docs(EC-2061): document dependency management strategy in AGENTS.md

[cuipinghuo]

What:

Add a "Dependency Management" section to AGENTS.md documenting that Go version updates are managed by both Renovate and Mintmaker, and that agents should not propose changes to this configuration without maintainer approval.

Why:

An AI agent pipeline (retro → triage → code → review) filed a PR proposing to add a missing "go version" group to Renovate config. The PR was closed without merge because the absence was intentional. Without documentation in AGENTS.md, agents cannot distinguish between "missing config" and "deliberately omitted config." This section provides that context to prevent future false-positive proposals.

Tickets:

• EC-2061
• Upstream: Document intentional Renovate exclusions in AGENTS.md to prevent false-positive config proposals #3458

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 4db6d080-e083-4634-b3b5-7f1ab2368c49

📥 Commits

Reviewing files that changed from the base of the PR and between b9f26b5 and 18a111c.

📒 Files selected for processing (1)

• AGENTS.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

AGENTS.md now documents Go dependency update automation through Renovate and Mintmaker, related grouping behavior, and approval requirements for changes to the automation.

Changes

Dependency management documentation

Layer / File(s)	Summary
Go dependency automation guidance AGENTS.md	Documents Renovate and Mintmaker Go version updates, the local Renovate preset extension, historical grouping configuration, and maintainer approval requirements.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 18a11

This documents the existing Go dependency automation and maintainer-approval requirement without changing runtime behavior, configuration, or dependencies. No merge-readiness risk remains.

Suggested reviewers: joejstuart

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the documentation change and identifies the affected file and ticket.
Description check	✅ Passed	The description includes all required sections: What, Why, and Tickets. It explains the change, context, and related issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 12:58 PM UTC · Ended 1:00 PM UTC

Commit: ca5794c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:01 PM UTC · Completed 1:16 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.89

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (ø)
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Documentation-only PR by a known human contributor adding a 4-line Dependency Management section to AGENTS.md. The change is additive, matches the linked issue's acceptance criteria exactly, touches no code/security/CI/dependency files, and is trivially revertible. The only elevated sub-signal is the protected path (AGENTS.md) and moderate multi-author activity on that file.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] AGENTS.md — This PR modifies a file under the repository's protected paths (AGENTS.md), which is a governance/instruction file for AI agents and human contributors. The PR provides sufficient context (linked issue Document intentional Renovate exclusions in AGENTS.md to prevent false-positive config proposals #3458 and Jira EC-2061, with a clear rationale for the addition), but human maintainer approval is always required for protected-path changes, regardless of context.

Info

• [provenance-warning] — Prior review context was discarded because provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app: the prior review comment was created by a different app than expected). This review treats all findings as first-time assessments; no severity anchoring was applied.
• [intent-coherence] AGENTS.md:108 — The new section broadens the linked issue's scope (which focused specifically on "intentional Renovate exclusions") to also cover Mintmaker and to note a specific org-level preset extension (helpers:pinGitHubActionDigests). The PR body explicitly announces this broader framing up front, so it is an intentional elaboration rather than accidental creep, but reviewers should confirm the added Mintmaker coverage is desired.

Previous run

Review

Findings

Medium

• [protected-path] AGENTS.md — AGENTS.md is a protected path (governance/infrastructure file). The PR has a linked issue (Document intentional Renovate exclusions in AGENTS.md to prevent false-positive config proposals #3458) and explains the rationale for the change. Human approval is always required for protected-path changes, regardless of context.

Low

• [intent-accuracy] AGENTS.md:108 — The PR states the local renovate.json extends the org-level preset "without local overrides," but the actual renovate.json also extends helpers:pinGitHubActionDigests, which is a local addition beyond the org-level preset. This is a factual inaccuracy in the documentation.
  Remediation: Change "without local overrides" to "with an additional helpers:pinGitHubActionDigests extension" or simply remove the "without local overrides" claim.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:28 PM UTC · Completed 4:35 PM UTC

Commit: 4ad3612 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.05

Superseded by updated review