What problem does it solve?
It prevents risky container image updates by tracing Renovate changes back to upstream release evidence and then validating the deployment path before any apply.
Core Features & Use Cases
- Renovate PR impact tracing: Reads a Renovate image PR, identifies bumped managed images, and maps each Spigell-owned image to the correct
my-images lookup query term.
- Evidence-backed upstream review: Traces the version bump chain across merged
spigell/my-images PRs and reads their contents for upstream release/PR links, while enforcing strict “no guessing” evidence rules.
- Special-case changelog for closed-source
agy: Uses the Antigravity manifest service to download the agy binary and runs agy changelog as primary evidence.
- Guardrailed deploy validation: Posts a consolidated pre-deploy risk review comment, then delegates Pulumi preview/apply via the shared
pulumi-deployer skill with rollback protection and protected-change refusal.
- Failure handling and automated update lock: If preview/apply fails or protected changes are detected, it blocks merge and writes a targeted
renovate.json lock for the exact failing image package name.
Quick Start
Ask the agent to run the review-renovate-pr workflow for your my-agents Renovate PR and produce a consolidated AI Image Update Risk Review, followed by Pulumi deploy validation via pulumi-deployer.