feat: renovate, a branded verdict header and comment: on-failure

[HugoRCD]

Renovate

renovate.json: config:recommended, SHA-pinned GitHub Actions (helpers:pinGitHubActionDigests), weekly window, 2-day minimum release age. A regex manager reads the # renovate: datasource=npm depName=@evlog/cli marker above the version default in action.yml, so a CLI release becomes a PR here, with no waiting period for our own package. Merging that PR and tagging is how the action adopts a new CLI.

Comment

• Header: evlog mark + evlog map, then one line to read: **56** needs work · -8 against main · 1 regression, or **64** needs work across 2 packages · below min-score 70. Footer links to this repository.
• comment: on-failure: posts only when the gate failed; an existing comment is updated either way, so a fixed gate turns its comment green instead of leaving it behind.
• README documents posting as your own app via actions/create-github-app-token and the token input, for a branded bot identity.

The test workflow now leaves one comment per PR (the baseline job); single-package exercises on-failure, monorepo posts nothing.

Unit tests: 58.

Summary by CodeRabbit

• New Features
  • Added an “on failure” comment mode: comments are created when the gate fails, while existing comments continue to update on every run.
  • Reports now include a concise verdict with package scores and, when available, baseline movement and regressions.
• Documentation
  • Clarified comment-mode behavior and added examples for failure-only comments and posting comments as a custom bot.
  • Updated version and release guidance.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 973f8f06-0c92-441d-9c38-68c930919f97

📥 Commits

Reviewing files that changed from the base of the PR and between b819c55 and 797ab0e.

📒 Files selected for processing (12)

• .github/workflows/test.yml
• AGENTS.md
• README.md
• action.yml
• renovate.json
• src/lib/comment.mjs
• src/lib/inputs.mjs
• src/lib/report.mjs
• src/main.mjs
• test/comment.test.mjs
• test/inputs.test.mjs
• test/report.test.mjs

 _________________________________________
< Schrodinbug: works until I stare at it. >
 -----------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

evlog map

64 needs work across 3 packages · unchanged against main · no regression

Package	Score	Δ	Instrumented	Partial	Dark	Gate
test/fixtures/express-app (express)	100 excellent	0	2	0	0	passed
test/fixtures/hono-app (hono)	100 excellent	0	2	0	0	passed
test/fixtures/nuxt-app (nuxt)	64 needs work	0	2	0	2	passed

Fix first

• POST /api/payments/refund test/fixtures/nuxt-app/server/api/payments/refund.post.ts:1: wide-event, context, audit
• GET /api/health test/fixtures/nuxt-app/server/api/health.get.ts:1: wide-event, context

_{evloghq/action · evlog map v0.8.0 · how the score works · what each check expects}