---
date: 2026-10-30
branch: fix/renovate-hold-auth-and-self
title: Operator decision — the oauth2-proxy sidecar and Renovate's own version never auto-merge
---

## What changed

`renovate.json5` gains two packageRules. Both set `automerge: false` and `addLabels: ["needs-review"]`.
They sit after the auto-merge rule, so they override it at every update type. Each rule's
`description` carries the operator's reason.

1. **`quay.io/oauth2-proxy/oauth2-proxy`.** This is the single depName emitted for:
   - `catalog/render.py` `OAUTH2_PROXY_IMAGE` (custom regex manager);
   - the five rendered `apps/wave-*` sidecars;
   - `platform/crafty/deployment.yaml` (kubernetes manager).

   **Reason:** since v7.13.0, oauth2-proxy validates refreshed OIDC sessions against the access
   token, not the id_token. Every sidecar sets `--cookie-refresh`, and that path is untested against
   this Keycloak: the platform oauth2-proxy runs v7.15.5 without `--cookie-refresh`.
   `render-golden` and `--selftest` pass on the bump, but both check rendered text, not the binary.
2. **`ghcr.io/renovatebot/renovate`.** This is the job `container.image` in
   `.gitea/workflows/renovate.yaml`. The rule also lists `renovatebot/github-action`, so a
   reintroduction would be held too. It is not used anywhere today; `ci/lint.sh` rejects it.

   **Reason:** nothing re-validates `renovate.json5` against the new version before it takes
   effect. The 39.x `CONFIG_VALIDATION` failure is the precedent.

## What I verified

- **The config validates on the pinned 44.167.0.** `renovate-config-validator` printed
  `Config validated successfully`. The migration diff is only the pre-existing top-level `docker`
  block.
- **The flag change is exactly the intended one.** I used Renovate 44.167.0's own
  `resolveConfigPresets` and `applyPackageRules` to evaluate b4ff287's config and this branch's
  config against the same updates (the local dry run of the #86 config). Exactly **2 of 29**
  branch rows differ:
  - `ghcr.io-renovatebot-renovate-44.x`: `automerge=true labels=` → `automerge=false labels=needs-review`;
  - `quay.io-oauth2-proxy-oauth2-proxy-7.x`: the same change, and every upgrade in the branch
    resolves `false`, the `catalog/render.py` one included.

  The other 27 rows are byte-identical.

## What I did NOT verify

- **The three GitHub-hosted branches** in run 357 (`pin-dependencies`, `kubevirt-cdi`,
  `intel-intel-device-plugins-for-kubernetes-0.x`) are not in the harness table: my local run has
  no github.com token. Neither rule's package names can match them.
- **A live Renovate run with this config.** The next debug-level dispatch should show
  `needs-review` on both branches.
- **The oauth2-proxy refresh path itself** remains untested. Exercising it on one app is the
  review the label asks for.