chore(deps): Update supply-chain - abandoned#16
Open
github-actions[bot] wants to merge 9 commits into
Open
Conversation
Introduces a self-hosted Renovate runner that shadows dependabot during a soft-launch phase. Renovate replaces and extends dependabot's coverage by also tracking the tool versions pinned in .settings.yaml (the project's single source of truth) — something dependabot cannot do. Coverage delta over dependabot: gomod, github-actions, dockerfile, and terraform are all preserved (with the kubernetes/golang-x/opencontainers gomod groups carried forward verbatim). New: npm (site/), helm-values (partial), the .settings.yaml tool set via a custom regex manager (28 annotated entries), and an automated chainsaw-checksum refresh hook. Key design decisions: - Self-hosted via renovatebot/github-action with the built-in GITHUB_TOKEN. The repo's /ok reviewer-comment policy re-fires CI on bot PRs, sidestepping GitHub's "GITHUB_TOKEN cannot trigger workflows" limitation. No PAT or App needed. - The `configurationFile:` action input is intentionally NOT passed: passing it would load .github/renovate.json5 as both the global config AND the auto-discovered repo config, doubling every customManager and duplicating PRs. - .settings.yaml entries are grouped by top-level YAML section via `depType=<section>` annotations + matchDepTypes packageRules. Branches read cleanly: `renovate/build-tools`, `renovate/test-images`, `renovate/major-site`, etc. - nvkind (pinned by main-branch SHA) gets a dedicated git-refs digest customManager with a distinct `# renovate-digest:` annotation prefix so the broad regex doesn't double-extract it. - Auto-merge is positive-listed (build/lint/security tooling, plus github-actions/gomod/npm patches). Cluster-impacting pins (helm, kubectl, kind, kwok, chainsaw, karpenter, gpu-operator, kindest/node, CUDA, Go toolchain, node, hugo, nvkind) require human review on every bump, even patches. - Schedule is `before 6am every weekday` since self-hosted Renovate cannot consume GitHub vulnerability alerts (Mend-only); weekday cadence narrows the CVE-to-PR window. - Both image references (Makefile validator + workflow runner) are digest-pinned to `sha256:00185c0d...` for supply-chain consistency with the project's GitHub Actions pinning policy. Verified end-to-end: - make lint-renovate validates against ghcr.io/renovatebot/renovate:43 cleanly. - merge-gate.yaml gains a path-filtered verify-renovate job that runs the same validator only when .github/renovate.json5 changes. - Local docker dry-run with the live config produces 6 distinct PR branches (down from 10 ungrouped) covering vue/vite/mermaid/esbuild bundled in renovate/site, kindest/node + cuda bundled in renovate/test-images, and 3 majors split into renovate/major-* for isolated review. - The chainsaw post-upgrade hook is wired and idempotent: rerun against the currently-pinned v0.2.14 produces zero diff. Soft-launch plan in .github/RENOVATE.md (Phases A-E). dependabot.yml and dependabot-auto-merge.yaml remain in place until Phase D confirms Renovate is healthy; Phase E is a follow-up PR removing them.
* fix(ci): make workflow cron the single Renovate schedule The previous setup had two scheduling layers that didn't overlap: the workflow cron fired Mondays at 09:00 UTC, while renovate.json5's `schedule: ["before 6am every weekday"]` only created PRs before 06:00 UTC. Every cron-triggered run landed three hours after the window closed and Renovate held all PRs in "Awaiting Schedule" — including the manually-dispatched runs we used during the soft-launch exercise. For self-hosted Renovate, the config-side `schedule:` field is redundant: Renovate only runs when the workflow fires, so the workflow cron already controls cadence. Removing the second layer: - Eliminates the alignment trap (the failure mode is silent — runs "succeed" while creating zero PRs). - Makes `workflow_dispatch` actually useful — manual triggers now create PRs immediately, regardless of clock time. - Removes the dependency on Dependency-Dashboard checkbox ticking to bypass the schedule for ad-hoc runs. Cron moved from `0 9 * * 1` (Mon 09:00) to `0 5 * * 1-5` (Mon-Fri 05:00) so PRs land before standup. RENOVATE.md updated to document the single-source-of-truth design and call out the rationale. * fix(ci): add release cooldown to renovate config Adds `minimumReleaseAge: "3 days"` globally and raises it to 7 days for the two auto-merge rules. Defends against malicious-publish ratchet attacks where a poisoned version goes live for hours then gets yanked (event-stream, colors.js, node-ipc, etc.). Trade-off: legitimate CVE patches land 3 days later than they would otherwise; for a project whose security-relevant deps come entirely from upstream tooling we don't write ourselves, the marginal protection is worth it. `internalChecksFilter: "strict"` excludes too-young releases rather than parking them in the Dependency Dashboard as "pending", keeping the dashboard signal clean — it shows what's about to land, not what's blocked behind cooldown. Auto-merge rules carry the higher 7-day cooldown because those updates skip human review; the cooldown is the only defense layer left if an attacker pushes a malicious patch.
