jakman85andClaude Opus 5.5
df96be98bf
Operator decision. Both are held at every update type and labelled needs-review: - quay.io/oauth2-proxy/oauth2-proxy (render.py constant, rendered sidecars, crafty). Since v7.13.0 oauth2-proxy validates refreshed OIDC sessions against the access token, every sidecar uses --cookie-refresh, and that path is untested against this Keycloak. - ghcr.io/renovatebot/renovate (and renovatebot/github-action if ever reintroduced). Nothing re-validates renovate.json5 against the new version before it takes effect. The validator passes on 44.167.0. Evaluated with Renovate's own packageRules engine: exactly 2 of 29 branch rows change (automerge true -> false, +needs-review); the other 27 are identical. Co-Authored-By: Claude Opus 5.5 <[email protected]>
53 lines
2.8 KiB
Markdown
53 lines
2.8 KiB
Markdown
---
|
|
date: 2026-10-30
|
|
branch: fix/renovate-hold-auth-and-self
|
|
title: Operator decision — the oauth2-proxy sidecar and Renovate's own version never auto-merge
|
|
---
|
|
|
|
## What changed
|
|
|
|
`renovate.json5` gains two packageRules. Both set `automerge: false` and `addLabels: ["needs-review"]`.
|
|
They sit after the auto-merge rule, so they override it at every update type. Each rule's
|
|
`description` carries the operator's reason.
|
|
|
|
1. **`quay.io/oauth2-proxy/oauth2-proxy`.** This is the single depName emitted for:
|
|
- `catalog/render.py` `OAUTH2_PROXY_IMAGE` (custom regex manager);
|
|
- the five rendered `apps/wave-*` sidecars;
|
|
- `platform/crafty/deployment.yaml` (kubernetes manager).
|
|
|
|
**Reason:** since v7.13.0, oauth2-proxy validates refreshed OIDC sessions against the access
|
|
token, not the id_token. Every sidecar sets `--cookie-refresh`, and that path is untested against
|
|
this Keycloak: the platform oauth2-proxy runs v7.15.5 without `--cookie-refresh`.
|
|
`render-golden` and `--selftest` pass on the bump, but both check rendered text, not the binary.
|
|
2. **`ghcr.io/renovatebot/renovate`.** This is the job `container.image` in
|
|
`.gitea/workflows/renovate.yaml`. The rule also lists `renovatebot/github-action`, so a
|
|
reintroduction would be held too. It is not used anywhere today; `ci/lint.sh` rejects it.
|
|
|
|
**Reason:** nothing re-validates `renovate.json5` against the new version before it takes
|
|
effect. The 39.x `CONFIG_VALIDATION` failure is the precedent.
|
|
|
|
## What I verified
|
|
|
|
- **The config validates on the pinned 44.167.0.** `renovate-config-validator` printed
|
|
`Config validated successfully`. The migration diff is only the pre-existing top-level `docker`
|
|
block.
|
|
- **The flag change is exactly the intended one.** I used Renovate 44.167.0's own
|
|
`resolveConfigPresets` and `applyPackageRules` to evaluate b4ff287's config and this branch's
|
|
config against the same updates (the local dry run of the #86 config). Exactly **2 of 29**
|
|
branch rows differ:
|
|
- `ghcr.io-renovatebot-renovate-44.x`: `automerge=true labels=` → `automerge=false labels=needs-review`;
|
|
- `quay.io-oauth2-proxy-oauth2-proxy-7.x`: the same change, and every upgrade in the branch
|
|
resolves `false`, the `catalog/render.py` one included.
|
|
|
|
The other 27 rows are byte-identical.
|
|
|
|
## What I did NOT verify
|
|
|
|
- **The three GitHub-hosted branches** in run 357 (`pin-dependencies`, `kubevirt-cdi`,
|
|
`intel-intel-device-plugins-for-kubernetes-0.x`) are not in the harness table: my local run has
|
|
no github.com token. Neither rule's package names can match them.
|
|
- **A live Renovate run with this config.** The next debug-level dispatch should show
|
|
`needs-review` on both branches.
|
|
- **The oauth2-proxy refresh path itself** remains untested. Exercising it on one app is the
|
|
review the label asks for.
|