renovate-workflow

Governed Renovate merge ladder with an Agent Plugins 1.0 portable core and Cursor-specific integration: classify dependency PRs, investigate high-risk changes, and merge only when repo-local policy and human gates allow.

Renovate opens many dependency PRs. This product turns that queue into a repeatable classify → route → (investigate) → maintainer path with explicit policy, instead of ad-hoc merges.

Background: Upgrades don't have to be a blind trust exercise (DEV Community) — the problem framing, four-step evidence checklist, and review path that led to this repository.

classify (/renovate-classifier)
    → route by packet
        → low risk → maintainer (auto path)
        → high-touch / unlisted → investigator → human audit → maintainer --approved
    → optional loop (/renovate-loop) for repeated cycles

Ownership split

Portable vs Cursor manifest layers: docs/adopt.md#portable-vs-cursor-layers-this-repo.

Install (Cursor plugin)

Cursor imports this GitHub repository as a local marketplace, then installs the listed plugin.

Step 1 — import marketplace

Customize → Plugins → + Add → From GitHub Repository → https://github.com/multipliers-dev/renovate-workflow

Or in Agent chat:

/add-plugin https://github.com/multipliers-dev/renovate-workflow

Step 2 — install plugin

Customize → Plugins → open the imported renovate-workflow marketplace → install the renovate-workflow plugin.

Full adoption guide: docs/adopt.md

Quick start (classifier only)

Minimum path to evaluate the ladder — no package.json changes required.

1. Import marketplace (step 1 above)
2. Install the renovate-workflow plugin (step 2 above)
3. Confirm /renovate-classifier appears under Customize → Plugins
4. Copy .agents/renovate-policy.template.yml to .agents/renovate-policy.yml in your repo and customize package lists, checks, and paths — see docs/policy-setup.md and examples/example-repo/
5. Ensure GitHub access (gh CLI or GitHub MCP)
6. Run /renovate-classifier

Success is queue_empty or a classification packet. The classifier never merges.

Enable loop / babysit helpers

Required for /renovate-loop --babysit and the freshness poll CLI. Not required to try the classifier.

Add the npm devDependency and script in your consumer package.json:

{
  "devDependencies": {
    "@multipliers-dev/renovate-workflow": "^0.3.0"
  },
  "scripts": {
    "renovate:freshness-poll": "renovate-workflow freshness-poll"
  }
}

See examples/adopt-stub/package.json and docs/adopt.md.

What this does not do

• Fully autonomous merging — human gates remain for high-risk and investigation paths
• Scheduled or webhook-driven automation — manual invocation only
• Classifier or investigator merge authority — only maintainer may merge, and only with a valid packet
• Loop with --approved — investigation-approved merges require a separate maintainer step
• Replace the Renovate bot — you still configure renovate.json and a Renovate workflow in your repo
• Cursor public marketplace or org Team Marketplace catalog — install via GitHub import of this repo

Documentation

Primary adopter path:

1. docs/adopt.md — plugin install + npm helpers + consumer layout
2. docs/policy-setup.md — consumer policy sync model
3. docs/renovate-workflow.md — operator runbook

Also:

• Upgrades don't have to be a blind trust exercise — background essay (DEV Community)
• docs/versioning.md — version alignment and git dependency pinning
• docs/distribution-discovery.md — architecture rationale (maintainer deep-dive)
• AGENTS.md — agent command reference

Publishing (maintainers)

This repository uses a two-step release. Merging to main never publishes.

Publishing uses npm Trusted Publishing (GitHub Actions OIDC). Do not create or store an NPM_TOKEN / NODE_AUTH_TOKEN for releases. Provenance is automatic for this public package from this public repo.

The release workflow reads name and version from the checked-out package.json only (npm publish --access public with no CLI coordinate override). It does not bump versions or commit to main. npm and plugin always share version V at the same commit. Only one release dispatch runs at a time (concurrency: release).

If npm publish succeeds but tag/GitHub Release creation fails, do not republish — verify the registry version matches the intended commit, then create the missing tag and GitHub Release manually. See docs/versioning.md § Partial release recovery.

Full policy: docs/versioning.md

Development

npm install
npm test
npm run typecheck
npm run build

Layout

plugin.json            Agent Plugins 1.0 portable manifest (metadata only)
skills/                Five renovate skills + verification assets (fixed discovery path)
.cursor-plugin/        Cursor marketplace + extension manifest (agents, skill paths)
.agents/               Agent prompts, rubric base, policy template, report templates
.cursor/               Repo-local Cursor dev (hooks, Cloud VM) — not plugin-distributed
docs/                  Adoption guides and runbook
scripts/               Guardrails, freshness poll, tests/fixtures
examples/example-repo/ Synthetic consumer stubs for policy schema tests

License

MIT