…te) (#4) * fix(ci): merge anchore + sigstore into single supply-chain group Both Anchore (grype/syft/sbom-action/scan-action) and Sigstore (cosign/ cosign-installer) are supply-chain hardening tools. Their bumps tend to be reviewed by the same eyes for the same reasons. Bundling them into a single `supply-chain` group reduces 2 PRs/cycle to 1 without coupling unrelated tooling. The cross-manager behavior is preserved — the matchPackageNames glob still picks up both .settings.yaml entries (via the regex manager: anchore/grype, anchore/syft, sigstore/cosign) and GitHub Actions entries (anchore/sbom-action, anchore/scan-action, sigstore/cosign-installer). Branch slug becomes `renovate/supply-chain`. * fix(ci): merge docs-tools + site into single docs group The docs build chain has two halves: hugo (.settings.yaml docs_tools, used by .github/actions/build-versioned-site for versioned landing pages) and site/package.json (vitepress + vue + mermaid + esbuild + vite, the main docs site). They're parts of one pipeline; reviewing their bumps together is the natural workflow. Both packageRules now share `groupName: "docs"` — Renovate uses the group slug to determine the branch, so deps from either manager (custom.regex on .settings.yaml + npm on site/package.json) land in the single `renovate/docs` PR. Major bumps still split into `renovate/major-docs` per Renovate's default behavior.
The `actions/checkout` step was modeled on NVIDIA/gpu-operator's renovate workflow, but our setup deliberately does not pass `configurationFile:` (to avoid customManager doubling — see PR #3). Without that input, the renovatebot/github-action clones the repo itself inside Docker and has no need for an outer working tree. Observed failure: every Renovate run since the practice exercise started would create the first eligible branch (e.g. `renovate/build-tools`) and then abort 0.3s later with "Repository has changed during renovation" — even though no commit to main happened during the run window. The credentials and working tree planted at /home/runner/work by `actions/checkout` are the suspect: Renovate's container-internal git operations and the runner-side git state cross-contaminate, and Renovate misinterprets its own branch push as a base-branch advance. Removing the step removes the cross-contamination surface. The action documents that checkout is not required when using its default internal-clone mode.
…kflow (#6) Reverts toward the known-working NVIDIA/gpu-operator pattern after PRs #5 (drop checkout) and earlier failed to clear the persistent "Repository has changed during renovation" abort. Three concrete changes: 1. **Add back actions/checkout.** The action documents that it clones internally, but the host-side git state planted by checkout appears to keep Renovate's pre/post hooks consistent. Removing it in PR #5 did not fix the abort, suggesting checkout was never the culprit. 2. **Pass configurationFile: .github/renovate.json5.** The earlier concern about customManager doubling came from `RENOVATE_PLATFORM=local` dry-runs; in production (platform=github) Renovate dedupes by manager identity, so the same-file case is benign. Without configurationFile, the action runs Renovate without a global config — and that mode is associated with mid-run race conditions that surface as "repository-changed" aborts right after a successful branch push. 3. **Set RENOVATE_DRY_RUN conditionally.** Previously the env var was emitted on every run as `''` (empty string when dryRun=false). Renovate's option parser may treat the *presence* of the env var differently from its unset state. The new "Configure dry-run mode" step writes the var to GITHUB_ENV only when explicitly requested, keeping the env clean for the common case. Verified end-to-end via actionlint. Soft-launch loop continues — once this lands, dispatch Renovate manually and check whether `renovate/build-tools` (the only bundle past the cooldown filter) finally produces a PR alongside its branch.
#7) Root cause of the persistent "Repository has changed during renovation" aborts since PR #4 — Renovate was calling POST /repos/{owner}/{repo}/ statuses/{sha} after each branch creation to write a stability status check (tied to the cooldown / merge-confidence flow). The workflow's permissions block had contents:write, pull-requests:write, issues:write but not statuses:write, so the call 403'd with "integration- unauthorized". Renovate's error handler maps that internally to "repository-changed", which is why every prior debugging attempt (checkout, configurationFile, dry-run env, digest pin) chased the wrong symptom. Confirmed via debug log on run 25346172853: Request failed with status code 403 (Forbidden): POST .../statuses/cf3dc7d1... "x-accepted-github-permissions": "statuses=write" DEBUG: Caught error setting branch status - aborting Error: integration-unauthorized DEBUG: Passing repository-changed error up The earlier hypothesis fixes in PRs #5 and #6 weren't wrong per se (actions/checkout and configurationFile aren't the cause, and RENOVATE_DRY_RUN='' isn't either) — they just couldn't have fixed the underlying permission gap. With statuses:write added, Renovate's post-branch status-check call should succeed and the run should complete normally.
