fix(renovate): mirror flake.nix Go vendorHash + cap wails/v3 below 3.1 (RIG-2852) - #681
Open
rigel-mintaka wants to merge 2 commits into
Open
fix(renovate): mirror flake.nix Go vendorHash + cap wails/v3 below 3.1 (RIG-2852)#681rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
|
Compass engineering docs preview: https://dependencies-rig-2852-renova.compass-eng-docs.pages.dev Deployed from |
rigel-mintaka
force-pushed
the
dependencies/rig-2852-renovate-flake-vendorhash-wails-cap
branch
2 times, most recently
from
August 27, 2026 19:30
bab15aa to
61074b7
Compare
rigel-mintaka
marked this pull request as ready for review
August 27, 2026 19:30
…1 (RIG-2852) Two Renovate gaps surfaced landing GTK4 T1 (RIG-2818, PR #667), both in tools/renovate/. Gap 1 (bug, all Go bumps): refresh-fod-hashes.ts refreshed the Go vendorHash in guest-image/default.nix but not the IDENTICAL one in flake.nix:52 — both are buildGoModule + proxyVendor over the same go/, so a gomod bump moves both and the stale flake.nix pin failed `nix flake check` (hash-mismatch), the RIG-2432 easy-dep-bump failure class. Add a `mirrorFiles` field to the Go FodEntry: the build vehicle realises guestd's FOD once, and the recomputed SRI is mirrored to flake.nix (equal by construction, no second realise). Add flake.nix to the top-level postUpgradeTasks.fileFilters so Renovate commits the mirror edit. Gap 2 (safety, wails): no cap on github.com/wailsapp/wails/v3, so Renovate would auto-open a v3.1 bump violating the GTK4-migration "Never v3.1" floor (compass-gtk4-migration/design.md §Global Constraints). Add a gomod packageRule capping it with a REGEX allowedVersions `/^v?3\.0\./` — not a semver range, because gomod's node-semver ranges exclude a prerelease at a different major.minor.patch, so `< 3.1.0-0` would wrongly reject the current v3.0.0-beta.0 pin. Admits v3.0.0-beta.N and future v3.0.x; rejects v3.1+ and v4+. Tests: refresh-fod-hashes.test.ts asserts the flake.nix mirror is refreshed to the same SRI on a go/go.mod bump (red-green verified against a neutered mirror loop); config.test.ts pins the flake.nix fileFilter and replays the wails regex against v3.0.0-beta.0 / v3.1.0 / v4.0.0 (red-green verified against a loosened cap). renovate:ci green (92 pass, typecheck + biome clean). Refs RIG-2852, RIG-2818, PR #667.
…cap test to live pin
Review round 1 (0 high / 0 medium / 2 low) doc-accuracy nits, both fixed:
- config.json5: the wails-cap comment said go/go.mod pins v3.0.0-beta.0, but it
now pins v3.0.0-beta.14 (Renovate bumped it via RIG-2818). No behavioral change
— the regex admits both — but the comment was stale. Made it version-agnostic
("a v3.0.0 prerelease today") so it can't drift on the next beta bump.
- config.test.ts: the cap-replay test asserted hard-coded v3.0.0-beta.0/beta.7,
never the actual pin. Now it reads the wails require line from go/go.mod and
asserts the shipped regex admits whatever is pinned — tying the cap to ground
truth (mirrors the postgres-stack live-extraction test), so a future pin/regex
pairing that would open zero PRs fails here. Red-green verified: a cap that
rejects the live pin reds the ground-truth assertion.
renovate:ci green (92 pass, typecheck + biome clean).
Refs RIG-2852.
Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
dependencies/rig-2852-renovate-flake-vendorhash-wails-cap
branch
from
August 28, 2026 03:05
61074b7 to
97f71bf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two Renovate gaps surfaced landing GTK4 T1 (RIG-2818, PR #667), both in
tools/renovate/.
Gap 1 (bug, all Go bumps): refresh-fod-hashes.ts refreshed the Go vendorHash
in guest-image/default.nix but not the IDENTICAL one in flake.nix:52 — both
are buildGoModule + proxyVendor over the same go/, so a gomod bump moves both
and the stale flake.nix pin failed
nix flake check(hash-mismatch), theRIG-2432 easy-dep-bump failure class. Add a
mirrorFilesfield to the GoFodEntry: the build vehicle realises guestd's FOD once, and the recomputed SRI
is mirrored to flake.nix (equal by construction, no second realise). Add
flake.nix to the top-level postUpgradeTasks.fileFilters so Renovate commits the
mirror edit.
Gap 2 (safety, wails): no cap on github.com/wailsapp/wails/v3, so Renovate
would auto-open a v3.1 bump violating the GTK4-migration "Never v3.1" floor
(compass-gtk4-migration/design.md §Global Constraints). Add a gomod packageRule
capping it with a REGEX allowedVersions
/^v?3\.0\./— not a semver range,because gomod's node-semver ranges exclude a prerelease at a different
major.minor.patch, so
< 3.1.0-0would wrongly reject the currentv3.0.0-beta.0 pin. Admits v3.0.0-beta.N and future v3.0.x; rejects v3.1+ and v4+.
Tests: refresh-fod-hashes.test.ts asserts the flake.nix mirror is refreshed to
the same SRI on a go/go.mod bump (red-green verified against a neutered mirror
loop); config.test.ts pins the flake.nix fileFilter and replays the wails regex
against v3.0.0-beta.0 / v3.1.0 / v4.0.0 (red-green verified against a loosened
cap). renovate:ci green (92 pass, typecheck + biome clean).
Refs RIG-2852, RIG-2818, PR #667.