fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges #86

2026-10-30T07:38:59Z

gitea-admin commented

2026-10-30 07:38:59 +00:00

Why

Dispatch runs 353 and 354 are Renovate's first completed runs: result: done, exit 0, dry-run, inside the schedule window. I audited both logs and reproduced the per-dependency detail with a debug-level local dry run of the same commit. A real run would have done these things:

Opened a red PR for every app image. Updates edited only the generated apps/wave-*, never catalog/. A ServiceDefinition has no apiVersion, so the kubernetes manager extracts 0 deps there, and the oauth2-proxy sidecar is a constant in render.py. Reproduced: ci/render-golden.sh returns rc 1, GOLDEN DRIFT.
Bumped the CNPG grant Job but not the databases. Cluster.spec.imageName is untracked in all 3 Clusters.
Proposed bogus or out-of-policy majors: gitea 28.2.0, qbittorrent 20.04.1, radarr 6, nextcloud 35, postgres 18. Each ServiceDefinition's update.range forbids these, but Renovate doesn't read it.
Auto-merged changes that should get a human: gitea 1.24→1.27 and act_runner 0.2→0.6 (the merge gate's own host), Helm range widenings, and python 3.13→3.15.
Never moved velero-plugin-for-aws off its RC. Docker versioning treats -rc.2 as a suffix.

What changed (`renovate.json5` only)

Regex managers for catalog source.image, render.py OAUTH2_PROXY_IMAGE and CNPG imageName. They use the same depName as the rendered line, so the source and generated edits land in one branch.
allowedVersions that mirror catalog/*/update.range, plus postgresql <17.
Blast-radius list: adds gitea, act_runner and postgresql.
range-widen changes are never auto-merged.
python minors are never auto-merged.
Majors need a Dependency Dashboard tick before a PR opens, so they stop holding prConcurrentLimit slots.
velero plugin uses semver versioning.
The flux duplicate docker extractions are disabled.
Two false comments are corrected.

Evidence

renovate-config-validator on 44.167.0: validated.
Local dry run, before vs after:
- regex deps 7 → 20;
- branches 33 → 29, with the 5 bogus majors gone and velero v1.14.3-rc.2 → v1.14.4 added;
- app branches now carry catalog/ + apps/;
- the postgres branch carries all 3 Clusters.
render-golden, after applying the gitea and oauth2-proxy branch edits: rc 0. With the old shape (only the generated file edited): rc 1.
Full class table: decisions/2026-10-30-renovate-run-hygiene.md.

Not verified: the merged automerge, label and dashboard-approval flags per branch. --platform=local stops before branch processing. The next debug dispatch shows them.

Gate

The local toolbox gate returned rc 3 (UNDETERMINED, not green). gitea-settings is the only stage that did not run. renovate.json5 is not a sensitive path in approval-policy.json.

🤖 Generated with Claude Code

## Why Dispatch runs 353 and 354 are Renovate's first completed runs: `result: done`, exit 0, dry-run, inside the schedule window. I audited both logs and reproduced the per-dependency detail with a debug-level local dry run of the same commit. A real run would have done these things: - **Opened a red PR for every app image.** Updates edited only the generated `apps/wave-*`, never `catalog/`. A ServiceDefinition has no `apiVersion`, so the `kubernetes` manager extracts 0 deps there, and the oauth2-proxy sidecar is a constant in `render.py`. Reproduced: `ci/render-golden.sh` returns rc 1, `GOLDEN DRIFT`. - **Bumped the CNPG grant Job but not the databases.** `Cluster.spec.imageName` is untracked in all 3 Clusters. - **Proposed bogus or out-of-policy majors:** gitea 28.2.0, qbittorrent 20.04.1, radarr 6, nextcloud 35, postgres 18. Each ServiceDefinition's `update.range` forbids these, but Renovate doesn't read it. - **Auto-merged changes that should get a human:** gitea 1.24→1.27 and act_runner 0.2→0.6 (the merge gate's own host), Helm range widenings, and python 3.13→3.15. - **Never moved velero-plugin-for-aws off its RC.** Docker versioning treats `-rc.2` as a suffix. ## What changed (`renovate.json5` only) - Regex managers for catalog `source.image`, `render.py` `OAUTH2_PROXY_IMAGE` and CNPG `imageName`. They use the same depName as the rendered line, so the source and generated edits land in one branch. - `allowedVersions` that mirror `catalog/*/update.range`, plus postgresql `<17`. - Blast-radius list: adds gitea, act_runner and postgresql. - `range-widen` changes are never auto-merged. - python minors are never auto-merged. - Majors need a Dependency Dashboard tick before a PR opens, so they stop holding `prConcurrentLimit` slots. - velero plugin uses semver versioning. - The flux duplicate docker extractions are disabled. - Two false comments are corrected. ## Evidence - `renovate-config-validator` on 44.167.0: validated. - Local dry run, before vs after: - regex deps 7 → 20; - branches 33 → 29, with the 5 bogus majors gone and velero `v1.14.3-rc.2 → v1.14.4` added; - app branches now carry `catalog/` + `apps/`; - the postgres branch carries all 3 Clusters. - render-golden, after applying the gitea and oauth2-proxy branch edits: **rc 0**. With the old shape (only the generated file edited): **rc 1**. - Full class table: `decisions/2026-10-30-renovate-run-hygiene.md`. **Not verified:** the merged automerge, label and dashboard-approval flags per branch. `--platform=local` stops before branch processing. The next debug dispatch shows them. ## Gate The local toolbox gate returned **rc 3** (UNDETERMINED, not green). `gitea-settings` is the only stage that did not run. `renovate.json5` is not a sensitive path in `approval-policy.json`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-10-30 07:38:59 +00:00

fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges

gate / gate (pull_request) Successful in 2m55s

Details

gate / conformance (pull_request) Has been skipped

Details

d9571fc6d8

Audit of the first completed dry runs (353/354) plus a debug-level local reproduction:

- App-image updates edited only the generated apps/wave-*. A ServiceDefinition has no apiVersion,
  so the kubernetes manager extracts nothing from catalog/, and every such PR would fail
  render-golden (reproduced: GOLDEN DRIFT). New regex managers for catalog source.image and
  render.py OAUTH2_PROXY_IMAGE put the source and generated edits in one branch (render-golden
  rc 0, reproduced).
- CNPG Cluster imageName was untracked (3 Clusters), while the grant Job was tracked. New manager.
- allowedVersions mirror catalog update.range: this drops gitea 28.x, qbittorrent 20.x, radarr 6,
  nextcloud 35 and postgresql 18.
- Never auto-merge: gitea, act_runner, postgresql (blast radius), flux range widening, python
  minors. Majors wait for a Dependency Dashboard tick.
- velero plugin RC: semver versioning (v1.14.3-rc.2 -> v1.14.4 now proposed).
- flux docker duplicates disabled (the "Cannot find replaceString" line). Two false comments
  corrected.

Local dry run: regex deps 7 -> 20, branches 33 -> 29. The validator passes on 44.167.0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 scheduled this pull request to auto merge when all checks succeed 2026-10-30 07:43:27 +00:00

jakman85 merged commit b4ff2879be into main

2026-10-30 07:43:28 +00:00

jakman85 referenced this issue from a commit

2026-10-30 07:43:30 +00:00

Merge pull request 'fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges' (#86) from fix/renovate-run-hygiene into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#86

fix(renovate): edit catalog sources, track CNPG imageName, honour update.range, guard real-run auto-merges #86

Why

What changed (renovate.json5 only)

Evidence

Gate

What changed (`renovate.json5` only)