feat(manager): add apm manager for Agent Package Manager by MPV · Pull Request #44390 · renovatebot/renovate

MPV · 2026-07-06T20:53:03Z

Changes

Adds a new apm manager that keeps APM (Agent Package Manager) dependencies up to date, as requested in discussion #42507.

APM projects declare git-pinned agent dependencies (skills, plugins, agents, full packages) in an apm.yml manifest and pin the resolved tree in an apm.lock.yaml lockfile. Nothing currently bumps those refs.

The new manager:

Parses the string entries under dependencies.apm and devDependencies.apm, of the form [host/]owner/repo[/subpath]#<ref>.
Selects the datasource dynamically from the git host (reusing detectPlatform, which also honors hostRules) — no new datasource is required:
- github.com (and self-hosted GitHub) → github-tags
- gitlab.com (and self-hosted GitLab) → gitlab-tags
- any other host (Bitbucket, Azure DevOps, …) → git-tags
Only updates entries that pin an exact #<ref>; unpinned entries are skipped.
Regenerates apm.lock.yaml (when present) by running apm install, wired through a new apm tool constraint that resolves the CLI from microsoft/apm GitHub releases.

MCP server entries under dependencies.mcp are intentionally not managed: they are identified by an MCP registry name (e.g. io.github.github/github-mcp-server) and carry no version to pin, so there is nothing for Renovate to update.

Lock file maintenance note

Renovate's adding-a-package-manager guide prefers a <tool> update command over delete-then-<tool> install, since the latter can lose platform-specific lock data. APM does not provide an update command, so:

After a package-file change, the manager runs apm install to sync apm.lock.yaml to the updated manifest (no delete).
During lock file maintenance, it deletes apm.lock.yaml and runs apm install to regenerate it. APM's lockfile records resolved sources and content hashes (no platform-specific fields), so a full regeneration is deterministic and safe here.

Depends on

feat: add apm (Agent Package Manager) install support containerbase/base#7038

...which adds install-tool apm to the base image. The apm install lockfile step only works once that PR is merged and a new base image is released; the manager’s unit tests mock exec, so this PR’s CI is green independently.

Context

Please select one of the following:

This closes an existing Issue, Closes: #
This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

The New Package Manager Questionnaire is completed in discussion #42507.

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

No — I did not use AI for this contribution.
Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
Yes — other (please describe):

The manager code, unit tests, and documentation were drafted with Claude (via Claude Code) and reviewed before submission.

Documentation (please check one with an [x])

I have updated the documentation, or
No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

Code inspection only, or
Newly added/modified unit tests, or
No unit tests, but ran on a real repository, or
Both unit tests + ran on a real repository

100% test coverage on the new files (pnpm vitest run lib/modules/manager/apm), plus pnpm check --all and pnpm type-check passing.

Additionally verified with a local extraction dry-run against a representative apm.yml, confirming correct datasource/packageName resolution across hosts:

Entry	datasource	packageName	currentValue
`microsoft/apm-sample-package#v1.0.0`	`github-tags`	`microsoft/apm-sample-package`	`v1.0.0`
`anthropics/skills/skills/frontend-design#v0.24.0`	`github-tags`	`anthropics/skills`	`v0.24.0`
`gitlab.com/acme/agents#v2.3.0`	`gitlab-tags`	`acme/agents`	`v2.3.0`
`bitbucket.org/acme/tools#v1.1.0`	`git-tags`	`https://bitbucket.org/acme/tools`	`v1.1.0`
`danielmeppiel/design-guide` (unpinned)	—	—	skipped (`unspecified-version`)
`owner/repo#v1.2.3` (devDependencies)	`github-tags`	`owner/repo`	`v1.2.3`

MCP entries under dependencies.mcp were correctly ignored.

The public repository: https://github.com/microsoft/apm

cla-assistant · 2026-07-06T20:53:18Z

All committers have signed the CLA.

cla-assistant · 2026-07-06T20:53:18Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Add a new `apm` manager that updates git-pinned dependencies in APM (Agent Package Manager) `apm.yml` manifests, as requested in renovatebot#42507. The manager parses the string entries under `dependencies.apm` and `devDependencies.apm` (`[host/]owner/repo[/subpath]#<ref>`) and selects the datasource dynamically from the git host, reusing the existing github-tags, gitlab-tags and git-tags datasources. MCP entries carry no pinnable version and are ignored. When an `apm.lock.yaml` lockfile is present, it is refreshed by running `apm install` via a new `apm` tool constraint (pypi `apm-cli`). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vfjt3BpqDriiVsvwqVe9M9

