chore(renovate): Configure

[RasmusRendal]

Since we're supposed to update our OS weekly, and people might prefer different weekdays, I set up renovate to just update daily.

We still need to figure out how much we want to test these new nixpkgs revisions before merging them. Do they just need to work for ES, or maybe also for famedly-nixos? Maybe for a repository? Or somebody's laptop?

[cursor]

PR Summary

Low Risk
Tooling-only change with no application or auth logic; main risk is automated PR volume and merge policy for nixpkgs bumps still to be decided.

Overview
Adds Renovate via a new renovate.json so Nix inputs (e.g. flake.lock) are updated on a daily cadence instead of manual weekly bumps.

The config uses Renovate’s recommended preset, Europe/Vienna timezone, only the nix manager, and extends schedule:daily plus schedule:automergeDaily. Lock file maintenance is enabled on a before 4am schedule.

^{Reviewed by Cursor Bugbot for commit 782acda. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Renovate edits generated workflows
  • Restricted Renovate to the Nix manager so it no longer updates generated GitHub workflow action pins directly.
• ✅ Fixed: Renovate skips required filegen step
  • Added a Renovate post-upgrade task to run nix run .#filegen-activate and commit generated file outputs after Nix updates.

Or push these changes by commenting:

@cursor push 6b2b370cf8

Preview (6b2b370cf8)

diff --git a/renovate.json b/renovate.json
--- a/renovate.json
+++ b/renovate.json
@@ -5,11 +5,25 @@
     "schedule:daily"
   ],
   "timezone": "Europe/Vienna",
+  "enabledManagers": [
+    "nix"
+  ],
   "nix": {
     "enabled": true
   },
   "lockFileMaintenance": {
     "enabled": true,
     "schedule": "before 4am"
+  },
+  "postUpgradeTasks": {
+    "commands": [
+      "nix run .#filegen-activate"
+    ],
+    "fileFilters": [
+      ".github/workflows/**",
+      ".pre-commit-config.yaml",
+      "treefmt.toml"
+    ],
+    "executionMode": "branch"
   }
 }

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 7e28abb. Configure here.}

[cursor]

Renovate skips required filegen step

Medium Severity

The new Renovate setup updates flake.lock (and possibly flake.nix) but does not run nix run .#filegen-activate, which the README documents as mandatory after dependency updates. CI runs the filegen pre-commit hook via prek, so PRs that change flake inputs without refreshing generated .github/workflows and .pre-commit-config.yaml can fail even when the lock bump itself is valid.

 

^{Reviewed by Cursor Bugbot for commit 7e28abb. Configure here.}

[RasmusRendal]

We've put some care into not having nix store paths in the generated files any more, so this should only really be a problem for downstream repositories when ES changes the filegen output intentionally.

[tlater-famedly]

Changes to flake inputs might also introduce changes to e.g. treefmt.toml. This risks devshell components not being compatible with their configuration files.

It's a small risk, but worth considering.

[tlater-famedly]

I'm still not sure about this. Automerging will cause our tooling to change daily. We have no idea if e.g. new lints will get introduced and cause cascading CI failures across the company.

@lukaslihotzki-f advocated pretty heavily for having a test suite that at least spot checks other repos before wide updates like this. It's not as bad as e.g. automatic rust toolchain updates, but this will still mass-update formatters (and I haven't looked into the dart toolchain yet, but at first glance I think we'll have to fix that before we can go ahead with even formatter updates).

This also doesn't discuss how updates make it to dependant repositories.

I think the implications of unsupervised updates are a bigger policy discussion and shouldn't just be done - certainly not as a "chore".

[tlater-famedly]

Shouldn't we be generating this file with filegen, so all projects get renovate config by default?

[tlater-famedly]

Changes to flake inputs might also introduce changes to e.g. treefmt.toml. This risks devshell components not being compatible with their configuration files.

It's a small risk, but worth considering.

[tlater-famedly]

It's pretty common for flake inputs to change their inputs, causing .follows to get out of sync. We should add a flake-edit follow to our prek hooks to ensure this doesn't cause problems.