Skip to content

chore(deps): update dependency nvidia/openshell to v0.1.4 - #8299

Merged
waynesun09 merged 1 commit into
mainfrom
renovate/openshell
Oct 16, 2026
Merged

waynesun09 merged 1 commit into
mainfrom
renovate/openshell

Conversation

@renovate-fullsend

@renovate-fullsend renovate-fullsend Bot commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
NVIDIA/OpenShell patch 0.1.2 → 0.1.4

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

NVIDIA/OpenShell

v0.1.4: OpenShell v0.1.4

Compare Source

OpenShell v0.1.4
Quick install
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.4 sh
What's Changed
New Contributors

Full Changelog: NVIDIA/OpenShell@v0.1.3...v0.1.4

v0.1.3: OpenShell v0.1.3

Compare Source

OpenShell v0.1.3
Quick install
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.3 sh
What's Changed
New Contributors

Full Changelog: NVIDIA/OpenShell@v0.1.2...v0.1.3


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:25 PM UTC · Completed 3:32 PM UTC

Commit: 29831a4 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.37

@codecov

codecov Bot commented Oct 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Oct 10, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Risk Assessment: moderate (2/5)

Details

Automated small patch bump by a bot touches a protected path (.github/) with recent regression history and multi-author activity in the target files, resulting in a moderate risk rating.

Previous run

Risk Assessment: moderate (2/5)

Details

Automated small patch bump by a bot touches a protected path (.github/) with recent regression history and multi-author activity in the target file, resulting in a moderate risk rating.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Automated small patch bump by a bot touches a protected path (.github/) with recent regression history and multi-author activity in the target file, resulting in a moderate risk rating.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Automated small patch bump by bot touches a protected path (.github/) with recent regression history and multi-author activity in the target file, resulting in a moderate risk rating.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Review

Findings

Medium

  • [protected-path] .github/scripts/openshell-version.sh — This PR modifies a protected path (.github/). Context is sufficient: it is a Renovate-generated patch bump (0.1.2 → 0.1.4) tracked by the customManager in renovate.json, and the body references the Dependency Dashboard issue. The new OPENSHELL_SHA (5a7728c3...) matches the commit the v0.1.4 tag resolves to in NVIDIA/OpenShell. Human approval is still required for protected-path changes regardless of context.
    Remediation: A human maintainer should review and approve the change to the protected file.
Previous run

Review

Findings

Medium

  • [protected-path] .github/scripts/openshell-version.sh:17 — This PR modifies a protected path (.github/): it bumps OPENSHELL_VERSION (0.1.2 → 0.1.4) and OPENSHELL_SHA. Human approval is always required for protected-path changes, regardless of context. The PR has no linked issue, but the description explains the update (a Renovate dependency bump with upstream release notes), and renovate.json explicitly configures this file via a customManager plus a postUpgradeTasks SHA refresh. The new SHA 5a7728c304b5528e954e9ae900cf21f84e1a12b1 matches the commit that upstream tag v0.1.4 resolves to. The correctness, security, style, intent and docs sub-agents raised no further findings.
Previous run (2)

Review

Findings

Medium

  • [protected-path] .github/scripts/openshell-version.sh — This PR modifies a file under the protected path .github/. Human approval is always required for protected-path changes, regardless of context. Context: the PR is a Renovate patch bump (0.1.2 → 0.1.4) that changes only OPENSHELL_VERSION and OPENSHELL_SHA in a CI-sourced pin file; the PR body references the Dependency Dashboard (Dependency Dashboard #2682) but there is no linked authorizing issue. The sub-agent reviews (correctness, security, style, docs, intent) found no defects in the diff, and the new SHA matches the commit that the upstream v0.1.4 tag resolves to.
    Remediation: A human maintainer with authority over .github/ should approve and merge.
Previous run (3)

Review

Findings

Medium

  • [protected-path] .github/scripts/openshell-version.sh:17 — This PR modifies a protected path (.github/). It is a Renovate-generated bump of OPENSHELL_VERSION and OPENSHELL_SHA, and renovate.json configures this exact file and its SHA post-upgrade task. The new OPENSHELL_SHA (e1f3c82c...) matches the upstream NVIDIA/OpenShell v0.1.3 tag commit as returned by the GitHub API. Human approval is still required for protected-path changes, regardless of context.

Low

  • [stale-fallback] hack/gitlab-runner-vm/setup.sh:61 (also create-gcp-vm.sh:179, create-openshift-vm.sh:132) — All three scripts still use ${OPENSHELL_VERSION:-0.1.2} as a fallback. Each carries the comment "keep in step with openshell-version.sh". The fallback applies only when the pin file is absent and OPENSHELL_VERSION is unset, so normal runs use 0.1.3. The earlier manual bump (311c1ef) updated these together with the pin.
    Remediation: Change the fallback to ${OPENSHELL_VERSION:-0.1.3} in all three scripts.

  • [stale-doc] docs/guides/user/running-agents-locally.md:56 — The walkthrough hardcodes export OPENSHELL_VERSION=0.1.2 (line 56) and supervisor_image = "ghcr.io/nvidia/openshell/supervisor:0.1.2" (line 74). Inline comments tell readers to check the pin file, but anyone copying the snippets as written installs 0.1.2.
    Remediation: Update line 56 to 0.1.3 and line 74 to supervisor:0.1.3.


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review[bot]

This comment was marked as outdated.

