diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 439797f..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,18 +0,0 @@ -version: 2 -updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: weekly - day: monday - time: "09:00" - timezone: America/Los_Angeles - commit-message: - prefix: "ci" - labels: - - "ci/cd" - - "automated" - groups: - github-actions: - patterns: - - "*" diff --git a/CLAUDE.md b/CLAUDE.md index 6c77f5d..0ef78ef 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -108,7 +108,7 @@ documents: `task validate` runs it report-only, CI runs it `--blocking`. - PR and push to main trigger `.github/workflows/ci.yml` (lint → validate per environment → PR summary) - The validate job renders every kustomize root plus the druid catalog chart, then gates the rendered output: render-assert (no unfilled sentinels), kubeconform strict (native schemas + datreeio CRDs-catalog, no ignore-missing-schemas, via the shared `scripts/kubeconform-scan.sh`), and `trivy config` (misconfiguration scan, MEDIUM+ hard-fails; scoped justified exceptions live in `.trivyignore.yaml`) - Standalone jobs on every PR: `helm-render` (templates every addon against its appset-pinned chart with base + each env's values — an unknown key fails here, not fleet-wide at sync), `policy-admission` (renders the whole fleet into its real destination namespaces and runs `kyverno apply` against the Enforce-tier best-practice/pod-security policies, so an addon landing in a namespace the policies don't exclude fails here instead of being denied at admission on a vended enforce cluster — also asserts all four exclusion lists stay identical, that every namespace the fleet lands a workload in is on that list, and that a deliberately non-compliant canary is denied by every rule, which is what proves the run evaluated anything), `appsets` (ApplicationSet schema + documented sync-wave ordering), `appset-render` (renders the Karpenter EC2NodeClass patch template the way the ArgoCD ApplicationSet controller does — Go text/template + sprig, `missingkey=error` — against fixture create/adopt/legacy cluster Secrets, so a control-flow edit that breaks the per-cluster render fails here instead of at sync), `secrets` (gitleaks over the working tree), plus the dashboard, fork-safety, and Kyverno policy gates -- Chart pins in `applicationsets/` are watched by Renovate (`renovate.json`); `.github/dependabot.yml` owns the github-actions bumps +- Chart pins in `applicationsets/`, the Go module, the CI tool downloads and the GitHub Actions are all watched by Renovate (`renovate.json`, extending the org preset at `nanohype/.github`) - Manual diff rendering available via `.github/workflows/diff.yml` ## Claude Code Tooling diff --git a/renovate.json b/renovate.json index 1f1ca93..6039171 100644 --- a/renovate.json +++ b/renovate.json @@ -1,16 +1,31 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:recommended"], - "description": "Currency management for the catalog. Renovate watches every Helm chart version pinned in applicationsets/ (and the git-pinned Gateway API CRDs), the Go module behind the appset-render gate, and the CLI tools the CI workflow downloads — the helm-render + schema + policy CI gates then validate each bump before merge. Scoped to chart, git-tag, gomod, and CI-tool managers so it never overlaps the github-actions updates dependabot owns.", - "enabledManagers": ["argocd", "gomod", "custom.regex"], + "extends": [ + "github>nanohype/.github" + ], + "description": [ + "Currency management for the catalog, layered on the org preset at nanohype/.github.", + "What stays local is the manager scoping and the custom managers. Renovate watches every Helm chart version pinned in applicationsets/ (and the git-pinned Gateway API CRDs), the Go module behind the appset-render gate, the CLI tools the CI workflow downloads, and the GitHub Actions in .github/workflows/ — the helm-render, schema and policy