feat: prepare suspended self-hosted Renovate pilot #13

Open

anton wants to merge 1 commit from feat/renovate-pilot into main

anton commented

2026-10-23 03:39:15 +00:00

Owner

Summary

Add the shared, low-noise Renovate policy for public/infrastructure and public/platform: manual merges, approval-gated high-risk updates, and report-only security findings.
Add a digest-pinned, non-root runner with persistent cache, NetworkPolicy and SOPS secret generation. It is suspended, full-dry-run-only and excluded from the internal root overlay; no credentials are included.
Document credential provisioning, authenticated validation and controlled smoke runs; add nine policy/native-handler regression tests.

Merge scope: inactive preparation. Merge this before the platform companion. Credentials are not needed to merge. Deployment is operator-owned and separate.

Companion: public/platform#501 — merge infrastructure first.

Verification

Passed on infrastructure b0b31a0dcad7ffd8af26f4e95fbc31508fecdf76 with platform 01b72e6088b41e9c8ca436353a3f8a2cb586b35b:

image=ghcr.io/renovatebot/renovate@sha256:e2ef0f770c9c469857070753a447f445da11822e2f3601a3763b1b2d1d069b9a
docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint renovate-config-validator -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --strict kustomizations/apps/renovate/config.json
docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint renovate-config-validator -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --strict --no-global renovate/default.json renovate.json /platform/renovate.json
docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint node -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --test renovate/check-policy.mjs

All four configs validated; 9 passed, 0 failed, 0 skipped. Synthetic SCM/issue fixtures exercise native branch and Dashboard handlers, not hosted Forgejo writes.

Also passed the disposable local runner harness (not a checked-in test):

docker run --rm --network none -e KUSTOMIZE_PLUGIN_HOME=/usr/lib/kustomize/plugins --entrypoint /bin/sh -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /tmp/renovate-pilot-checks:/checks:ro -w /work 16cfcebf2790 -c 'sh -n kustomizations/apps/renovate/scripts/generate-renovate-secret.sh && kustomize build kustomizations/apps/renovate >/dev/null && python3 /checks/validate-runner.py'

This checks missing-secret failure, the restricted suspended runner, and real SOPS/ksops rendering with an ephemeral key and synthetic Secret. No operator keyring or real credentials were used. Independent reviews approved the unchanged pre-credential source; the commit matches the reviewed file contents and modes.

Deployment follow-ups — not activation approval

Follow kustomizations/envs/internal/renovate/README.md after both configs land: provision restricted bot credentials, deploy suspended, then validate hosted preset resolution, native artifacts, cluster admission/storage/egress and alert delivery.
The default/unpinned npm artifact probe has not passed; only the tool-pinned probe passed. Retest the actual runner after approved public GitHub metadata access is configured.
Keep recurring writes disabled: Dashboard approvals bypass native limits/scheduling, and closed-PR handling can delete branches despite pruning being disabled. The documented one-shot isolation is not a recurring-write guarantee.
Failure/staleness alerting still needs implementation/validation. Security remediation and unsupported custom Cargo-registry updates remain manual.

No cluster apply, live bot write, merge or schedule activation was performed.

Scope: one commit; 14 files; +845 / -0 lines.

## Summary - Add the shared, low-noise Renovate policy for `public/infrastructure` and `public/platform`: manual merges, approval-gated high-risk updates, and report-only security findings. - Add a digest-pinned, non-root runner with persistent cache, NetworkPolicy and SOPS secret generation. It is **suspended, full-dry-run-only and excluded from the internal root overlay**; no credentials are included. - Document credential provisioning, authenticated validation and controlled smoke runs; add nine policy/native-handler regression tests. **Merge scope: inactive preparation. Merge this before the platform companion.** Credentials are not needed to merge. Deployment is operator-owned and separate. Companion: https://git.caution.co/public/platform/pulls/501 — merge infrastructure first. ## Verification Passed on infrastructure `b0b31a0dcad7ffd8af26f4e95fbc31508fecdf76` with platform `01b72e6088b41e9c8ca436353a3f8a2cb586b35b`: ```sh image=ghcr.io/renovatebot/renovate@sha256:e2ef0f770c9c469857070753a447f445da11822e2f3601a3763b1b2d1d069b9a docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint renovate-config-validator -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --strict kustomizations/apps/renovate/config.json docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint renovate-config-validator -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --strict --no-global renovate/default.json renovate.json /platform/renovate.json docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint node -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --test renovate/check-policy.mjs ``` All four configs validated; **9 passed, 0 failed, 0 skipped**. Synthetic SCM/issue fixtures exercise native branch and Dashboard handlers, not hosted Forgejo writes. Also passed the disposable local runner harness (not a checked-in test): ```sh docker run --rm --network none -e KUSTOMIZE_PLUGIN_HOME=/usr/lib/kustomize/plugins --entrypoint /bin/sh -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /tmp/renovate-pilot-checks:/checks:ro -w /work 16cfcebf2790 -c 'sh -n kustomizations/apps/renovate/scripts/generate-renovate-secret.sh && kustomize build kustomizations/apps/renovate >/dev/null && python3 /checks/validate-runner.py' ``` This checks missing-secret failure, the restricted suspended runner, and real SOPS/ksops rendering with an ephemeral key and synthetic Secret. No operator keyring or real credentials were used. Independent reviews approved the unchanged pre-credential source; the commit matches the reviewed file contents and modes. ## Deployment follow-ups — not activation approval - Follow `kustomizations/envs/internal/renovate/README.md` after both configs land: provision restricted bot credentials, deploy suspended, then validate hosted preset resolution, native artifacts, cluster admission/storage/egress and alert delivery. - The default/unpinned npm artifact probe has **not** passed; only the tool-pinned probe passed. Retest the actual runner after approved public GitHub metadata access is configured. - Keep recurring writes disabled: Dashboard approvals bypass native limits/scheduling, and closed-PR handling can delete branches despite pruning being disabled. The documented one-shot isolation is not a recurring-write guarantee. - Failure/staleness alerting still needs implementation/validation. Security remediation and unsupported custom Cargo-registry updates remain manual. No cluster apply, live bot write, merge or schedule activation was performed. Scope: one commit; 14 files; +845 / -0 lines.

anton added 1 commit

2026-10-23 03:39:15 +00:00