@ankhorage/devtools 1.8.3 → 1.8.5

package/README.md

@@ -313,7 +313,7 @@ A repository participates in Changesets synchronization when `.changeset/config.
 
 CI and Release render their `bun-version` from the same managed Bun runtime policy used for `package.json`. They also render Changesets status, version, and publish commands from the same policy that owns the synchronized package scripts. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and Changesets checks. Ordinary pull requests run the strict `changeset:status --since=origin/main` guard. A same-repository `changeset-release/main` pull request instead runs `bun run changeset -- status --since=HEAD`, validating the Version Packages metadata from the detached release checkout without requiring a local `main` ref or another unreleased Changeset after the release Changeset was consumed. A fork using that branch name remains subject to the ordinary strict guard. Release publishing calls the Devtools-owned runner through the synchronized package script; it never resolves an ambient or mutable Changesets executable.
 
-The Renovate workflow accepts only same-repository branches created by `renovate[bot]`. It calls the SHA-pinned `ankhorage/renovate` workflow to add a release Changeset for runtime Ankhorage dependency updates or an empty Changeset for dev-only updates, then dispatches CI for that bot-authored commit. It never checks out or executes pull-request code in the privileged `pull_request_target` context.
+The Renovate workflow accepts only same-repository branches created by `renovate[bot]`. It calls the SHA-pinned `ankhorage/renovate` workflow to add a release Changeset for runtime Ankhorage dependency updates or an empty Changeset for dev-only updates. The trusted workflow scopes the Ankhorage Renovate Sync GitHub App token to the current repository and uses it only for the validated commit, allowing every normal pull-request CI workflow to start without manual approval. It never checks out or executes pull-request code in the privileged `pull_request_target` context.
 
 ## Managed VS Code configuration
 

package/dist/tools/workflows/files/renovate.yml

@@ -8,8 +8,7 @@ on:
       - synchronize
 
 permissions:
-  actions: write
-  contents: write
+  contents: read
   pull-requests: read
 
 jobs:
@@ -18,4 +17,8 @@ jobs:
       github.actor == 'renovate[bot]' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       startsWith(github.event.pull_request.head.ref, 'renovate/')
-    uses: ankhorage/renovate/.github/workflows/changeset.yml@ae2cde4673bb58c6659bc5a7bd16739fb6f0db5e
+    uses: ankhorage/renovate/.github/workflows/changeset.yml@b9a44c350b71b4292c8da69eb469888de60b68be
+    with:
+      renovate_sync_client_id: ${{ vars.ANKHORAGE_RENOVATE_SYNC_CLIENT_ID }}
+    secrets:
+      renovate_sync_private_key: ${{ secrets.ANKHORAGE_RENOVATE_SYNC_PRIVATE_KEY }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "Shared development tools and repository standards for Ankhorage",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",
@@ -115,13 +115,13 @@
     "eslint-plugin-security": "^4.0.1",
     "eslint-plugin-simple-import-sort": "^12.1.1",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "knip": "^6.32.3",
+    "knip": "^6.33.0",
     "prettier": "^3.9.6",
-    "typescript-eslint": "^8.68.0"
+    "typescript-eslint": "^8.69.0"
   },
   "devDependencies": {
     "@ankhorage/ankh": "^0.8.4",
-    "@ankhorage/doctor": "0.10.2",
+    "@ankhorage/doctor": "0.10.4",
     "@types/bun": "^1.4.0",
     "@types/node": "^25.9.5",
     "typescript": "^5.9.3"