CI gates then validate each bump before merge.", + "enabledManagers is an allowlist rather than a default because this repo is a manifest catalog: without it Renovate would try to read every values.yaml as a Helm chart it owns." + ], + "enabledManagers": [ + "argocd", + "gomod", + "custom.regex", + "github-actions" + ], "argocd": { - "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"] + "managerFilePatterns": [ + "/^applicationsets/[^/]+\\.ya?ml$/" + ] }, "customManagers": [ { "customType": "regex", "description": "HTTPS Helm chart pins in ApplicationSet matrix list elements (chartRepo/chart/chartVersion), which the argocd manager cannot resolve because they are templated onto the source.", - "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"], + "managerFilePatterns": [ + "/^applicationsets/[^/]+\\.ya?ml$/" + ], "matchStrings": [ "chartRepo:\\s*(?https://[^\\s]+)\\s*\\n\\s*chart:\\s*(?[^\\s]+)\\s*\\n\\s*chartVersion:\\s*\"?(?[^\"\\s]+)\"?" ], @@ -19,7 +34,9 @@ { "customType": "regex", "description": "OCI Helm chart pins in ApplicationSet matrix list elements. The registry path carries the chart name for every pin, so packageName is the path alone.", - "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"], + "managerFilePatterns": [ + "/^applicationsets/[^/]+\\.ya?ml$/" + ], "matchStrings": [ "chartRepo:\\s*oci://(?[^\\s]+)\\s*\\n\\s*chart:[^\\n]*\\n\\s*chartVersion:\\s*\"?(?[^\"\\s]+)\"?" ], @@ -28,7 +45,9 @@ { "customType": "regex", "description": "Git-pinned Gateway API CRDs (gateway-api-crds.yaml). A plain manifest directory (config/crd/standard) sourced from a git tag, not a Helm chart, so neither the argocd manager nor the chart regex managers above can resolve it. Watched against the upstream GitHub release tags so a currency PR opens and runs the render + schema gates; the deliberate-bump rationale in the file still governs the merge decision.", - "managerFilePatterns": ["/^applicationsets/gateway-api-crds\\.ya?ml$/"], + "managerFilePatterns": [ + "/^applicationsets/gateway-api-crds\\.ya?ml$/" + ], "matchStrings": [ "repoURL:\\s*https://github\\.com/(?kubernetes-sigs/gateway-api)\\s*\\n\\s*targetRevision:\\s*(?v[0-9][^\\s]+)" ], @@ -37,7 +56,9 @@ { "customType": "regex", "description": "CLI tools the CI workflow downloads as release tarballs or installs through a setup action (kyverno/gitleaks/kubeconform/trivy). These are release binaries, not GitHub Actions (dependabot owns those), so they age silently otherwise. Each pin in ci.yml's top-level env block carries a `# renovate:` comment naming its datasource + GitHub repo; a bump also fails the hardcoded checksum next to it until a human confirms the new SHA256, so it never auto-merges blind.", - "managerFilePatterns": ["/^\\.github/workflows/ci\\.ya?ml$/"], + "managerFilePatterns": [ + "/^\\.github/workflows/ci\\.ya?ml$/" + ], "matchStrings": [ "#\\s*renovate:\\s*datasource=(?[a-z-]+)\\s+depName=(?[^\\s]+)\\s*\\n\\s*[A-Z0-9_]+:\\s*\"?(?[^\"\\s]+)\"?" ], @@ -46,27 +67,50 @@ ], "packageRules": [ { - "matchDatasources": ["helm", "docker"], - "labels": ["dependencies", "charts"] + "matchDatasources": [ + "helm", + "docker" + ], + "labels": [ + "dependencies", + "charts" + ] }, { - "matchDatasources": ["github-releases"], - "matchPackageNames": ["kubernetes-sigs/gateway-api"], - "labels": ["dependencies", "charts"] + "matchDatasources": [ + "github-releases" + ], + "matchPackageNames": [ + "kubernetes-sigs/gateway-api" + ], + "labels": [ + "dependencies", + "charts" + ] }, { - "matchManagers": ["gomod"], - "labels": ["dependencies", "go"] + "matchManagers": [ + "gomod" + ], + "labels": [ + "dependencies", + "go" + ] }, { - "matchDatasources": ["github-releases"], + "matchDatasources": [ + "github-releases" + ], "matchPackageNames": [ "kyverno/kyverno", "gitleaks/gitleaks", "yannh/kubeconform", "aquasecurity/trivy" ], - "labels": ["dependencies", "ci"] + "labels": [ + "dependencies", + "ci" + ] } ] }