chore(deps): bump renovate-blind version surfaces - #62
Merged
Conversation
Renovate-blind Surface 2 (npm plugins). Renovate's npm manager does not recognize the OpenCode plugin[] JSON shape, so this is manual. @tarquinen/opencode-dcp 3.1.13 -> 3.1.14 (published 2026-06-25, satisfies 7-day embargo; cutoff 2026-07-21). Plugin-alignment invariant preserved: @tarquinen/opencode-dcp@3.1.14 is mirrored in both opencode.json (canonical) and tui.json. Verification: ./scripts/validate.sh PASS (35/36, 1 pre-existing warning). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Renovate-blind Surface 4 (skills-lock.json content hashes). The computedHash fields are SHA256 of upstream SKILL.md content and drift as upstream changes; they must never be hand-edited. Regenerated via: npx skills@1.5.13 experimental_install --agent opencode --copy -y (same pin as Containerfile L123). 10 of 18 skill hashes refreshed (upstream SKILL.md drift); skill count unchanged at 18. The build/.agents/ working directory is gitignored. Verification: ./scripts/validate.sh PASS (35/36, 1 pre-existing warning). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Fallback per updated Supply-Chain Policy: latest tag v1.18.9 (2026-07-28) embargoed; fell back to v1.18.4 (2026-07-20), the newest tag >=7 days old. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Fallback per updated Supply-Chain Policy: latest is 4.19.3 (2026-07-28, embargoed). Fell back to 4.19.0 (2026-07-17), the newest version >=7 days old. Mirrored in opencode.json and tui.json per plugin-alignment invariant. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
tankdonut
added a commit
that referenced
this pull request
Jul 28, 2026
## What Promotes the `bumping-opencoder-versions` skill from user-level (`~/.agents/skills/`) to a project-level skill at `.agents/skills/bumping-opencoder-versions/SKILL.md`. This ships the bumping playbook with the repo so it's available to anyone (human or agent) working on opencoder. ## Why The skill was authored and iteratively refined against this repo (PR #62) and is project-specific — it has no use outside `tankdonut/opencoder`. User-level was fine for first authoring; project-level is the right home for ongoing maintenance. ## Coverage Four Renovate-blind version surfaces (Renovate owns the rest via `config:recommended`): | # | Surface | Tool | |---|---------|------| | 1 | OpenCode core (`.opencode-version` + `.opencode-checksums`) | `scripts/bump-version.sh` | | 2 | npm plugins in `opencode.json` + `tui.json` (with alignment invariant) | `jq --indent 4` edit | | 3 | `skills@X.Y.Z` pin in markdown docs (4 files) | `sed -i` across all four | | 4 | `skills-lock.json` `computedHash` values | regenerate via skills CLI | Plus: - **7-day embargo fallback policy** (matches Renovate's `minimumReleaseAge` behavior — fall back to latest eligible, don't skip) - **Two-tier verification protocol**: `validate.sh` always; `build.sh` + `container-test.sh` only with explicit user OK (5–20+ min each) - **Live-tested jq recipes** for npm and GitHub Releases embargo filtering - **Common-mistake and red-flag tables** covering the failure modes observed during PR #62 (e.g. plain `jq` defaults to 2-space indent → noisy diff; latest version embargoed → skip is wrong, fall back is right) ## Validation - Skill was executed end-to-end via subagent in PR #62 — all four surfaces bumped correctly, plugin alignment invariant preserved, `validate.sh` green - Pre-commit hooks pass on this commit (large files, merge conflicts, private key, trailing whitespace, shellcheck) - No code changes, no container changes — documentation only ## Follow-ups considered and rejected - Adding to `build/skills-lock.json`: rejected, that's for skills.sh registry skills from external repos, not project-local skills - Baking into the container image: rejected, the bumping skill is for working ON opencoder, not for using opencode to develop other projects - Updating root `AGENTS.md` to mention the skill: deferred — can be a follow-up if the convention emerges that project skills should be enumerated there
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Executes the bumping-opencoder-versions skill against this repo, applying Renovate-blind surface bumps under the 7-day embargo with fallback policy (skill updated this run to mandate fallback rather than skip when the latest version is embargoed).
