feat: catch up Renovate PRs with passing CI in agent loop (#289)

Renovate PRs accumulate unmerged when CI runs before the merge-renovate
job was added, or when the automerge label is missing from the repo.

Add _open_renovate_prs() and a new catch-up section (2c) that detects
open renovate/* PRs with passing CI and merges them automatically.
Also created the missing 'automerge' label so Renovate can tag future
minor/patch PRs correctly for the merge-renovate CI job.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/website.yml

@@ -1,4 +1,4 @@
-name: Deploy Website
+name: Update Website
 
 on:
   push:
@@ -11,7 +11,7 @@ on:
 
 jobs:
   deploy:
-    name: Build & Deploy Website
+    name: Build & Update Website
     runs-on: ubuntu-latest
     timeout-minutes: 60
 
@@ -34,7 +34,7 @@ jobs:
           DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
         run: scripts/setup_dagger_remote.sh
 
-      - name: Build & Deploy Website
+      - name: Build & Update Website
         if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
@@ -45,6 +45,7 @@ jobs:
         run: task publish-website
 
       - name: Verify Website
+        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
         env:
           SSH_HOST: ${{ secrets.WEBSITE_SSH_HOST }}
         run: scripts/website-verify.sh

.fvmrc

@@ -1,3 +1,3 @@
 {
-  "flutter": "3.41.6"
+  "flutter": "3.44.0"
 }

android/app/build.gradle.kts

@@ -67,7 +67,7 @@ flutter {
 
 dependencies {
     // Required for flutter_local_notifications and other plugins that need Java 8+ APIs on API < 26.
-    coreLibraryDesugaring("com.android.tools:desugar_jdk_libs:2.1.4")
+    coreLibraryDesugaring("com.android.tools:desugar_jdk_libs:2.1.5")
     // integration_test is a dev dependency; the Flutter plugin loader adds it as
     // debugImplementation only, but GeneratedPluginRegistrant.java (in src/main)
     // references its class in all variants. Make it available for release compilation

android/gradle/wrapper/gradle-wrapper.properties

@@ -2,4 +2,4 @@ distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip

ci/go.mod

@@ -44,10 +44,10 @@ require (
 	google.golang.org/protobuf v1.36.11 // indirect
 )
 
-replace go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc => go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0
+replace go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc => go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0
 
-replace go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp => go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0
+replace go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp => go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0
 
-replace go.opentelemetry.io/otel/log => go.opentelemetry.io/otel/log v0.16.0
+replace go.opentelemetry.io/otel/log => go.opentelemetry.io/otel/log v0.19.0
 
-replace go.opentelemetry.io/otel/sdk/log => go.opentelemetry.io/otel/sdk/log v0.16.0
+replace go.opentelemetry.io/otel/sdk/log => go.opentelemetry.io/otel/sdk/log v0.19.0

lib/ui/widgets/secure_email_webview.dart

@@ -31,10 +31,13 @@ String buildEmailHtml(String htmlBody, {bool loadRemoteImages = false}) {
 <meta name="color-scheme" content="light">
 <meta http-equiv="Content-Security-Policy" content="$csp">
 <style>
-body { margin: 0; padding: 0; font-family: sans-serif; word-break: break-word; color-scheme: light; background-color: #ffffff; color: #000000; }
+body { margin: 0; padding: 0; font-family: sans-serif; word-break: break-word; overflow-x: hidden; color-scheme: light; background-color: #ffffff; color: #000000; }
 img { max-width: 100%; height: auto; }
 a { color: #1976D2; }
-* { box-sizing: border-box; }
+* { box-sizing: border-box; max-width: 100%; }
+table { width: 100%; border-collapse: collapse; }
+td, th { overflow-wrap: break-word; word-break: break-word; }
+pre { white-space: pre-wrap; word-break: break-word; overflow-x: auto; }
 </style>
 </head>
 <body>

