From 0cc52e69f00f7c91ee94ecb1d7d8a18b4acd9e0c Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Wed, 9 Sep 2026 17:29:45 -0400
Subject: [PATCH] ci: validate the shared dependency update policy

A mistake in the shared policy degrades to the bot staying quiet, which
looks exactly like the policy working. The file now decides update
behaviour for every repository in the org, so a bad edit disarms
dependency updates everywhere and reports nothing.

Key changes:
- Add a check that runs on every change to the policy files, failing the
  build rather than merging a policy that does nothing
- Reject options the bot does not recognise and values of the wrong
  type, which is how a typo degrades to silence
- Reject malformed JSON ahead of the bot's own validator, which accepts
  trailing commas through a JSON5 fallback and exits zero
- Fail when no policy file is found, so the check cannot pass vacuously

Claude-Session: https://claude.ai/code/session_01QP4dYFku9krW7bng4mzriX
---
 .../workflows/validate-renovate-config.yml    | 24 ++++++++++++++++++
 bin/validate-renovate-config                  | 25 +++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/validate-renovate-config.yml
 create mode 100755 bin/validate-renovate-config

diff --git a/.github/workflows/validate-renovate-config.yml b/.github/workflows/validate-renovate-config.yml
new file mode 100644
index 0000000..94f8ff0
--- /dev/null
+++ b/.github/workflows/validate-renovate-config.yml
@@ -0,0 +1,24 @@
+name: Validate Renovate config
+
+on:
+  pull_request:
+    paths:
+      - renovate-config.json
+      - renovate.json
+      - bin/validate-renovate-config
+      - .github/workflows/validate-renovate-config.yml
+  push:
+    branches:
+      - main
+    paths:
+      - renovate-config.json
+      - renovate.json
+      - bin/validate-renovate-config
+      - .github/workflows/validate-renovate-config.yml
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: ./bin/validate-renovate-config
diff --git a/bin/validate-renovate-config b/bin/validate-renovate-config
new file mode 100755
index 0000000..d5e04eb
--- /dev/null
+++ b/bin/validate-renovate-config
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+files=()
+for candidate in renovate-config.json renovate.json; do
+  [ -f "$candidate" ] && files+=("$candidate")
+done
+
+if [ ${#files[@]} -eq 0 ]; then
+  echo "no renovate config files found; nothing was validated" >&2
+  exit 1
+fi
+
+status=0
+for file in "${files[@]}"; do
+  if ! jq empty "$file" >/dev/null 2>&1; then
+    echo "$file: not strict JSON" >&2
+    status=1
+  fi
+done
+[ "$status" -eq 0 ] || exit "$status"
+
+npx --yes --package renovate -- renovate-config-validator --strict "${files[@]}"