Skip to content

WIP: Enable Renovate vulnerability alerts - #407

Closed
erikgb wants to merge 1 commit into
mainfrom
renovate/reconfigure
Closed

WIP: Enable Renovate vulnerability alerts#407
erikgb wants to merge 1 commit into
mainfrom
renovate/reconfigure

Conversation

@erikgb

@erikgb erikgb commented Sep 6, 2025

Copy link
Copy Markdown
Member

I want to see how this works, and eventually consider enabling it for our release branches.

@cert-manager-prow cert-manager-prow Bot added the dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. label Sep 6, 2025
@cert-manager-prow

cert-manager-prow Bot commented Sep 6, 2025

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign sgtcodfish for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow Bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Sep 6, 2025
@erikgb
erikgb force-pushed the renovate/reconfigure branch from e2faed7 to ce43d09 Compare September 6, 2025 10:41
@cert-manager cert-manager deleted a comment from octo-sts Bot Sep 6, 2025
@erikgb
Enable Renovate vulnerability alerts
8b88f9b 
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
@erikgb
erikgb force-pushed the renovate/reconfigure branch from ce43d09 to 8b88f9b Compare September 6, 2025 10:50
@octo-sts

octo-sts Bot commented Sep 6, 2025

Copy link
Copy Markdown
Contributor

Reconfigure PR Results

This is an reconfigure PR comment to help you understand and re-configure your renovate bot settings. If this Reconfigure PR were to be merged, we'd expect to see the following outcome:

Detected Package Files

  • .github/workflows/base-images-upgrade.yaml (github-actions)
  • .github/workflows/e2e-test.yaml (github-actions)
  • .github/workflows/go-auto-upgrade.yaml (github-actions)
  • .github/workflows/kind-images-upgrade.yaml (github-actions)
  • .github/workflows/renovate.yaml (github-actions)
  • modules/go/base/.github/workflows/govulncheck.yaml (github-actions)
  • modules/repository-base/base/.github/workflows/make-self-upgrade.yaml (github-actions)
  • modules/repository-base/base/.github/workflows/renovate.yaml (github-actions)
  • modules/olm-bundle/olm-to-oci/go.mod (gomod)
  • tests/e2e-projects/test-project/go.mod (gomod)
  • modules/tools/00_mod.mk (regex)
  • modules/tools/00_mod.mk (regex)

Configuration Summary

Based on the default config's presets, Renovate will:

  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Pin Docker digests.
  • Pin github-action digests.
  • Enable Renovate configuration migration PRs when needed.
  • Pin dependency versions for development dependencies.
  • Append Signed-off-by: to signoff Git commits.
  • Disable vulnerability alerts completely.
  • Limit to maximum 10 open PRs at any time.
  • Removes rate limit for PR creation per hour.
  • Enable Renovate Dependency Dashboard creation.
  • Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
  • Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
  • Group known monorepo packages together.
  • Use curated list of recommended non-monorepo package groupings.
  • Show only the Age and Confidence Merge Confidence badges for pull requests.
  • Apply crowd-sourced package replacement rules.
  • Apply crowd-sourced workarounds for known problems with packages.
  • Pin Docker digests.
  • Pin github-action digests.
  • Enable Renovate configuration migration PRs when needed.
  • Pin dependency versions for development dependencies.
  • Append Signed-off-by: to signoff Git commits.
  • Raise PR when vulnerability alerts are detected.
  • Limit to maximum 10 open PRs at any time.
  • Removes rate limit for PR creation per hour.

What to Expect

It looks like your repository dependencies are already up-to-date and no Pull Requests will be necessary right away.

@erikgb

erikgb commented Sep 6, 2025 •
edited
Loading

Copy link
Copy Markdown
Member Author

It seems like Renovate requires read access to dependabot alerts to make this work, ref. https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts. And this is currently not a permission granted to the Octo STS App, ref. https://github.com/octo-sts/app/blob/3b34e02d9873acd86406d47341635ef5b898b149/README.md#octo-sts-github-permissions.

I have now opened up a request to grant the missing permission to the Octo STS App: octo-sts/app#1039

@erikgb erikgb changed the title Enable Renovate vulnerability alerts WIP: Enable Renovate vulnerability alerts Sep 6, 2025
@cert-manager-prow cert-manager-prow Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Sep 6, 2025
@cert-manager-prow

cert-manager-prow Bot commented Sep 6, 2025

Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@erikgb erikgb mentioned this pull request Sep 6, 2025
Closed
@erikgb

erikgb commented Sep 6, 2025

Copy link
Copy Markdown
Member Author

Superseded by #410.

@erikgb erikgb closed this Sep 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@erikgb