[marcusrbrown]

When Renovate bumps the OpenCode V2 pin, it now regenerates the pin's sha256 digests. Before this, #1989 changed version and kept the 2.2.0 digests, so the V2 image build failed digest verification.

• New postupgrade task. The V2 pin rule in .github/renovate.json5 now runs its own postUpgradeTasks, in branch mode: bun install --ignore-scripts, bun run postupgrade (bun scripts/sync-opencode-v2-pin.ts), then bun run build. A rule-level list replaces the top-level one, so the full list is repeated.
  • The sync runs before the build because the Action bundle embeds the pin.
  • The command list has to match the fixed allowedCommands in bfra-me/renovate-action, and postupgrade is one of the script names it allows. node scripts/... would be rejected.
• No manual step. The prBodyNotes instruction to run the script by hand is gone.
• Test. scripts/renovate-v2-pin-postupgrade.test.ts pins the allowlist regexes copied from the action and asserts that all three commands match, in order.

Verification

• I simulated the Renovate branch locally: pin at 2.2.3 with the 2.2.0 digests. --check exited 1 before the three commands and 0 against upstream 2.2.3 after them. I restored the pin afterwards; this PR doesn't bump it.
• bun install and bun update don't trigger postupgrade.
• The script's main guard works under bun.
• check-types, lint, build (dist/ unchanged) and test:scripts (732) pass.

Once this merges, ticking #1989's rebase box should regenerate it with correct 2.2.3 digests.

[fro-bot]

Verdict: PASS

The command order regenerates digests before bundling, preserves install/build steps, and matches the upstream runner allowlist. No actionable correctness, security, or public-API regressions found.

Blocking issues

None

Non-blocking concerns

None

Missing tests

Optional: a subprocess smoke test for the Bun entry-point guard. Existing tests cover configuration wiring and injected sync behavior, but not execution through bun run postupgrade.

Risk assessment (LOW): likelihood of regression, security exposure, or blast radius

Scoped to V2 Renovate updates; digest validation and failure-before-write behavior remain intact. No tests, build, lint, or type checks were run, per instructions.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/agent
Run ID	41162453053
Cache	hit
Session	ses_e7015e49fffeYatsLwK6QaWOwW
Scope	All eight changed files and relevant sync tests
Verification	Static inspection and upstream runner allowlist inspection
Workflow limitation	Packaged review-validation references were access-denied; verdict is based on direct source inspection