chore(deps): Renovate config, packageManager-derived pnpm in CI, repo-wide format

[devin-ai-integration]

Summary

Dependency hygiene for the repo: a Renovate config, CI that can no longer disagree with
package.json about which pnpm to run, and a format script that covers the whole repo instead of a
hand-maintained path list. Closes #1422.

pnpm version drift. .github/actions/setup-node-pnpm carried its own pnpm-version: '11.1.2'
default — a second source of truth next to packageManager, so a bump on one side stayed green while
local (corepack) and CI ran different pnpm. The input is gone; the action derives the version and
then asserts it:

- id: package-manager                       # pnpm@11.17.0 -> 11.17.0, fails on a non-pnpm/absent spec
  run: spec="$(node -p "require('$GITHUB_WORKSPACE/package.json').packageManager ?? ''")"
- uses: pnpm/action-setup@...
  with: { version: ${{ steps.package-manager.outputs.pnpm-version }} }
- run: '[ "$(pnpm --version)" = "$EXPECTED_PNPM_VERSION" ] || exit 1'   # after setup-node, so a
                                                                       # PATH/corepack surprise fails loudly

No workflow passed pnpm-version, so no caller changes. The assert step is the point: resolving the
version is not the same as proving the pnpm actually on PATH is that version. packageManager is
bumped to pnpm@11.17.0 in the same commit set, which is now a one-line change with no CI edit.
Locally the same field is activated by corepack enable pnpm, now the documented setup step — that
is what silences the local pnpm drift warning.

Renovate (.github/renovate.json, validated with renovate-config-validator): weekly
lockfile maintenance, one grouped devDependencies PR, groupName: null for runtime deps so each
gets its own PR, action digest bumps via helpers:pinGitHubActionDigests + pinDigests, a
packageManager group so the pnpm pin above gets its own PR, and a minimumReleaseAge: "7 days"
supply-chain floor. automerge: false at the top level and on every packageRules entry,
lockFileMaintenance, and vulnerabilityAlerts — inheritance makes a single top-level false easy
for a later preset to defeat. Security updates are enabled explicitly (vulnerabilityAlerts.enabled

• osvVulnerabilityAlerts) and are the only updates that opt out of the release-age floor
  (minimumReleaseAge: null). The examples/test-app group is scoped to devDependencies only, so
  rule-merge order cannot regroup that app's runtime deps out of the one-PR-per-runtime-dep policy.

format/format:check generalized. They enumerated ~25 paths, so anything outside the list
(scripts/, workflows, website/rspress.config.ts, the test-app screens) silently drifted, and every
new formattable tree needed a package.json edit:

-"format": "node ./node_modules/oxfmt/bin/oxfmt --write src test skills scripts/fuzz ... .oxfmtrc.json '!test/skillgym/.skillgym-results/**'"
+"format": "node ./node_modules/oxfmt/bin/oxfmt --write"

With no path argument oxfmt formats the repo, already skipping node_modules and honoring
.gitignore, so the single exclusion list is .oxfmtrc.json ignorePatterns. Added there:
**/*.md (prose stays hand-wrapped, as before), scripts/maestro-conformance/corpus/** (upstream
fixture data whose bytes are the oracle — and one deliberately invalid YAML file that oxfmt
hard-errors on), and the generated fallow-baselines/, mutation-baselines/. The resulting one-time
reformat is 45 files, mechanical only: quote style in workflows/YAML, collapsed single-element JSON
arrays, wrapping. One gate was coupled to the old quote style: scripts/mutation/workflow.test.ts
parsed the affected-lane path filters with /^ {6}- "(?<glob>[^"]+)"$/, which matched nothing once
oxfmt rewrote them to single quotes (the mutation lane's Select affected kernels job caught it).
The regex now accepts either quote spelling via a backreference; the assertion itself is unchanged.

CONTRIBUTING gains the gating paragraph: Renovate PRs are reviewed like human PRs — green CI plus a
green affected-check plan (which fails open to the full set for lockfile/workflow diffs), never
rubber-stamp automerge. AGENTS.md's formatting note now points at ignorePatterns instead of
naming scripts/ as deliberately unformatted.

