fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version

Operator decision. Both are held at every update type and labelled needs-review:

- quay.io/oauth2-proxy/oauth2-proxy (render.py constant, rendered sidecars, crafty). Since v7.13.0
  oauth2-proxy validates refreshed OIDC sessions against the access token, every sidecar uses
  --cookie-refresh, and that path is untested against this Keycloak.
- ghcr.io/renovatebot/renovate (and renovatebot/github-action if ever reintroduced). Nothing
  re-validates renovate.json5 against the new version before it takes effect.

The validator passes on 44.167.0. Evaluated with Renovate's own packageRules engine: exactly 2 of 29
branch rows change (automerge true -> false, +needs-review); the other 27 are identical.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

decisions/2026-10-30-renovate-hold-auth-and-self.md

@@ -0,0 +1,52 @@
+---
+date: 2026-10-30
+branch: fix/renovate-hold-auth-and-self
+title: Operator decision — the oauth2-proxy sidecar and Renovate's own version never auto-merge
+---
+
+## What changed
+
+`renovate.json5` gains two packageRules. Both set `automerge: false` and `addLabels: ["needs-review"]`.
+They sit after the auto-merge rule, so they override it at every update type. Each rule's
+`description` carries the operator's reason.
+
+1. **`quay.io/oauth2-proxy/oauth2-proxy`.** This is the single depName emitted for:
+   - `catalog/render.py` `OAUTH2_PROXY_IMAGE` (custom regex manager);
+   - the five rendered `apps/wave-*` sidecars;
+   - `platform/crafty/deployment.yaml` (kubernetes manager).
+
+   **Reason:** since v7.13.0, oauth2-proxy validates refreshed OIDC sessions against the access
+   token, not the id_token. Every sidecar sets `--cookie-refresh`, and that path is untested against
+   this Keycloak: the platform oauth2-proxy runs v7.15.5 without `--cookie-refresh`.
+   `render-golden` and `--selftest` pass on the bump, but both check rendered text, not the binary.
+2. **`ghcr.io/renovatebot/renovate`.** This is the job `container.image` in
+   `.gitea/workflows/renovate.yaml`. The rule also lists `renovatebot/github-action`, so a
+   reintroduction would be held too. It is not used anywhere today; `ci/lint.sh` rejects it.
+
+   **Reason:** nothing re-validates `renovate.json5` against the new version before it takes
+   effect. The 39.x `CONFIG_VALIDATION` failure is the precedent.
+
+## What I verified
+
+- **The config validates on the pinned 44.167.0.** `renovate-config-validator` printed
+  `Config validated successfully`. The migration diff is only the pre-existing top-level `docker`
+  block.
+- **The flag change is exactly the intended one.** I used Renovate 44.167.0's own
+  `resolveConfigPresets` and `applyPackageRules` to evaluate b4ff287's config and this branch's
+  config against the same updates (the local dry run of the #86 config). Exactly **2 of 29**
+  branch rows differ:
+  - `ghcr.io-renovatebot-renovate-44.x`: `automerge=true labels=` → `automerge=false labels=needs-review`;
+  - `quay.io-oauth2-proxy-oauth2-proxy-7.x`: the same change, and every upgrade in the branch
+    resolves `false`, the `catalog/render.py` one included.
+
+  The other 27 rows are byte-identical.
+
+## What I did NOT verify
+
+- **The three GitHub-hosted branches** in run 357 (`pin-dependencies`, `kubevirt-cdi`,
+  `intel-intel-device-plugins-for-kubernetes-0.x`) are not in the harness table: my local run has
+  no github.com token. Neither rule's package names can match them.
+- **A live Renovate run with this config.** The next debug-level dispatch should show
+  `needs-review` on both branches.
+- **The oauth2-proxy refresh path itself** remains untested. Exercising it on one app is the
+  review the label asks for.