fix: repair two dead Renovate custom managers, and validate config in CI - #86
Merged
Conversation
Both customManagers in renovate.json matched no file at all. Their
managerFilePatterns were written as bare regexes:
"^\\.github/workflows/.*\\.ya?ml$"
managerFilePatterns takes "regex or glob", and a value only counts as a
regex when it is wrapped in slashes. Undelimited, that string is read as a
glob and matches nothing, so neither manager has ever fired and HUGO_VERSION
has not been offered an update. The visible symptom: Hugo is pinned here at
0.163.1 while Hagmolenpups.nl, whose patterns are correctly slashed, is on
0.164.0. Both patterns are now delimited, and matching is verified against
the real workflow filenames.
Nothing reported this. renovate-config-validator calls the config valid,
because it is -- it just does nothing. So the new Config validation workflow
checks for it directly, alongside Renovate's own validator and schema
validation of dependabot.yml (absent here, so that step reports and passes).
The workflow also runs actionlint. The other repositories in the
organisation run it from their quality workflow; this one had no equivalent,
so the workflow files went unchecked.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
Both Install Hugo steps left ${HUGO_VERSION} unquoted inside the download
URL, which shellcheck reports as SC2086. The new actionlint job runs
shellcheck over every run: block and fails on it.
Harmless in practice, since the value is a version number with no spaces or
glob characters in it. Quoting is still the right shape, and it keeps the
workflow files clean under the linter that now watches them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
GitHub's release CDN hands out an occasional 503, which failed a job in THectic.nl on this same download pattern. curl already retries 5xx and timeouts when asked; --retry-all-errors extends that to connection failures. The checksum verification is unaffected: a retry only fetches the archive again, and it still has to match the pinned SHA-256. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
lycheeverse/lychee-action fetches its binary with a bare `curl -sfLO`: no retry, and no check on what comes back. That download failed twice in a quarter of an hour across this organisation while GitHub's release CDN was struggling, once in this job and once in THectic.nl, and in both cases the job gave up without having checked a single link. Replaced with a pinned version, a checksum verified against the release's own lychee-x86_64-unknown-linux-gnu.tar.gz.sha256, and a retried download. As a side effect the binary is now verified at all, which the action never did. The Renovate annotation needs an extractVersion here: lychee tags its releases "lychee-v0.24.2" rather than "v0.24.2", so the default pattern cannot read a version out of the tag and would never offer an update. The shared matchString now takes an optional extractVersion= field for this, and falls back to the default when it is absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
Two separate faults in this job, both of which made it look like it was working. The glob was being expanded by bash before lychee ever saw it. Without globstar, ** collapses to a single directory level, so the job checked 95 links where the site has 3379. Everything below /docs/<section>/ -- which is almost all of the documentation -- was never looked at. Quoting the glob hands the pattern to lychee, which expands it recursively. Once it did check the whole site, four anchors reported "Cannot find fragment" against headings that are plainly present. That is the second fault: lychee does not resolve a directory link to an index file unless --index-files says so, and it is off by default. Hugo serves every page as <page>/index.html, so lychee stopped at the directory and never opened the file the fragment lives in. --include-fragments cannot work here without it. Confirmed on a scratch tree rather than assumed: an anchor that exists passes only with --index-files, and an anchor that genuinely does not exist still fails with it. The content is fine; the check was not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
Stensel8
force-pushed
the
claude/hugo-cicd-cleanup-if8vl9
branch
from
August 12, 2026 19:43
c9247b1 to
e23b0f7
Compare
known-issues.nl.md linked to /docs/applications with the English anchor, #touchpad-scroll-speed-still-no-native-gnome-setting. relref resolves that to the Dutch page, whose heading is "Touchpad-scrollsnelheid: nog steeds geen native GNOME-instelling" and therefore carries a different slug, so the link landed at the top of the page instead of at the section. The anchor was almost certainly copied over unchanged when the page was translated. The neighbouring case, #podman--podman-desktop, survived because "Podman & Podman Desktop" is a product name and reads the same in both languages. The replacement slug is Hugo's own output for that heading, checked by rendering it rather than by deriving it by hand. It is the only language-dependent anchor in the content: the two files with anchored relrefs are known-issues and virtualization/podman, and the podman one is identical in both languages. Found by the link checker in this same branch, once it started covering more than 3% of the site. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Beide
customManagersinrenovate.jsonmatchten geen enkel bestand. Ze hebben nooit gewerkt.Type of change
fix— bug fix (broken link, incorrect command, layout issue)chore— maintenance (dependencies, config, CI/CD)De bug
De
managerFilePatternsstonden als kale regex:managerFilePatternsaccepteert "RegEx (re2) and glob patterns", en een waarde telt alleen als regex wanneer hij tussen slashes staat. Zonder die slashes wordt de string als glob gelezen, en dan matcht hij niets. Beide managers hebben dus nooit gedraaid enHUGO_VERSIONis hier nooit een update aangeboden.Het zichtbare symptoom: Hugo staat hier op 0.163.1, terwijl Hagmolenpups.nl — waar de patterns wél correct geslashed zijn — op 0.164.0 zit.
Nagemeten met Renovate's eigen matcher tegen de echte bestandsnamen:
.github/workflows/hugo.yml"^\\.github/workflows/.*\\.ya?ml$"(voor)false"/^\\.github/workflows/.*\\.ya?ml$/"(na)trueWaarom niets dit meldde
renovate-config-validatornoemt deze config geldig — en dat ís hij ook. Hij doet alleen niets. Dat is precies het lastige aan deze fout: geen error, geen waarschuwing, alleen dependencies die maanden stil blijven staan.Daarom controleert de nieuwe
config-validation.ymler direct op, naast Renovate's eigen validator.Wat de nieuwe workflow doet
renovate-config-validator --strict— Renovate's eigen validator. Zonder argumenten zoekt hij de configbestanden zelf en valideert ze als repository config; geef je een pad mee, dan valideert hij als global config, wat een zwakkere set regels is.dependabot.ymlschema-validatie — deze repo heeft er geen, dus die stap meldt dat en slaagt. Staat klaar als er ooit een bijkomt.De twee tool-versies die de workflow pint worden zelf ook bijgehouden, via een custom manager die de
# renovate:-comment erboven leest. Diezelfde manager is nu in alle vier de repo's van de organisatie aanwezig.Checklist
fix: correct nmcli command in eduroam guide)/images/*.avifall exist instatic/images/) — n.v.t.hugo server— n.v.t.; in plaats daarvan zijn de validator, de pattern-check en actionlint lokaal tegen deze repo gedraaid, en is de patroonmatch nagemeten met Renovate's eigenstring-matchmodule🤖 Generated with Claude Code
https://claude.ai/code/session_01SwrLVfDhkTVHC945s1kZ2s
Generated by Claude Code