHub API at runtime, not one-off Renovate shell scripts. Matches the precedent from #4901 and #5578 too. Happy to reconsider if we want Renovate tooling under the same umbrella.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:03 PM UTC · Completed 5:21 PM UTC

Commit: 2137bff · View workflow run →

[ralphbean]

/fs-fix somehow my local changes got lost. please address all of @waynesun09's findings.

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 9:40 PM UTC · Completed 9:46 PM UTC

Commit: 2137bff · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Addressed both of @waynesun09's findings: (1) removed the UBI digest automerge rule since the runner-image build is not a required check and can't gate merges, (2) corrected the README note to accurately attribute OPENSHELL_SHA to CI host installs rather than the runner Containerfile.

Fixed (2):

1. UBI digest automerge not gated on runner-image build succeeding (renovate.json): Removed the UBI10 digest automerge packageRule. The reviewer confirmed runner-image.yml is not a required status check and lacks a merge_group trigger, so automerging UBI digest bumps could merge a broken runner image into main without validation. The safety gate must exist before automerge can be safely enabled.
2. README note misattributes OPENSHELL_SHA to runner Containerfile workflow (images/README.md): Rewrote the note to correctly scope OPENSHELL_SHA to CI host installs (install-openshell.sh) rather than the runner Containerfile build. Clarified that the runner Containerfile's OpenShell install is independent — it downloads the release tarball by version and verifies with sha256sum -c against release checksums.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:47 PM UTC · Completed 10:04 PM UTC

Commit: d68e0b0 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[waynesun09]

Review

High

PR title/description still claim a UBI digest-automerge rule that was reverted in the final commit (renovate.json)

The PR title ("...and add UBI digest automerge") and the Summary bullet in the PR body still describe a packageRule that automerges Docker digest bumps for registry.access.redhat.com/ubi10/*, cite it as evidence for internal requirement "SEC-PATCH-REQ-2", and the closing Note claims "#6021 and #6047 (queued UBI digest-bump PRs) were reviewed, approved, and enqueued in the merge queue by hand, since the new automerge rule doesn't apply retroactively to already-open PRs" — all implying the rule exists on the branch.

It did, briefly: the rule was added in the first commit (c9522b2f) with automerge: true for the ubi10 group, then flagged HIGH in review because it wasn't gated on the runner-image build actually succeeding (.github/workflows/runner-image.yml is not a required status check and has no merge_group trigger, so platformAutomerge could merge an unvalidated/broken runner image). The author accepted this and removed the rule entirely in the final commit (d68e0b04, "Remove UBI digest automerge rule: runner-image.yml is not a required status check and lacks a merge_group trigger...").

Confirmed at the current head (d68e0b04) via the GitHub API: renovate.json has zero occurrences of ubi, ubi10, or registry.access.redhat.com — the packageRules array only contains the patch/pin, submodule, fullsend-self-reference, openshell, cloudflare, cosign, and tirith rules.

The PR title/body/Note were never updated after the revert, so at head the PR claims SEC-PATCH-REQ-2 compliance evidence and hand-merged-PR bookkeeping that no longer reflects what the code does — misleading for reviewers, auditors, and anyone reading squash-merge history later, and it leaves the actual automerge gap for #6021/#6047-style UBI digest PRs silently unresolved. The Testing checklist's renovate-config-validator bullet is also stale for the same reason (it reads as validating a config that includes the now-removed rule).

Suggestion: Update the PR title to drop "and add UBI digest automerge", and rewrite the body to remove the UBI packageRule Summary bullet, the SEC-PATCH-REQ-2 citation, and the #6021/#6047 Note — or replace them with an explicit statement that UBI automerge was attempted, reverted pending a proper required-check/merge_group gate on runner-image.yml, and remains open (tracked separately) for SEC-PATCH-REQ-2. Also re-run/re-note the renovate-config-validator Testing bullet against the final (post-revert) config.

[ralphbean]

Updated the PR title and description to drop the UBI automerge references — the rule got removed in d68e0b0 but the metadata didn't follow. Should be accurate now.

[fullsend-ai-retro]

🤖 Finished Retro · ❌ Failure · Started 5:23 PM UTC · Completed 5:23 PM UTC

Commit: d68e0b0 · View workflow run →