Configure Renovate postUpgradeTasks to sync mint embed files after Go dependency updates

[fullsend-ai-retro]

What happened

Renovate opened PR #2854 bumping functions-framework-go in internal/mint/go.mod. The current renovate.json has postUpdateOptions: ["gomodTidy"] but no postUpgradeTasks, so Renovate's commit only contained the go.mod/go.sum changes. The lint-mint-embed-sync pre-commit hook failed in CI because the .embed copies were not updated. The PR has auto-merge enabled but cannot merge due to this CI failure. A human (ralphbean) triggered /fs-retro specifically asking how to make Renovate handle this automatically.

What could go better

Renovate has a postUpgradeTasks feature (available in self-hosted mode, which this repo uses via renovate-fullsend[bot]) that can run arbitrary commands after updating dependencies and include the resulting file changes in the commit. This would let Renovate PRs touching internal/mint/go.mod automatically include the synced .embed files, passing CI without manual intervention. This is a recurring risk: any future Renovate bump to a dependency in the mint module will hit the same failure.

Proposed change

After hack/sync-mint-embed exists (see companion proposal), add a postUpgradeTasks block to renovate.json scoped to the mint module:

{
  "packageRules": [
    {
      "description": "Sync mint embed files after Go dependency updates in internal/mint",
      "matchFileNames": ["internal/mint/go.mod"],
      "postUpgradeTasks": {
        "commands": ["hack/sync-mint-embed"],
        "fileFilters": ["internal/dispatch/gcf/mintsrc/**"],
        "executionMode": "update"
      }
    }
  ]
}

This scopes the task to only run when Renovate modifies internal/mint/go.mod, and includes only the embed output files in the commit. The executionMode: "update" ensures it runs per-update rather than per-branch. Also verify that the Renovate runner's allowedPostUpgradeCommands config permits hack/sync-mint-embed (self-hosted Renovate requires explicit allowlisting of post-upgrade commands).

Validation criteria

The next Renovate PR that bumps a dependency in internal/mint/go.mod includes updated .embed files in the same commit, and the lint-mint-embed-sync pre-commit hook passes in CI without manual intervention. Verify on at least one real Renovate PR before considering this resolved.

---

Generated by retro agent from #2854

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:54 PM UTC · Completed 7:57 PM UTC
Commit: 0a95cac · View workflow run →

[fullsend-ai-triage]

Triage Assessment

This issue is blocked on #2965, which creates the hack/sync-mint-embed script that the proposed postUpgradeTasks configuration would invoke. The issue body explicitly notes this dependency: the Renovate config change should land after the sync script exists.

Currently, only hack/lint-mint-embed-sync exists (a read-only checker that detects desync). The write-side script (hack/sync-mint-embed) that would actually copy and transform the files has not been implemented yet.

Once #2965 is resolved

The implementation is straightforward:

1. Add a postUpgradeTasks block to renovate.json scoped to internal/mint/go.mod
2. Ensure the self-hosted Renovate runner's allowedPostUpgradeCommands permits hack/sync-mint-embed
3. Consider also scoping to internal/mintcore/ changes, since AGENTS.md documents that mintcore files also have .embed counterparts under mintsrc/mintcore/
4. Validate on the next real Renovate PR (e.g., re-run against PR #2854 which is currently stuck on this exact failure)

Blocked by:

• Add hack/sync-mint-embed script to automate embed file sync #2965

---

Labels: Renovate config change for mint embed sync touches CI automation and the mint component; blocked on a prerequisite issue.