agentmods.dev

home-ops: Skill for Claude Code

.agents/skills/renovate/SKILL.md

renovate is a skill for Claude Code, Codex from Aviator-Coding/home-ops. It costs 101 tokens per session (1,306 once invoked), scanned A, original, MIT.

A set of guidance for Renovate, a tool that opens pull requests to update software dependencies and container images. It explains how this repository's scheduled and GitHub Actions-based update jobs interact.

In plain words
What is it for?
Use it before editing Renovate configuration or annotations, changing its workflow, or merging updates for cluster, storage, and application components.
Why use it?
It helps prevent two update jobs from changing the same files at once and avoids accidentally enabling automatic merges for packages that need review. It also explains rule ordering and update exceptions.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is Aviator-Coding/home-ops's own configuration. It tells Claude Code and Codex how to work on home-ops itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything home-ops configures →

not rated 3repo changed 23d ago A scan 101 tokens original MIT
View source ↗ Aviator-Coding/home-ops
Reuse

Borrowing it

Nothing to install: this file belongs to Aviator-Coding/home-ops. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Aviator-Coding/home-ops/main/.agents/skills/renovate/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/Aviator-Coding/home-ops

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for renovate

README.md
[![agentmods](https://agentmods.dev/badge/skills/aviator-coding/home-ops/renovate/github.svg)](https://agentmods.dev/skills/aviator-coding/home-ops/renovate)
Your own site
<a href="https://agentmods.dev/skills/aviator-coding/home-ops/renovate"><img src="https://agentmods.dev/badge/skills/aviator-coding/home-ops/renovate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for renovate

Your own site · 80×15
<a href="https://agentmods.dev/skills/aviator-coding/home-ops/renovate"><img src="https://agentmods.dev/badge/skills/aviator-coding/home-ops/renovate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 101 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,306 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00101 $0.01306
Opus 5.5 $0.00040 $0.00522
Sonnet 5.5 $0.00020 $0.00261
Haiku 4.5 $0.00010 $0.00131

Measured 23d ago against content hash 93998709d708, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

renovate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/renovate/SKILL.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Renovate

The live writer is the in-cluster CronJob (kubernetes/apps/base/renovate/, chart oci://ghcr.io/renovatebot/charts/renovate, every 4 hours). .github/workflows/renovate.yaml is the rollback path: its schedule is commented out. Its push trigger on .renovaterc.json5 and .renovate/**.json5 is still active.

Tripwires

  1. Suspend .github/workflows/renovate.yaml before merging a config change. The push trigger runs a GHA writer beside the CronJob. Resume after the in-cluster pass (or kubectl -n renovate create job --from=cronjob/renovate if a pass is needed immediately). Comment-only edits of .renovate/** still fire it.
  2. Last match wins. A later packageRule overrides an earlier one. Every automerge: false rule sits after the three blanket automerge rules. The "MUST stay after" comments are the ordering constraint. Sibling exclusions match disjoint packages, so their order relative to each other does not matter. None of them may turn automerge back on.
  3. Never-automerge list (proposals still open as PRs): Renovate's own chart (matchFileNames: kubernetes/apps/base/renovate/**), kopiur images, the four Talos packages, the five Kubernetes control-plane/kubelet packages, ghcr.io/berriai/litellm-non_root, and the CloudNativePG chart and operator image (1.31.0 removes the in-tree barman backup; skill databases). rsshub digests stay automerge: true on before 6am on monday (UTC).
  4. A version pin uses a negated regex, never a bare <X.Y.Z. allowedVersions filters candidates. Once the tracked value passes a ceiling, Renovate proposes nothing. Talos excludes only v1.13.3: !/^v?1\.13\.3$/. versioning-traps.md
  5. Docker isStable ignores -alpha / -beta / -rc. It keeps the dash-separated prefix. v1.14.0-alpha.0 is a stable minor. The Talos automerge exclusion covers stable bumps too, because a merge of talosupgrade.yaml is an unattended powercycle.
  6. No in-repo branch automerge. Do not re-add :automergeBranch or automergeType: "branch". renovate/** pushes get no status check, so ignoreTests: false leaves them pending. mortyops' mise and github-actions presets set ignoreTests: true; later home-ops rules force it back to false, so those updates stay PRs.
  7. platformAutomerge: false. GitHub would otherwise merge when Labeler alone is green. Skill github-ci.
  8. # renovate: value stays on the next line. The customManager and functional-comments-guard both require that. Do not edit those lines while condensing comments.
  9. quay.io/ceph/ceph stays on stable x.2.z (allowedVersions: "/^v?\\d+\\.2\\.\\d+$/"). Do not apply that regex to ghcr.io/rook/ceph. Those stable tags still match the blanket docker automerge rules (as PRs).
  10. A merged bump of tuppr/upgrades/talosupgrade.yaml upgrades nodes. tuppr consumes that CR with rebootMode: powercycle. Treat it as a live upgrade. The same shape applies to kubernetesupgrade.yaml (kubelet). Skill talos-nodes.

Read the full file on GitHub · 81 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 23d ago Changed · +1 lines 93998709d708
  2. 25d ago First seen · 80 lines · 101 tokens per session scan A 6c6da561de76

Subscribe to this mod's changes

renovate is a skill published in the GitHub repository Aviator-Coding/home-ops (3 stars, last pushed today), licensed MIT. It adds 101 tokens to every session and 1,306 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.

CI and CDDevOps and cloudGit and workflow
Related

Other skills, from other repositories

deployment-patterns

Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.

affaan-m/ECC · 41 tokens

agent-github-modes

Agent skill for github-modes - invoke with $agent-github-modes.

ruvnet/ruflo · 21 tokens

baby-sit

Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.

langchain-ai/open-swe · 30 tokens

chinese-git-workflow

A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.

jnMetaCode/superpowers-zh · 69 tokens

atmos-hooks

Atmos hooks: lifecycle events, hook kinds, command/store/git/security hooks, step/steps hooks, when: conditions, scoping and overrides, toolchain integration, --skip-hooks, and Atmos Pro/local output.

cloudposse/atmos · 46 tokens

atmos-pro

Atmos Pro setup and workflows: settings.pro, GitHub OIDC, affected and inventory uploads, stack locks, pro commit, workflow dispatch, merge queues, and drift detection.

cloudposse/atmos · 38 tokens