fix: bump apm to 0.30.0 and opencode to 1.18.31 + add renovate…

[FScholPer]

bump opencode and apm and added renovate

Frank Scholter Peres frank.scholter_peres@mercedes-benz.com, Mercedes-Benz Tech Innovation GmbH
Provider Information

• Assisted by Copilot

[Copilot]

🟡 Changes recommended

Critical workflow security issues and Renovate scheduling/configuration issues must be resolved before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates APM to 0.30.0 and OpenCode to 1.18.31, while adding Renovate maintenance automation.

Changes:

• Updates lockfiles, checksums, documentation, and DevContainer versions.
• Adds daily maintenance and Renovate configuration.

File summaries

File	Summary
tools/README.md	Updates documented tool versions.
tools/lockfiles/opencode.lock.json	Updates OpenCode artifacts and checksums.
tools/lockfiles/apm.lock.json	Updates APM artifacts and checksums.
src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml	Updates installed tool versions.
.github/workflows/daily.yml	Adds maintenance and Renovate execution.
.github/renovate.json5	Configures Renovate dependency discovery and scheduling.

Review details

Suppressed comments (3)

.github/renovate.json5:58

• This pattern has no currentValue capture, so Renovate can update the standalone version field but cannot rewrite the v... segment in the download URLs. The separate digest pattern is also not tied to each URL, leaving a future update with stale artifact URLs or checksums. Capture the version and adjacent digest together so all platform artifacts are updated atomically.

        "\"url\":\\s*\"https://github\\.com/anomalyco/opencode/releases/download/v[^/]+/[^\"]+\"",
        "\"sha256\":\\s*\"(?<currentDigest>[^\"]+)\""

.github/renovate.json5:18

• config:base leaves Renovate's default managers enabled, including GitHub Actions, while .github/dependabot.yml already updates GitHub Actions, Docker, and devcontainers. Both bots can therefore open overlapping dependency PRs; either limit Renovate to the custom regex manager for these tools or remove the overlapping Dependabot jobs.

  "extends": [
    "config:base",
    ":dependencyDashboard",
    ":semanticCommits"

.github/workflows/daily.yml:24

• The workflow runs at 00:00 UTC, but Renovate is allowed only after 22:00 on Monday. The daily invocation therefore never falls inside the configured Monday window, so scheduled dependency and lock-file updates will not run. Align the cron with the configured window or remove the Renovate schedule restriction.

    - cron: '0 0 * * *'

• Files reviewed: 6/6 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🎉 This PR is included in version 1.11.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