APM ships self-contained binaries as GitHub release assets (apm-linux-<arch>.tar.gz under vX.Y.Z tags), not as the PyPI apm-cli wheel. Point the apm tool constraint at the github-releases datasource so the version Renovate resolves matches the artifact that actually gets installed, stripping the leading `v` from the tag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vfjt3BpqDriiVsvwqVe9M9

The APM project's canonical home is github.com/microsoft/apm (originally danielmeppiel/apm). Update the manager URL and readme accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vfjt3BpqDriiVsvwqVe9M9

MPV · 2026-07-07T09:06:37Z

(sorry about the force-push, it was necessary to solve the CLA issue, i.e. committing properly as myself)

RahulGautamSingh · 2026-07-11T09:54:25Z

+    return {
+      ...base,
+      currentValue,
+      skipReason: 'invalid-dependency-specification' as SkipReason,


drop the cast,

RahulGautamSingh · 2026-07-11T09:54:40Z

+
+  if (!currentValue) {
+    // Unpinned dependency (no `#ref`) - nothing for Renovate to update.
+    return { ...base, skipReason: 'unspecified-version' as SkipReason };


drop the case

RahulGautamSingh · 2026-07-11T09:56:34Z

+    return null;
+  }
+
+  const manifest = parsed as ApmManifest;


dont cast as such, instead create a zod schema and use with parseSingleYaml as such

parseSingleYaml(content, { customSchema })

RahulGautamSingh · 2026-07-11T09:57:14Z

+  depType: string,
+): PackageDependency[] {
+  const result: PackageDependency[] = [];
+  if (!deps || !Array.isArray(deps.apm)) {


You already import from @sindresorhus/is;

is.array(deps.apm) is more consistent with the rest of the file.

Thanks for the review! Addressed all four points in 3fdb4cf:

Zod schema — added schema.ts with an ApmManifest schema and switched to parseSingleYaml(content, { customSchema: ApmManifest }), dropping the as ApmManifest cast.

as SkipReason casts — both removed; the literals infer fine.

is.array(deps.apm) — resolved structurally rather than with the is.array swap: the schema now models the section as LooseArray(z.string()), so it keeps only the string entries and drops MCP objects / non-string / non-array values during parsing. That means the manual Array.isArray + is.string guards are gone entirely — extractSection just maps a typed string[]. Let me know if you'd prefer the explicit runtime check kept instead.

Also removed the now-unused types.ts. Coverage stays at 100% on the module and type-check passes.

Address review feedback on the apm manager: - parse `apm.yml` with a dedicated zod schema via `parseSingleYaml(content, { customSchema })` instead of casting the parsed YAML to `ApmManifest` - `LooseArray(z.string())` keeps only the string dependency entries, so MCP objects and other non-string values are dropped by the schema and the manual `Array.isArray`/`is.string` guards are no longer needed - drop the `as SkipReason` casts now that the literals are inferred - remove the now-unused `types.ts` Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UbMAQBiMRNkCNxc8EGQw1C

MPV mentioned this pull request Jul 6, 2026

feat: add apm (Agent Package Manager) install support containerbase/base#7038

Open

MPV and others added 3 commits July 7, 2026 11:03

MPV force-pushed the claude/renovate-suggestion-plan-0loxk2 branch from 3ff6c7b to 9cc5d88 Compare July 7, 2026 09:04

MPV marked this pull request as ready for review July 7, 2026 09:09

github-actions Bot requested a review from viceice July 7, 2026 09:09

secustor self-requested a review July 7, 2026 13:03

RahulGautamSingh suggested changes Jul 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(manager): add apm manager for Agent Package Manager#44390

feat(manager): add apm manager for Agent Package Manager#44390
MPV wants to merge 4 commits into
renovatebot:mainfrom
MPV:claude/renovate-suggestion-plan-0loxk2

MPV commented Jul 6, 2026 •

edited

Loading

Uh oh!

cla-assistant Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

cla-assistant Bot commented Jul 6, 2026

Uh oh!

MPV commented Jul 7, 2026

Uh oh!

RahulGautamSingh Jul 11, 2026

Uh oh!

RahulGautamSingh Jul 11, 2026

Uh oh!

RahulGautamSingh Jul 11, 2026

Uh oh!

RahulGautamSingh Jul 11, 2026

Uh oh!

MPV Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

MPV commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Lock file maintenance note

Category

Depends on

Context

AI assistance disclosure

Documentation (please check one with an [x])

How I've tested my work (please select one)

Uh oh!

cla-assistant Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cla-assistant Bot commented Jul 6, 2026

Uh oh!

MPV commented Jul 7, 2026

Uh oh!

RahulGautamSingh Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

RahulGautamSingh Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

RahulGautamSingh Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

RahulGautamSingh Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

MPV Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MPV commented Jul 6, 2026 •

edited

Loading

cla-assistant Bot commented Jul 6, 2026 •

edited

Loading