From 347836ac0e1906e75f66b883b534f21fbb70c821 Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Fri, 7 Aug 2026 18:41:47 -0700 Subject: [PATCH] chore: one dependency bot, not two MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This was the only repo in the org still running Dependabot. It owned the github-actions bumps while Renovate owned the chart pins, the Go module and the CI tool downloads — two tools splitting one job, in the one repo where the split was never revisited after Renovate arrived everywhere else. Renovate now owns all four. .github/dependabot.yml is deleted and github-actions joins the enabledManagers allowlist. This is not a like-for-like swap: the org preset sets pinDigests on github-actions, so actions are pinned to commit SHAs and kept there. Dependabot's config here did not do that, and SHA pinning is the reason those pins were brought up to date by hand in the first place — the tool now maintains what a person had to. The rest stays local, because it is genuinely local. enabledManagers is an allowlist rather than a default: this repo is a manifest catalog, and without it Renovate reads every values.yaml as a Helm chart it owns. The four custom managers that find chart pins inside ApplicationSet matrix elements have no equivalent anywhere else in the org. Both are described in the config rather than left to be inferred. The posture — patch and minor open a PR, majors labelled for review, CVE-triggered updates excluded from automerge twice over, related packages grouped — now comes from the shared preset instead of being absent here, which it was: this config carried no automerge rules and no vulnerability handling at all. CLAUDE.md said dependabot owned the actions. It now says what is true. --- .github/dependabot.yml | 18 ---------- CLAUDE.md | 2 +- renovate.json | 78 +++++++++++++++++++++++++++++++++--------- 3 files changed, 62 insertions(+), 36 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 439797f..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,18 +0,0 @@ -version: 2 -updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: weekly - day: monday - time: "09:00" - timezone: America/Los_Angeles - commit-message: - prefix: "ci" - labels: - - "ci/cd" - - "automated" - groups: - github-actions: - patterns: - - "*" diff --git a/CLAUDE.md b/CLAUDE.md index 6c77f5d..0ef78ef 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -108,7 +108,7 @@ documents: `task validate` runs it report-only, CI runs it `--blocking`. - PR and push to main trigger `.github/workflows/ci.yml` (lint → validate per environment → PR summary) - The validate job renders every kustomize root plus the druid catalog chart, then gates the rendered output: render-assert (no unfilled sentinels), kubeconform strict (native schemas + datreeio CRDs-catalog, no ignore-missing-schemas, via the shared `scripts/kubeconform-scan.sh`), and `trivy config` (misconfiguration scan, MEDIUM+ hard-fails; scoped justified exceptions live in `.trivyignore.yaml`) - Standalone jobs on every PR: `helm-render` (templates every addon against its appset-pinned chart with base + each env's values — an unknown key fails here, not fleet-wide at sync), `policy-admission` (renders the whole fleet into its real destination namespaces and runs `kyverno apply` against the Enforce-tier best-practice/pod-security policies, so an addon landing in a namespace the policies don't exclude fails here instead of being denied at admission on a vended enforce cluster — also asserts all four exclusion lists stay identical, that every namespace the fleet lands a workload in is on that list, and that a deliberately non-compliant canary is denied by every rule, which is what proves the run evaluated anything), `appsets` (ApplicationSet schema + documented sync-wave ordering), `appset-render` (renders the Karpenter EC2NodeClass patch template the way the ArgoCD ApplicationSet controller does — Go text/template + sprig, `missingkey=error` — against fixture create/adopt/legacy cluster Secrets, so a control-flow edit that breaks the per-cluster render fails here instead of at sync), `secrets` (gitleaks over the working tree), plus the dashboard, fork-safety, and Kyverno policy gates -- Chart pins in `applicationsets/` are watched by Renovate (`renovate.json`); `.github/dependabot.yml` owns the github-actions bumps +- Chart pins in `applicationsets/`, the Go module, the CI tool downloads and the GitHub Actions are all watched by Renovate (`renovate.json`, extending the org preset at `nanohype/.github`) - Manual diff rendering available via `.github/workflows/diff.yml` ## Claude Code Tooling diff --git a/renovate.json b/renovate.json index 1f1ca93..6039171 100644 --- a/renovate.json +++ b/renovate.json @@ -1,16 +1,31 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:recommended"], - "description": "Currency management for the catalog. Renovate