@renovate-fullsend renovate-fullsend Bot changed the title chore(deps): update dependency nvidia/openshell to v0.1.3 chore(deps): update dependency nvidia/openshell to v0.1.4 Oct 14, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:30 AM UTC · Completed 3:36 AM UTC

Commit: 11064a2 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.07

@fullsend-ai-review
fullsend-ai-review Bot dismissed their stale review October 14, 2026 03:36

Superseded by updated review

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Oct 14, 2026
gklein added a commit to gklein/fullsend that referenced this pull request Oct 15, 2026
…nts guide

Renovate tracked the OpenShell pin only in
.github/scripts/openshell-version.sh, so every bump left the two copies
in docs/guides/user/running-agents-locally.md stale: the install snippet
(export OPENSHELL_VERSION=) and the supervisor image in the gateway.toml
example. Open Renovate PR fullsend-ai#8299 (0.1.4) shows it: it touches only the
pin file.

Add a regex customManager for both lines with the same depName, so they
land in the existing openshell group PR. Automerge stays off and
postUpgradeTasks is unchanged.

Verified with renovate --platform=local: extract finds NVIDIA/OpenShell
in exactly the pin file plus the two docs lines, and lookup puts all
three on branch renovate/openshell (0.1.2 -> 0.1.4).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Gil Klein <[email protected]>
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 3:30 AM UTC · Ended 3:36 AM UTC

Commit: 8a6e6b7 · View workflow run →

@github-actions

github-actions Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Site preview

Preview: https://89c94977-site.fullsend-ai.workers.dev

Commit: 8a8f5b5378612e6d1275a417914eb857859d36b3

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:30 AM UTC · Completed 3:36 AM UTC

Commit: 8a6e6b7 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.10

@waynesun09

Copy link
Copy Markdown
Member

Blocked by #8484: on OpenShell 0.1.4, sandbox upload stops on git-ignored files, and fullsend calls it without --no-git-ignore, so the output-schema upload from .fullsend-cache/ fails. That failure is only a WARNING, so this PR can go green with the regression in place.

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:25 PM UTC · Completed 3:30 PM UTC

Commit: 8a8f5b5 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $0.80

@waynesun09

Copy link
Copy Markdown
Member

Validation on OpenShell 0.1.4

I ran this head (8a8f5b537, which includes #8485) as a real local fullsend run on an OpenShell v0.1.4 gateway (podman), with --forge github and the dummy runtime. The harness base: is fullsend-ai/agents@ce9e432 triage.yaml. Its schema is cached in a git-ignored .fullsend/.fullsend-cache/.

  ✓ Sandbox created (8.4s)
    Waiting 7.9s for the sandbox's first policy poll (OpenShell #3809)
  • Checking GitHub API connectivity from sandbox
  ✓ GitHub API reachable from sandbox (1.5s)
  ✓ Validation passed: Validating: output/agent-result.json against …/.fullsend-cache/…/content.json
    Agent exit code: 0
    Validation: passed
# in sandbox: . /sandbox/workspace/.env; fullsend-check-output output/agent-result.json
FULLSEND_OUTPUT_SCHEMA=/sandbox/workspace/.fullsend/output-schema.json
PASS: output validated against schema

Then sandbox stop (0.28 s) and sandbox start (Ready in 1.6 s). The first requests after Ready had no wait, the same command the pre-flight check runs:

gh api /rate_limit req1 exit=0
gh api /rate_limit req2 exit=0
gh api /rate_limit req3 exit=0

The 12 s first-poll wait (#3809) is not needed on 0.1.4, which includes NVIDIA/OpenShell#3819. A follow-up PR removes it. It will also bump the 0.1.2 fallback pins in hack/gitlab-runner-vm/{create-gcp-vm,create-openshift-vm,setup}.sh and correct the runner-VM README's version-skew note.

Rollout note: GitLab runner VMs provisioned before this bump keep their own 0.1.2 pin. prepare.sh rejects a job image that reports 0.1.4 ("this host only trusts the Renovate-pinned 0.1.2"). Re-provision those VMs, or copy in the new openshell-version.sh, before they run 0.1.4 runner images.

@waynesun09 waynesun09 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved: OpenShell 0.1.4 pin matches the v0.1.4 tag; #8485 landed first; validated locally on v0.1.4.

@waynesun09
waynesun09 added this pull request to the merge queue Oct 16, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 16, 2026
@waynesun09
waynesun09 added this pull request to the merge queue Oct 16, 2026
Merged via the queue into main with commit 888951b Oct 16, 2026
54 checks passed
@waynesun09
waynesun09 deleted the renovate/openshell branch October 16, 2026 17:09
waynesun09 added a commit that referenced this pull request Oct 16, 2026
OpenShell 0.1.3 and later include NVIDIA/OpenShell#3819, so the supervisor's
first settings poll no longer reloads policy and terminates connections in
flight (NVIDIA/OpenShell#3809). With the pin at 0.1.4 (#8299), the 12 s wait
before the GitHub pre-flight check is no longer needed. Local runs still on
OpenShell 0.1.2 should upgrade to the pinned version.

Signed-off-by: Wayne Sun <[email protected]>
Assisted-by: Claude

This branch was successfully deployed

1 active and 1 inactive deployments
site-preview — 8a8f5b53 Deployed Oct 16, 2026 by github-actions[bot]
dev — 8a8f5b53 Deployed Oct 16, 2026 by renovate-fullsend[bot] via behaviour #16848
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires-manual-review Review requires human judgment risk/moderate PR risk: moderate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant