5 Commits

Author	SHA1	Message	Date
marcel	83ca2eb34d	DevOps: Renovate runner + nightly npm audit early-warning (#818) (#821) ... ## Summary Closes #818. Sets up the prevention layer so newly-published advisories are caught on a branch we own, not on a contributor's PR. **What changed:** - `renovate.json` — migrated 2 deprecated keys (`matchPackagePatterns` → `matchPackageNames`, `matchPaths` → `matchFileNames`); added `osvVulnerabilityAlerts`, `dependencyDashboard`, `vulnerabilityAlerts` (labels: security + P1-high), weekly routine `schedule`, and `lockFileMaintenance` (no automerge) - `.gitea/workflows/renovate.yml` — **new** daily cron runner (`0 3 * * *`), pinned to `renovatebot/github-action@8217b3fc` (v46.1.15) with `renovate-version: "46.1.15"`, `RENOVATE_TOKEN` secret, Gitea platform/endpoint env vars - `.gitea/workflows/nightly.yml` — added `npm-audit` job (parallel to `deploy-staging`, independent signal): shell self-test, `set +e` audit capture, jq-built deduped issue open/update, `NIGHTLY_AUDIT_TOKEN` via step env only, heartbeat on clean path - `docs/adr/041-renovate-runner-setup.md` — **new** negative-space ADR (no auto GITEA_TOKEN, two-token rationale, OSV-vs-platform, digest-pin threat model, schedule-batches-routine-only, l2-containers omission) - `docs/infrastructure/ci-gitea.md` — two-token model, PAT rotation cadence, OSV-vs-platform, nightly/PR-gate divergence table, runbook for nightly-opened issues - `docs/infrastructure/self-hosted-catalogue.md` — fixed Renovate snippet (daily cron, digest pin, `RENOVATE_TOKEN`, fixed version, no root `automerge: true`) **No `l2-containers.puml` entry** — Renovate is a scheduled CI job, not a long-lived container. Stated here as a decision, not an oversight (ADR-041). ## Manual steps required before the runner is live (not automated) 1. Create a dedicated bot account (e.g. `renovate-bot`) on the Gitea instance 2. Mint `RENOVATE_TOKEN` PAT (scopes: `contents` + `pull_request` + `issues`) → add as Gitea secret 3. Mint `NIGHTLY_AUDIT_TOKEN` PAT (scope: `issues` only) → add as Gitea secret 4. Configure `main` branch protection to forbid the bot pushing directly ## Acceptance criteria status - [x] `renovate.json` deprecated keys migrated; vuln surfacing config enabled - [x] `.gitea/workflows/renovate.yml` exists (digest-pinned, daily cron, fixed version) - [x] `self-hosted-catalogue.md` snippet corrected (4 items) - [x] `nightly.yml` npm-audit job: survives non-zero exit, deduped tracking issue, jq payload, NIGHTLY_AUDIT_TOKEN via env only, heartbeat on clean - [x] ADR-041 records all negative-space decisions - [x] `ci-gitea.md` documents two-token model + runbook - [ ] Phase 0 manual gates: bot account creation, Renovate onboarding PR evidence, Dependency Dashboard screenshot — **requires manual provisioning** - [ ] Dedupe AC verified via `workflow_dispatch` — **requires NIGHTLY_AUDIT_TOKEN secret to be provisioned first** - [ ] `$GITHUB_STEP_SUMMARY` availability on this runner — **verify in first live run** Co-authored-by: Marcel <marcel@familienarchiv> Reviewed-on: #821	2026-06-13 12:13:35 +02:00
Marcel	75293c6aa8	ci(deploy): extend Renovate privileged-digest watch to .gitea/actions ... The reload-caddy pinned alpine digest moved out of the workflow files into a composite action. Add .gitea/actions/** to the manual-review digest rule so the digest stays watched and never silently goes stale (#603). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-02 19:23:56 +02:00
Marcel	d8520d9714	devops(deps): add bucket4j-core to Renovate package rules ... bucket4j-core 8.10.1 is manually pinned in pom.xml outside the Spring BOM. Adds a packageRules entry so Renovate tracks it: patch updates auto-merge, minor/major updates open PRs for manual review. Addresses Tobias Concern 1 from PR #617 review. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 09:23:01 +02:00
Marcel	e9caa3a1f7	chore(renovate): require manual review for privileged CI image digest bumps ... Adds a packageRule matching .gitea/workflows/** digest updates with automerge: false. Digest bumps for images running --privileged --pid=host have root-equivalent host access and must not be auto-merged. Addresses Nora's review concern on #537. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-12 07:42:28 +02:00
Marcel	41a57c0dc8	feat(frontend): add Tiptap renovate group, i18n keys, fix geb. literal, remove rename-conflict ... - renovate.json: group all @tiptap/* packages so version bumps stay in sync - de/en/es.json: add transcription_editor_aria_label and person_born_name_prefix keys - PersonHoverCard: replace hardcoded "geb." with m.person_born_name_prefix() (Leonie #5602) - errors.ts: remove PERSON_RENAME_CONFLICT (backend enum value deleted) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-29 15:00:13 +02:00