watches every Helm chart version pinned in applicationsets/ (and the git-pinned Gateway API CRDs), the Go module behind the appset-render gate, and the CLI tools the CI workflow downloads — the helm-render + schema + policy CI gates then validate each bump before merge. Scoped to chart, git-tag, gomod, and CI-tool managers so it never overlaps the github-actions updates dependabot owns.", - "enabledManagers": ["argocd", "gomod", "custom.regex"], + "extends": [ + "github>nanohype/.github" + ], + "description": [ + "Currency management for the catalog, layered on the org preset at nanohype/.github.", + "What stays local is the manager scoping and the custom managers. Renovate watches every Helm chart version pinned in applicationsets/ (and the git-pinned Gateway API CRDs), the Go module behind the appset-render gate, the CLI tools the CI workflow downloads, and the GitHub Actions in .github/workflows/ — the helm-render, schema and policy CI gates then validate each bump before merge.", + "enabledManagers is an allowlist rather than a default because this repo is a manifest catalog: without it Renovate would try to read every values.yaml as a Helm chart it owns." + ], + "enabledManagers": [ + "argocd", + "gomod", + "custom.regex", + "github-actions" + ], "argocd": { - "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"] + "managerFilePatterns": [ + "/^applicationsets/[^/]+\\.ya?ml$/" + ] }, "customManagers": [ { "customType": "regex", "description": "HTTPS Helm chart pins in ApplicationSet matrix list elements (chartRepo/chart/chartVersion), which the argocd manager cannot resolve because they are templated onto the source.", - "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"], + "managerFilePatterns": [ + "/^applicationsets/[^/]+\\.ya?ml$/" + ], "matchStrings": [ "chartRepo:\\s*(?https://[^\\s]+)\\s*\\n\\s*chart:\\s*(?[^\\s]+)\\s*\\n\\s*chartVersion:\\s*\"?(?[^\"\\s]+)\"?" ], @@ -19,7 +34,9 @@ { "customType": "regex", "description": "OCI Helm chart pins in ApplicationSet matrix list elements. The registry path carries the chart name for every pin, so packageName is the path alone.", - "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"], + "managerFilePatterns": [ + "/^applicationsets/[^/]+\\.ya?ml$/" + ], "matchStrings": [ "chartRepo:\\s*oci://(?[^\\s]+)\\s*\\n\\s*chart:[^\\n]*\\n\\s*chartVersion:\\s*\"?(?[^\"\\s]+)\"?" ], @@ -28,7 +45,9 @@ { "customType": "regex", "description": "Git-pinned Gateway API CRDs (gateway-api-crds.yaml). A plain manifest directory (config/crd/standard) sourced from a git tag, not a Helm chart, so neither the argocd manager nor the chart regex managers above can resolve it. Watched against the upstream GitHub release tags so a currency PR opens and runs the render + schema gates; the deliberate-bump rationale in the file still governs the merge decision.", - "managerFilePatterns": ["/^applicationsets/gateway-api-crds\\.ya?ml$/"], + "managerFilePatterns": [ + "/^applicationsets/gateway-api-crds\\.ya?ml$/" + ], "matchStrings": [ "repoURL:\\s*https://github\\.com/(?kubernetes-sigs/gateway-api)\\s*\\n\\s*targetRevision:\\s*(?v[0-9][^\\s]+)" ], @@ -37,7 +56,9 @@ { "customType": "regex", "description": "CLI tools the CI workflow downloads as release tarballs or installs through a setup action (kyverno/gitleaks/kubeconform/trivy). These are release binaries, not GitHub Actions (dependabot owns those), so they age silently otherwise. Each pin in ci.yml's top-level env block carries a `# renovate:` comment naming its datasource + GitHub repo; a bump also fails the hardcoded checksum next to it until a human confirms the new SHA256, so it never auto-merges blind.", - "managerFilePatterns": ["/^\\.github/workflows/ci\\.ya?ml$/"], + "managerFilePatterns": [ + "/^\\.github/workflows/ci\\.ya?ml$/" + ], "matchStrings": [ "#\\s*renovate:\\s*datasource=(?[a-z-]+)\\s+depName=(?[^\\s]+)\\s*\\n\\s*[A-Z0-9_]+:\\s*\"?(?[^\"\\s]+)\"?" ], @@ -46,27 +67,50 @@ ], "packageRules": [ { - "matchDatasources": ["helm", "docker"], - "labels": ["dependencies", "charts"] + "matchDatasources": [ + "helm", + "docker" + ], + "labels": [ + "dependencies", + "charts" + ] }, { - "matchDatasources": ["github-releases"], - "matchPackageNames": ["kubernetes-sigs/gateway-api"], - "labels": ["dependencies", "charts"] + "matchDatasources": [ + "github-releases" + ], + "matchPackageNames": [ + "kubernetes-sigs/gateway-api" + ], + "labels": [ + "dependencies", + "charts" + ] }, { - "matchManagers": ["gomod"], - "labels": ["dependencies", "go"] + "matchManagers": [ + "gomod" + ], + "labels": [ + "dependencies", + "go" + ] }, { - "matchDatasources": ["github-releases"], + "matchDatasources": [ + "github-releases" + ], "matchPackageNames": [ "kyverno/kyverno", "gitleaks/gitleaks", "yannh/kubeconform", "aquasecurity/trivy" ], - "labels": ["dependencies", "ci"] + "labels": [ + "dependencies", + "ci" + ] } ] }