scripts/agent_loop.py

@@ -251,6 +251,24 @@ def _open_issue_prs() -> list[dict]:
     return issue_prs
 
 
+def _open_renovate_prs() -> list[dict]:
+    """Return all open PRs from Renovate (renovate/* branches), oldest-first."""
+    result = subprocess.run(
+        ["fgj", "--hostname", "codeberg.org", "pr", "list",
+         "--repo", REPO, "--state", "open", "--json"],
+        capture_output=True, text=True,
+    )
+    if result.returncode != 0 or not result.stdout.strip():
+        return []
+    prs = json.loads(result.stdout)
+    renovate_prs = [
+        pr for pr in prs
+        if (pr.get("head", {}).get("ref") or "").startswith("renovate/")
+    ]
+    renovate_prs.sort(key=lambda p: p["number"])
+    return renovate_prs
+
+
 def _latest_ci_run_for_pr(pr_number: int) -> dict | None:
     """Return the latest CI run triggered by a pull_request event for the given PR number."""
     pr_ref = f"#{pr_number}"
@@ -828,6 +846,40 @@ def _run_loop() -> int:
                 print(f"Merged PR #{pr_number}.")
             return 0
 
+    # ── 2c. Catch-up: merge Renovate PRs with passing CI ─────────────────────
+    # The merge-renovate CI job only fires on pull_request events. If a Renovate
+    # PR had CI run before that job was added (or the automerge label was absent),
+    # it stays open forever. Detect and merge those here.
+    for pr in _open_renovate_prs():
+        pr_number = pr["number"]
+        pr_url = f"{REPO_URL}/pulls/{pr_number}"
+        pr_run = _latest_ci_run_for_pr(pr_number)
+
+        if pr_run and pr_run.get("status") == "running":
+            print(f"Catch-up (Renovate): CI {_ci_run_url(pr_run['id'])} on PR #{pr_number} still running. Waiting.")
+            return 0
+
+        if pr_run and pr_run.get("status") in ("failure", "error"):
+            print(f"Catch-up (Renovate): CI {_ci_run_url(pr_run['id'])} on PR #{pr_number} failed — skipping.")
+            continue
+
+        if pr_run and pr_run.get("status") == "success":
+            print(f"Catch-up (Renovate): CI passed on PR #{pr_number} ({pr_url}) — merging.")
+            try:
+                _merge_pr(pr_number)
+            except RuntimeError as e:
+                print(f"Catch-up (Renovate): merge of PR #{pr_number} failed: {e} — skipping.")
+                continue
+            branch = pr.get("head", {}).get("ref", "")
+            if _find_pr_for_branch(branch):
+                print(f"Catch-up (Renovate): PR #{pr_number} still open after merge — skipping.")
+                continue
+            print(f"Catch-up (Renovate): merged PR #{pr_number}.")
+            return 0
+
+        if pr_run is None:
+            print(f"Catch-up (Renovate): no CI run for PR #{pr_number} ({pr_url}) — skipping (needs manual review).")
+
     # ── 3. Global CI check (main branch only) ────────────────────────────────
     run = _latest_main_ci_run()
 

test/widget/secure_email_webview_test.dart

@@ -41,6 +41,20 @@ void main() {
       expect(html, contains('https: http: data: blob:'));
       _expectLightMode(html);
     });
+
+    test('prevents horizontal overflow so wide HTML emails are not cut off',
+        () {
+      final html =
+          buildEmailHtml('<table width="600"><tr><td>x</td></tr></table>');
+      // Body clips overflow so fixed-width email tables don't escape the viewport.
+      expect(html, contains('overflow-x: hidden'));
+      // Tables are forced to full viewport width so fixed pixel widths don't overflow.
+      expect(html, contains('table { width: 100%'));
+      // All elements are capped at viewport width via max-width.
+      expect(html, contains('max-width: 100%'));
+      // Pre-formatted text wraps instead of stretching the page.
+      expect(html, contains('white-space: pre-wrap'));
+    });
   });
 
   // On Linux (the test host) the widget falls back to plain text extracted via