fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version #87

2026-10-30T07:58:15Z

gitea-admin commented

2026-10-30 07:58:15 +00:00

Operator decision

These two never auto-merge, at any update type, and are labelled needs-review:

quay.io/oauth2-proxy/oauth2-proxy. This is the one depName emitted for catalog/render.py OAUTH2_PROXY_IMAGE, the 5 rendered apps/wave-* sidecars and platform/crafty/deployment.yaml.
- Reason: since v7.13.0, oauth2-proxy validates refreshed OIDC sessions against the access token. Every sidecar uses --cookie-refresh, and that path is untested against this Keycloak: the platform proxy runs v7.15.5 without it.
- render-golden and --selftest pass on the bump, but they check rendered text, not the binary.
ghcr.io/renovatebot/renovate (the job container.image), plus renovatebot/github-action should it ever come back.
- Reason: nothing re-validates renovate.json5 against the new version before it takes effect. See the 39.x CONFIG_VALIDATION precedent.

Only renovate.json5 changes, plus the handoff decisions/2026-10-30-renovate-hold-auth-and-self.md.

Evidence

renovate-config-validator on 44.167.0: Config validated successfully.
Renovate 44.167.0's own resolveConfigPresets + applyPackageRules, run on b4ff287's config vs this branch's: exactly 2 of 29 branch rows change.

< ghcr.io-renovatebot-renovate-44.x      minor automerge=true  labels=              44.167.0->44.198.0
> ghcr.io-renovatebot-renovate-44.x      minor automerge=false labels=needs-review  44.167.0->44.198.0
< quay.io-oauth2-proxy-oauth2-proxy-7.x  minor automerge=true  labels=              v7.8.1->v7.15.5  (7 files incl. catalog/render.py)
> quay.io-oauth2-proxy-oauth2-proxy-7.x  minor automerge=false labels=needs-review  v7.8.1->v7.15.5

The other 27 rows are identical. Run 357's 3 GitHub-hosted branches are not in the local table (no github.com token there), and neither rule can match them.

Gate

The local toolbox gate returned rc 3 (UNDETERMINED, not green). gitea-settings is the only stage that did not run. renovate.json5 is not a sensitive path.

🤖 Generated with Claude Code

## Operator decision These two never auto-merge, at any update type, and are labelled `needs-review`: 1. **`quay.io/oauth2-proxy/oauth2-proxy`.** This is the one depName emitted for `catalog/render.py` `OAUTH2_PROXY_IMAGE`, the 5 rendered `apps/wave-*` sidecars and `platform/crafty/deployment.yaml`. - **Reason:** since v7.13.0, oauth2-proxy validates refreshed OIDC sessions against the **access token**. Every sidecar uses `--cookie-refresh`, and that path is untested against this Keycloak: the platform proxy runs v7.15.5 *without* it. - `render-golden` and `--selftest` pass on the bump, but they check rendered text, not the binary. 2. **`ghcr.io/renovatebot/renovate`** (the job `container.image`), plus `renovatebot/github-action` should it ever come back. - **Reason:** nothing re-validates `renovate.json5` against the new version before it takes effect. See the 39.x `CONFIG_VALIDATION` precedent. Only `renovate.json5` changes, plus the handoff `decisions/2026-10-30-renovate-hold-auth-and-self.md`. ## Evidence - `renovate-config-validator` on 44.167.0: `Config validated successfully`. - Renovate 44.167.0's own `resolveConfigPresets` + `applyPackageRules`, run on b4ff287's config vs this branch's: **exactly 2 of 29 branch rows change**. ``` < ghcr.io-renovatebot-renovate-44.x minor automerge=true labels= 44.167.0->44.198.0 > ghcr.io-renovatebot-renovate-44.x minor automerge=false labels=needs-review 44.167.0->44.198.0 < quay.io-oauth2-proxy-oauth2-proxy-7.x minor automerge=true labels= v7.8.1->v7.15.5 (7 files incl. catalog/render.py) > quay.io-oauth2-proxy-oauth2-proxy-7.x minor automerge=false labels=needs-review v7.8.1->v7.15.5 ``` The other 27 rows are identical. Run 357's 3 GitHub-hosted branches are not in the local table (no github.com token there), and neither rule can match them. ## Gate The local toolbox gate returned **rc 3** (UNDETERMINED, not green). `gitea-settings` is the only stage that did not run. `renovate.json5` is not a sensitive path. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-10-30 07:58:15 +00:00

fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version

gate / gate (pull_request) Successful in 2m51s

Details

gate / conformance (pull_request) Has been skipped

Details

df96be98bf

Operator decision. Both are held at every update type and labelled needs-review:

- quay.io/oauth2-proxy/oauth2-proxy (render.py constant, rendered sidecars, crafty). Since v7.13.0
  oauth2-proxy validates refreshed OIDC sessions against the access token, every sidecar uses
  --cookie-refresh, and that path is untested against this Keycloak.
- ghcr.io/renovatebot/renovate (and renovatebot/github-action if ever reintroduced). Nothing
  re-validates renovate.json5 against the new version before it takes effect.

The validator passes on 44.167.0. Evaluated with Renovate's own packageRules engine: exactly 2 of 29
branch rows change (automerge true -> false, +needs-review); the other 27 are identical.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 added 1 commit 2026-10-30 08:14:17 +00:00

Merge branch 'main' into fix/renovate-hold-auth-and-self

gate / gate (pull_request) Successful in 2m55s

Details

gate / conformance (pull_request) Has been skipped

Details

74ba90c0b3

jakman85 merged commit a4d5206294 into main

2026-10-30 08:21:22 +00:00

jakman85 referenced this issue from a commit

2026-10-30 08:21:24 +00:00

Merge pull request 'fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version' (#87) from fix/renovate-hold-auth-and-self into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#87