Skill:
/var/home/white/.agents/skills/bumping-opencoder-versions/SKILL.mdEmbargo cutoff (recomputed at execution time):
2026-07-21T23:14:11Z(now - 7d)Commits (one per surface, for bisectability)
chore(deps): bump @tarquinen/opencode-dcp to 3.1.14@tarquinen/opencode-dcp@3.1.13→@tarquinen/opencode-dcp@3.1.14(mirrored in bothbuild/.opencode/opencode.jsonandbuild/.opencode/tui.jsonper plugin-alignment invariant). Published2026-06-25, eligible.chore(deps): refresh skills-lock.json hashescomputedHashvalues regenerated viacd build && npx skills@1.5.13 experimental_install --agent opencode --copy -y. Skill count unchanged at 18; hash-only drift from upstreamSKILL.mdcontent.chore: update opencode to v1.18.41.17.6→1.18.4(bothbuild/.opencode-versionandbuild/.opencode-checksumsupdated atomically by./scripts/bump-version.sh 1.18.4). Embargo fallback: latest tagv1.18.9(published2026-07-28, embargoed) → fell back tov1.18.4(published2026-07-20, eligible — the newest tag ≥7 days old per the skill's recipe).chore(deps): bump oh-my-openagent to 4.19.0oh-my-openagent@4.12.0→oh-my-openagent@4.19.0(mirrored in bothopencode.jsonandtui.jsonper plugin-alignment invariant). Embargo fallback: latest is4.19.3(published2026-07-28, embargoed) → fell back to4.19.0(published2026-07-17, eligible — the newest version ≥7 days old per the skill's recipe).Skipped surfaces (with reason)
cc-safety-net— Surface 21.0.6); no newer version exists on npm.AGENTS.md,build/AGENTS.md,DEVELOPMENT.md,docs/guides/usage.md) — Surface 3skills@1.5.13) match the Renovate-managed Containerfile L123 pin (skills@1.5.13). Per skill: markdown tracks the Containerfile, never races ahead. Wait for Renovate's PR.bun,ubuntu:26.04, builder digest, GitHub Actions,skills@1.5.13in Containerfile L123,build/.opencode/package.json)Embargo fallback report (per skill Reporting requirement)
v1.18.9(published2026-07-28T18:15:01Z, embargoed). Fell back tov1.18.4(published2026-07-20T15:28:21Z, eligible).oh-my-openagent: latest is4.19.3(published2026-07-28T15:33:52Z, embargoed). Fell back to4.19.0(published2026-07-17T16:40:31Z, eligible).@tarquinen/opencode-dcp: latest is3.1.14(published2026-06-25, eligible) — no fallback needed; bumped directly to latest.cc-safety-net: latest is1.0.6(already pinned) — no bump.Intermediate embargoed versions exist for both fallback surfaces (
v1.18.5–v1.18.9for OpenCode core;4.19.1,4.19.2,4.19.3foroh-my-openagent) and were correctly skipped by the fallback selection.Verification
./scripts/validate.sh— PASS (35/36 checks, 0 failures; the single WARN about error-handling in scripts is pre-existing onmainand unrelated to these bumps). Run after every commit../scripts/build.shand./scripts/container-test.sh— deferred to CI on this PR, per explicit user choice for this run. Both will run in thebuild-and-publish-imageworkflow on PR push.Cross-surface invariants checked
opencode.jsonandtui.json(@tarquinen/opencode-dcp,oh-my-openagent) use identical versions in both files..opencode-version(1.18.4) and.opencode-checksums(x64 + arm64 digests forv1.18.4) written together bybump-version.sh, never hand-edited.opencode.json,tui.json, andskills-lock.jsonall parse withjq ..computedHashvalues changed, regenerated exclusively via the skills CLI (no hand-edits).Ultraworked with Sisyphus
Co-authored-by: Sisyphus clio-agent@sisyphuslabs.ai