renovate

The renovate extension keeps the dependencies in your local repos current with minimal fuss. A quiet renovate session sweeps a watch list on a schedule and, for each repo that isn't already mid-update, dispatches a worker that runs Renovate on its local platform , runs your project's tests, commits the bumps to a fresh branch, and opens a review PR — then pings the monitor so the next repo dispatches. Dependency upkeep becomes background work you only look at when a PR is ready or a major upgrade needs a decision.

Overview #

A renovate session sweeps your watched repos on a renovate-tick automation (weekly, Monday 09:00). Updaters are Thurbox tasks ( update <repo> deps … ): each runs in an isolated worktree on a fresh renovate/updates-<ts> branch and self-reports via the same ===RESULT=== sentinel as flow. The monitor and worker are plain agents.toml aliases ( renovate , renovate-worker ), so each can be any CLI.

Renovate runs only locally #

The worker always invokes Renovate with --platform=local (via scripts/renovate-run.sh , which hard-codes it): no hosted bot, no token, no Renovate-opened PRs. Renovate simply rewrites the dependency manifests + lockfiles in the worktree; the Thurbox worker owns the rest (test, commit, push, open a PR). That keeps it forge-agnostic and agent-agnostic, like Thurbox itself — the only thing baked in is git . The worker works the forge out from git remote -v and uses its client ( gh / glab ) to open the review PR; with no client it leaves the branch committed locally and says so.

Update strategy #

Two layers control how far versions move:

• Per repo — the strategy column in repos.md : patch , minor (patch + minor, the default), major , or all . It is layered onto the base config as a RENOVATE_CONFIG overlay.
• Global — renovate-config.json , Renovate's own config (grouping, version ranges, ignored deps, lockfile maintenance), passed via RENOVATE_CONFIG_FILE .

Requirements #

• git , jq , and thurbox-cli on PATH .
• Node ≥ 20 — Renovate runs via npx --yes renovate (a global renovate install is used if present). Set GITHUB_COM_TOKEN to raise GitHub API limits / fetch changelogs (optional, read-only).
• For the worker to open a review PR: the forge client authenticated ( gh auth login / glab auth login ).

Install #

renovate is a Thurbox extension (a declarative extension.toml manifest):

thurbox-cli extension install renovate    # or ./extensions/renovate
thurbox-cli extension uninstall renovate  # --purge also deletes ~/.config/thurbox/extensions/renovate

Installing lays down the renovate home ( ~/.config/thurbox/extensions/renovate ; override with --home ), registers the renovate / renovate-worker agents, and activates the renovate session plus the renovate-tick automation — both self-healed by Thurbox.

Use #

• Add the repos to keep current to ~/.config/thurbox/extensions/renovate/repos.md (one row each; strategy defaults to minor , provider to auto ).
• The monitor sweeps on its schedule; trigger one now by sending tick to the renovate session.
• status for a one-screen report; clean to prune merged update worktrees.

How the worker gets its branch #

A renovate run starts a brand-new branch, so — unlike ci-shepherd — there's no branch to adopt: dispatch-update.sh uses Thurbox's native --worktree , which runs git worktree add -b renovate/updates-<ts> origin/main . The worker runs Renovate locally there, tests, commits, and pushes that branch for review. clean removes the worktree once the PR has merged (refusing if it has uncommitted work).

Files #

See extensions/renovate for the RENOVATE.md behavior spec, the extension.toml manifest, the renovate-config.json global config, and the helper scripts ( renovate-run.sh — the local-only Renovate wrapper, renovate-snapshot.sh , dispatch-update.sh , parse-result.sh ).