fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version #87

Merged

jakman85 merged 2 commits from fix/renovate-hold-auth-and-self into main

2026-10-30 08:21:22 +00:00

Author	SHA1	Message	Date
jakman85	74ba90c0b3	Merge branch 'main' into fix/renovate-hold-auth-and-self gate / gate (pull_request) Successful in 2m55s Details gate / conformance (pull_request) Has been skipped Details	2026-10-30 08:14:15 +00:00
jakman85andClaude Opus 5.5	df96be98bf	fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version gate / gate (pull_request) Successful in 2m51s Details gate / conformance (pull_request) Has been skipped Details Operator decision. Both are held at every update type and labelled needs-review: - quay.io/oauth2-proxy/oauth2-proxy (render.py constant, rendered sidecars, crafty). Since v7.13.0 oauth2-proxy validates refreshed OIDC sessions against the access token, every sidecar uses --cookie-refresh, and that path is untested against this Keycloak. - ghcr.io/renovatebot/renovate (and renovatebot/github-action if ever reintroduced). Nothing re-validates renovate.json5 against the new version before it takes effect. The validator passes on 44.167.0. Evaluated with Renovate's own packageRules engine: exactly 2 of 29 branch rows change (automerge true -> false, +needs-review); the other 27 are identical. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-30 02:54:51 -05:00

Author

SHA1

Message

Date

jakman85

74ba90c0b3

Merge branch 'main' into fix/renovate-hold-auth-and-self

gate / gate (pull_request) Successful in 2m55s

Details

gate / conformance (pull_request) Has been skipped

Details

2026-10-30 08:14:15 +00:00

jakman85andClaude Opus 5.5

df96be98bf

fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version

gate / gate (pull_request) Successful in 2m51s

Details

gate / conformance (pull_request) Has been skipped

Details

Operator decision. Both are held at every update type and labelled needs-review:

- quay.io/oauth2-proxy/oauth2-proxy (render.py constant, rendered sidecars, crafty). Since v7.13.0
  oauth2-proxy validates refreshed OIDC sessions against the access token, every sidecar uses
  --cookie-refresh, and that path is untested against this Keycloak.
- ghcr.io/renovatebot/renovate (and renovatebot/github-action if ever reintroduced). Nothing
  re-validates renovate.json5 against the new version before it takes effect.

The validator passes on 44.167.0. Evaluated with Renovate's own packageRules engine: exactly 2 of 29
branch rows change (automerge true -> false, +needs-review); the other 27 are identical.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-30 02:54:51 -05:00