WIP: Enable Renovate vulnerability alerts

[erikgb]

I want to see how this works, and eventually consider enabling it for our release branches.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign sgtcodfish for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[octo-sts]

Reconfigure PR Results

This is an reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:

---

Detected Package Files

• .github/workflows/base-images-upgrade.yaml (github-actions)
• .github/workflows/e2e-test.yaml (github-actions)
• .github/workflows/go-auto-upgrade.yaml (github-actions)
• .github/workflows/kind-images-upgrade.yaml (github-actions)
• .github/workflows/renovate.yaml (github-actions)
• modules/go/base/.github/workflows/govulncheck.yaml (github-actions)
• modules/repository-base/base/.github/workflows/make-self-upgrade.yaml (github-actions)
• modules/repository-base/base/.github/workflows/renovate.yaml (github-actions)
• modules/olm-bundle/olm-to-oci/go.mod (gomod)
• tests/e2e-projects/test-project/go.mod (gomod)
• modules/tools/00_mod.mk (regex)
• modules/tools/00_mod.mk (regex)

Configuration Summary

Based on the default config's presets, Renovate will:

• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Pin Docker digests.
• Pin github-action digests.
• Enable Renovate configuration migration PRs when needed.
• Pin dependency versions for development dependencies.
• Append Signed-off-by: to signoff Git commits.
• Disable vulnerability alerts completely.
• Limit to maximum 10 open PRs at any time.
• Removes rate limit for PR creation per hour.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Pin Docker digests.
• Pin github-action digests.
• Enable Renovate configuration migration PRs when needed.
• Pin dependency versions for development dependencies.
• Append Signed-off-by: to signoff Git commits.
• Raise PR when vulnerability alerts are detected.
• Limit to maximum 10 open PRs at any time.
• Removes rate limit for PR creation per hour.

---

What to Expect

It looks like your repository dependencies are already up-to-date and no Pull Requests will be necessary right away.

[erikgb]

It seems like Renovate requires read access to dependabot alerts to make this work, ref. https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts. And this is currently not a permission granted to the Octo STS App, ref. https://github.com/octo-sts/app/blob/3b34e02d9873acd86406d47341635ef5b898b149/README.md#octo-sts-github-permissions.

I have now opened up a request to grant the missing permission to the Octo STS App: octo-sts/app#1039

[cert-manager-prow]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[erikgb]

Superseded by #410.