Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity
Files
main
home-network-k3s-impl/decisions/2026-10-30-renovate-hold-auth-and-self.md
T
jakman85andClaude Opus 5.5 df96be98bf
gate / gate (pull_request) Successful in 2m51s
Details
gate / conformance (pull_request) Has been skipped
Details
fix(renovate): never auto-merge the oauth2-proxy sidecar or Renovate's own version 
Operator decision. Both are held at every update type and labelled needs-review:

- quay.io/oauth2-proxy/oauth2-proxy (render.py constant, rendered sidecars, crafty). Since v7.13.0
  oauth2-proxy validates refreshed OIDC sessions against the access token, every sidecar uses
  --cookie-refresh, and that path is untested against this Keycloak.
- ghcr.io/renovatebot/renovate (and renovatebot/github-action if ever reintroduced). Nothing
  re-validates renovate.json5 against the new version before it takes effect.

The validator passes on 44.167.0. Evaluated with Renovate's own packageRules engine: exactly 2 of 29
branch rows change (automerge true -> false, +needs-review); the other 27 are identical.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-30 02:54:51 -05:00

2.8 KiB
Raw Permalink Blame History

date, branch, title
date branch title
2026-10-30 fix/renovate-hold-auth-and-self Operator decision — the oauth2-proxy sidecar and Renovate's own version never auto-merge

What changed

renovate.json5 gains two packageRules. Both set automerge: false and addLabels: ["needs-review"]. They sit after the auto-merge rule, so they override it at every update type. Each rule's description carries the operator's reason.

  1. quay.io/oauth2-proxy/oauth2-proxy. This is the single depName emitted for:

    • catalog/render.py OAUTH2_PROXY_IMAGE (custom regex manager);
    • the five rendered apps/wave-* sidecars;
    • platform/crafty/deployment.yaml (kubernetes manager).

    Reason: since v7.13.0, oauth2-proxy validates refreshed OIDC sessions against the access token, not the id_token. Every sidecar sets --cookie-refresh, and that path is untested against this Keycloak: the platform oauth2-proxy runs v7.15.5 without --cookie-refresh. render-golden and --selftest pass on the bump, but both check rendered text, not the binary.

  2. ghcr.io/renovatebot/renovate. This is the job container.image in .gitea/workflows/renovate.yaml. The rule also lists renovatebot/github-action, so a reintroduction would be held too. It is not used anywhere today; ci/lint.sh rejects it.

    Reason: nothing re-validates renovate.json5 against the new version before it takes effect. The 39.x CONFIG_VALIDATION failure is the precedent.

What I verified

  • The config validates on the pinned 44.167.0. renovate-config-validator printed Config validated successfully. The migration diff is only the pre-existing top-level docker block.

  • The flag change is exactly the intended one. I used Renovate 44.167.0's own resolveConfigPresets and applyPackageRules to evaluate b4ff287's config and this branch's config against the same updates (the local dry run of the #86 config). Exactly 2 of 29 branch rows differ:

    • ghcr.io-renovatebot-renovate-44.x: automerge=true labels= → automerge=false labels=needs-review;
    • quay.io-oauth2-proxy-oauth2-proxy-7.x: the same change, and every upgrade in the branch resolves false, the catalog/render.py one included.

    The other 27 rows are byte-identical.

What I did NOT verify

  • The three GitHub-hosted branches in run 357 (pin-dependencies, kubevirt-cdi, intel-intel-device-plugins-for-kubernetes-0.x) are not in the harness table: my local run has no github.com token. Neither rule's package names can match them.
  • A live Renovate run with this config. The next debug-level dispatch should show needs-review on both branches.
  • The oauth2-proxy refresh path itself remains untested. Exercising it on one app is the review the label asks for.
Reference in new issue View Git Blame Copy Permalink