postUpgradeTasks with executionMode: "update" silently drops file changes when modifying the same file as the manager update

[kdeldycke]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.101.1

Please tell us more about your question or problem

Current behavior

When a postUpgradeTasks command (with executionMode: "update") modifies the same file that the custom regex manager already changed, the post-upgrade modifications are silently dropped from the commit. The debug logs confirm the command runs successfully, Renovate detects the modified file, logs "Post-upgrade file saved" and "1 file(s) to commit", but the resulting commit only contains the manager's version change, not the post-upgrade modifications.

Expected behavior

The commit should include both the manager's change (version bump) and the postUpgradeTasks change (checksum update) since they modify different lines of the same file.

Setup

I maintain a Python tool registry in repomatic/tool_runner.py where each tool entry has a version field and a checksums dict with SHA-256 hashes for binary downloads:

"biome": ToolSpec(
    name="biome",
    version="2.4.5",
    ...
    binary=BinarySpec(
        urls={
            "linux-x64": "https://github.com/biomejs/biome/releases/download/.../{version}/biome-linux-x64",
        },
        checksums={
            "linux-x64": "a31815f19b0b90fa043eb23fbf769ed931fbcde6d98bb89894ea8be1387d8394",
        },
        ...
    ),
),

A custom regex manager in renovate.json5 detects version bumps in this file. A postUpgradeTasks rule (with executionMode: "update" and matchFileNames: ["repomatic/tool_runner.py"]) runs a CLI command that downloads the new binary and updates the checksum in-place:

{
    matchFileNames: ["repomatic/tool_runner.py"],
    postUpgradeTasks: {
        commands: ["bash -c '... repomatic update-checksums --registry'"],
        fileFilters: ["repomatic/tool_runner.py"],
        executionMode: "update",
    },
},

Full config: renovate.json5 lines 59-68 (postUpgradeTasks rule) and lines 162-175 (custom regex manager for biome).

Reproduction

This has been reproduced across three independent Renovate runs on PR #2435 (branch renovate/biomejs-biome-2.x). The PR diff consistently shows only the version bump, never the checksum update.

Run 1: 43.86.1: initial PR creation (biome 2.4.5 → 2.4.7)

Workflow run: 23431508867

The command executes successfully and computes the new checksum (line 6963):

"stdout": "/tmp/uv.tar.gz: OK\nUpdated: https://github.com/biomejs/biome/releases/download/…/biome-linux-x64\n  Old: a31815f19b0b90fa043eb23fbf769ed931fbcde6d98bb89894ea8be1387d8394\n  New: a9bd4061269214c965b468867c1098996d6b1b250b7e2cea7d0b25a29b0de2b0\n"

Renovate detects the modified file and saves it (line 6978):

Post-upgrade file saved
  "file": "repomatic/tool_runner.py",
  "pattern": "repomatic/tool_runner.py"
1 file(s) to commit

But the commit summary only shows 1 insertion / 0 deletions — just the version line, not the checksum replacement (line 6984):

"summary": {"changes": 1, "insertions": 1, "deletions": 0}

Run 2: 43.101.1: branch rebase (biome 2.4.5 → 2.4.8)

Workflow run: 23763622841

Same behavior. Command succeeds with new checksum (line 7172):

"stdout": "/tmp/uv.tar.gz: OK\nUpdated: …/biome-linux-x64\n  Old: a31815f19b0b90fa043eb23fbf769ed931fbcde6d98bb89894ea8be1387d8394\n  New: bab205dea2d2432638e01fb41d136d6ccb26dd07e543d2f40d20b7b1e55be263\n"

File saved (line 7187), "1 file(s) to commit" (line 7200), but commit only has 1 insertion / 1 deletion (line 7202):

"summary": {"changes": 1, "insertions": 1, "deletions": 1}

If both the version bump and checksum replacement were committed, the summary would show insertions: 2, deletions: 2.

Subsequent runs skip the task entirely

Once the branch exists with the version-only commit, subsequent runs log (example from run 23762428803):

Branch dep biomejs/biome in repomatic/tool_runner.py is already updated
No changes to package files, skipping post-upgrade tasks

This means the checksum can never be fixed by re-running Renovate: only the initial commit-creating run executes the task, and it drops the result.

Hypothesis

Renovate appears to build the commit content from its own stored copy of the file (with just the manager's version change) rather than from the working directory state after the postUpgradeTasks command has run. When the post-upgrade task modifies the same file the manager already changed, the manager's stored version overwrites the post-upgrade version during commit creation.

This may only affect executionMode: "update" when fileFilters targets the same file as the manager's matchFileNames.

Note: I have other postUpgradeTasks rules targeting workflow files (different files from the manager target), and those work correctly. The checksum updates do appear in the commit. The issue seems specific to the case where the postUpgradeTask modifies the same file the regex manager updated.

Platform

• Renovate versions: 43.86.1 and 43.101.1 (both affected)
• Platform: GitHub, self-hosted via renovatebot/github-action in GitHub Actions
• Repository: https://github.com/kdeldycke/repomatic (public)
• PR: Update biomejs/biome to 2.4.10 kdeldycke/repomatic#2435

All the workflow runs, config files, and PR are public. Happy to create a minimal reproduction repo if needed.

[kdeldycke]

Same issue reproduced again on kdeldycke/repomatic#2537 . Here the checksum was not updated despite the proper renovate.json5 config.

[kdeldycke]

As a temporary measure, I had to create a dedicated workflow that triggers on renovate/** branches to fix post-facto the postUpgradeTasks limitations: kdeldycke/repomatic@438f128