Confirmed in production run 25346453345: the regex manager stats
showed `"regex": {"fileCount": 4, "depCount": 56}` instead of the
expected 2/28. With `configurationFile: .github/renovate.json5`
passed, the action mounts the file as Renovate's global config AND
Renovate auto-discovers the same file from the cloned working tree;
both loads register the customManagers and every annotation gets
extracted twice. The doubling produced 14 "Cannot find replaceString
in current file content. Was it already updated?" warnings across
the four created branches — Renovate's first pass applied the
replacement, the second pass tried to re-apply but the content no
longer matched.
PR #6 added `configurationFile:` chasing the "repository-changed"
aborts under the wrong hypothesis; PR #7 found and fixed the actual
cause (missing `statuses: write` permission). With #7 in place we
can drop `configurationFile:` cleanly. Earlier dry-run experiments in
RENOVATE_PLATFORM=local mode had already shown this doubling, but I
mis-attributed it to local-mode specifics. Production confirms the
behavior is the same.
`actions/checkout` stays — it's not the cause of any issue we've
seen, and the upstream gpu-operator pattern keeps it.
After the first successful production Renovate run on the practice fork created PRs #8–#11, the next 8 eligible bundles all landed in the dashboard's Rate-Limited section instead of as PRs: - renovate/github-actions, linting, python-3.x, supply-chain - renovate/major-linting, major-docs, major-github-actions, major-test-images Reason: prHourlyLimit was 4 and we'd already created 4 in the run. Renovate's hourly cap is a per-repo rolling-window throttle whose default (2) is tuned for Mend's hosted service serving many repos against the same upstream registries — for our self-hosted single repo, the constraint is purely "don't flood reviewers", which is already what prConcurrentLimit handles. Setting prHourlyLimit to 10 (matching prConcurrentLimit) means the hourly cap never holds back updates that the concurrent-PR cap would otherwise allow through. With cooldown filtering (3 days global, 7 days for auto-merge) plus group consolidation already in place, even a backlog-clearing run will rarely produce more than 10 PRs at once. Patch auto-merge drains the safe ones without human attention.
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
github-actions
Bot
changed the title
Author
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.107.0→v0.112.0v0.22.0→v0.24.0v1.42.2→v1.44.0v3.0.4→v3.0.6v4.0.0→v4.1.1Release Notes
anchore/grype (anchore/grype)
v0.112.0Compare Source
Added Features
Additional Changes
(Full Changelog)
v0.111.1Compare Source
Bug Fixes
"group" : "debian"is specified [#2967](Full Changelog)
v0.111.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.110.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.109.1Compare Source
Bug Fixes
Additional Changes
(Full Changelog)
v0.109.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.108.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.107.1Compare Source
Additional Changes
(Full Changelog)
anchore/sbom-action (anchore/sbom-action)
v0.24.0Compare Source
v0.24.0
⬆️ Dependencies
v0.23.1Compare Source
v0.23.1
⬆️ Dependencies
v0.23.0Compare Source
v0.23.0
v0.22.2Compare Source
v0.22.2
⬆️ Dependencies
v0.22.1Compare Source
v0.22.1
⬆️ Dependencies
anchore/syft (anchore/syft)
v1.44.0Compare Source
Added Features
Bug Fixes
(Full Changelog)
v1.43.0Compare Source
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v1.42.4Compare Source
Bug Fixes
Additional Changes
(Full Changelog)
v1.42.3Compare Source
Bug Fixes
Additional Changes
(Full Changelog)
sigstore/cosign (sigstore/cosign)
v3.0.6Compare Source
Changelog
v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys.
f1ad3eeFix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)a09afa9Handle whitespace-only certificate annotation (#4760)5a38a6dfix(sign): closing SignerVerifier too early when signing with a security key (#4761)2290a59Disallow --new-bundle-format and --rfc3161-timestamp (#4762)36f4008support managed keys in conformance testing (#4728)3274cf9Add support for GCE metadata server env var (#4732)2e9754afix: preserve per-layer annotations in WriteAttestationsReferrer (#4709)dece275Fix parsing of in-toto for string predicatesbd4f0fdMark batch of flags for deprecation (#4698)9b259ffdisallow key and cert identity being used together during verification (#4636)95eb1c3support key creation in GitLab group (#4704)Thanks to all contributors!
v3.0.5Compare Source
Deprecations
Features
Bug Fixes
Documentation
sigstore/cosign-installer (sigstore/cosign-installer)
v4.1.1Compare Source
What's Changed
Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1
v4.1.0Compare Source
What's Changed
We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing
with: cosign-releaseand strongly discourage usingcosign-releaseunless you have a specific reason to use an older version of Cosign.Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.