Requires a repo admin (not doable in this PR)

• Install/authorize the Renovate GitHub App on callstack/agent-device (or grant the
  self-hosted runner's token access). Until then the config is inert and no Renovate PR opens.
• Enable Dependency graph + Dependabot alerts in repo settings; vulnerabilityAlerts and
  osvVulnerabilityAlerts read GitHub's advisory data, so security PRs stay dormant without them.
• Ensure the dependencies / security labels exist (Renovate creates them if the app has write
  access).

Validation

CI green on 043e721 (31/31 checks, including the mutation lane), which is the only place the action
change is provable: every job routes through setup-node-pnpm, so a broken resolve/assert step fails all of
them. Locally: pnpm format:check, pnpm lint, pnpm typecheck, pnpm maestro:conformance,
pnpm depgraph:test, pnpm check:affected:test, pnpm check:mcp-metadata green after the reformat,
plus pnpm mutation:test and pnpm check:affected --base origin/main --run, which fails open to the
full 19-check set on these paths and was green through every locally runnable check. corepack install activates pnpm@11.17.0 and pnpm install reports the lockfile unchanged.

Residual risk / gaps:

• skillgym in the local plan cannot run here (spawn claude ENOENT); it has no CI job either, and
  no skills/ file changed.
• examples/test-app typecheck needs pnpm test-app:install, not run here; its two touched files are
  pure re-wrapping.
• pnpm build needs Node ≥ 24.11 (tsdown loads tsdown.config.ts natively; the optional unrun
  peer is absent), so local runs used Node 24.13 to match CI — unrelated to this diff.

Touched 50 files, 45 of them the one-time mechanical reformat; scope expanded from CI/tooling config
to that reformat at the reviewer's request.

Link to Devin session: https://app.devin.ai/sessions/9c55972f3d1545eeaf1d3b8efbe42b7c
Requested by: @thymikee

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.87 MB	1.87 MB	0 B
JS gzip	598.7 kB	598.7 kB	0 B
npm tarball	714.4 kB	714.2 kB	-210 B
npm unpacked	2.50 MB	2.50 MB	-1.6 kB

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	26.6 ms	27.2 ms	+0.7 ms
CLI --help	57.2 ms	58.5 ms	+1.2 ms

Top changed chunks: no changes in the largest emitted chunks.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-28 11:50 UTC

[thymikee]

Not ready — one configuration mismatch remains:

P2 — the fixture-app rule regroups runtime dependencies. .github/renovate.json:51-54 matches examples/test-app/package.json and assigns groupName: "test-app fixture dependencies". Renovate merges all matching package rules in order, so this later rule overrides the preceding groupName: null runtime rule and groups that app’s runtime dependencies. That contradicts #1422 and CONTRIBUTING’s “one PR per runtime dependency” policy. Remove or restrict the fixture rule so runtime dependencies remain individual, or explicitly record an accepted exception and align the policy text.

Everything else reviewed clean at 043e721: current checks are green and merge state is clean; packageManager is the single pnpm source with a post-setup assertion; Renovate’s pinned Actions/security/automerge/release-age settings are sound; and the repository-wide formatter change plus mechanical reformat are consistent. Renovate app authorization and the missing dependency/security labels remain disclosed admin prerequisites.

[devin-ai-integration]

P2 — the fixture-app rule regroups runtime dependencies.

Fixed in 43e4aed: the fixture rule is now scoped to matchDepTypes: ["devDependencies"] (group renamed test-app fixture devDependencies, slug test-app-dev), so merge order can only regroup that app's dev tooling. Its runtime deps no longer match the rule and fall through to the groupName: null runtime rule, i.e. one PR each — matching #1422 and the CONTRIBUTING policy text, no exception needed. Re-validated with renovate-config-validator.

[thymikee]

Re-reviewed head 43e4aed: the prior Renovate grouping finding is fixed. The fixture-specific rule now matches only devDependencies, so test-app runtime dependencies continue to match the earlier groupName: null rule and remain individual PRs, while fixture dev dependencies are grouped as intended. No new code finding.

Code review is clean and this head is ready for human review while the remaining checks finish. Residual admin acceptance remains external to this PR: Renovate app/permissions and the repository’s dependency-security prerequisites must be enabled before the first real Renovate/security PR can prove the configuration end to end.