chore: configure Renovate pilot policy #501

Open

anton wants to merge 1 commit from feat/renovate-pilot into main

anton commented

2026-10-23 03:39:19 +00:00

Owner

Summary

Add only renovate.json, consuming local>public/infrastructure//renovate/default.json.
Apply platform-specific grouping/approval rules while leaving unmapped source pins and unsupported custom-registry dependencies manual.
No application/runtime changes, automerge or deployment wiring.

Merge after the infrastructure companion, which must publish the shared preset on its default branch first. This is inactive preparation; credentials and operator deployment come afterward.

Companion: public/infrastructure#13 — merge infrastructure first.

Verification

On this exact commit (01b72e6088b41e9c8ca436353a3f8a2cb586b35b) together with infrastructure b0b31a0dcad7ffd8af26f4e95fbc31508fecdf76:

image=ghcr.io/renovatebot/renovate@sha256:e2ef0f770c9c469857070753a447f445da11822e2f3601a3763b1b2d1d069b9a
docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint renovate-config-validator -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --strict --no-global renovate/default.json renovate.json /platform/renovate.json
docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint node -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --test renovate/check-policy.mjs

Strict validation passed; policy/native-handler tests: 9 passed, 0 failed, 0 skipped. Presets resolve locally in these tests; authenticated hosted fetching remains an operator validation step.

Previously passed on the byte-identical source before committing:

RUSTUP_TOOLCHAIN=1.96.1 make test
make test-cli-install test-setup test-e2e-contracts test-prepare-components

Both exited 0. Plain make test initially selected Rust 1.93.0 and failed dependency minimum-version checks; the 1.96.1 rerun passed. No live E2E/deployment was performed. The source and file mode match the independently reviewed preparation patch.

Operational boundary

The infrastructure runner remains suspended/full-dry-run-only. Its PR/runbook documents remaining credentials, hosted artifact validation, alerting, approval-budget and branch-preservation gates. Merging this config does not deploy or start that runner; unattended operation is not approved by this PR.

Scope: one commit; one file; +36 / -0 lines.

## Summary - Add only `renovate.json`, consuming `local>public/infrastructure//renovate/default.json`. - Apply platform-specific grouping/approval rules while leaving unmapped source pins and unsupported custom-registry dependencies manual. - No application/runtime changes, automerge or deployment wiring. **Merge after the infrastructure companion**, which must publish the shared preset on its default branch first. This is inactive preparation; credentials and operator deployment come afterward. Companion: https://git.caution.co/public/infrastructure/pulls/13 — merge infrastructure first. ## Verification On this exact commit (`01b72e6088b41e9c8ca436353a3f8a2cb586b35b`) together with infrastructure `b0b31a0dcad7ffd8af26f4e95fbc31508fecdf76`: ```sh image=ghcr.io/renovatebot/renovate@sha256:e2ef0f770c9c469857070753a447f445da11822e2f3601a3763b1b2d1d069b9a docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint renovate-config-validator -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --strict --no-global renovate/default.json renovate.json /platform/renovate.json docker run --rm --user "$(id -u):$(id -g)" --network none --entrypoint node -v /home/tuna/git/infrastructure-renovate-pilot:/work:ro -v /home/tuna/git/platform-renovate-pilot:/platform:ro -w /work "$image" --test renovate/check-policy.mjs ``` Strict validation passed; policy/native-handler tests: **9 passed, 0 failed, 0 skipped**. Presets resolve locally in these tests; authenticated hosted fetching remains an operator validation step. Previously passed on the byte-identical source before committing: ```sh RUSTUP_TOOLCHAIN=1.96.1 make test make test-cli-install test-setup test-e2e-contracts test-prepare-components ``` Both exited 0. Plain `make test` initially selected Rust 1.93.0 and failed dependency minimum-version checks; the 1.96.1 rerun passed. No live E2E/deployment was performed. The source and file mode match the independently reviewed preparation patch. ## Operational boundary The infrastructure runner remains suspended/full-dry-run-only. Its PR/runbook documents remaining credentials, hosted artifact validation, alerting, approval-budget and branch-preservation gates. Merging this config does not deploy or start that runner; unattended operation is not approved by this PR. Scope: one commit; one file; +36 / -0 lines.

anton added 1 commit

2026-10-23 03:39:19 +00:00