marcel
83ca2eb34d
Some checks failed
CI / OCR Service Tests (push) Has been cancelled
CI / Unit & Component Tests (push) Has started running
CI / Backend Unit Tests (push) Has been cancelled
CI / fail2ban Regex (push) Has been cancelled
CI / Semgrep Security Scan (push) Has been cancelled
CI / Compose Bucket Idempotency (push) Has been cancelled
## Summary Closes #818. Sets up the prevention layer so newly-published advisories are caught on a branch we own, not on a contributor's PR. **What changed:** - `renovate.json` — migrated 2 deprecated keys (`matchPackagePatterns` → `matchPackageNames`, `matchPaths` → `matchFileNames`); added `osvVulnerabilityAlerts`, `dependencyDashboard`, `vulnerabilityAlerts` (labels: security + P1-high), weekly routine `schedule`, and `lockFileMaintenance` (no automerge) - `.gitea/workflows/renovate.yml` — **new** daily cron runner (`0 3 * * *`), pinned to `renovatebot/github-action@8217b3fc` (v46.1.15) with `renovate-version: "46.1.15"`, `RENOVATE_TOKEN` secret, Gitea platform/endpoint env vars - `.gitea/workflows/nightly.yml` — added `npm-audit` job (parallel to `deploy-staging`, independent signal): shell self-test, `set +e` audit capture, jq-built deduped issue open/update, `NIGHTLY_AUDIT_TOKEN` via step env only, heartbeat on clean path - `docs/adr/041-renovate-runner-setup.md` — **new** negative-space ADR (no auto GITEA_TOKEN, two-token rationale, OSV-vs-platform, digest-pin threat model, schedule-batches-routine-only, l2-containers omission) - `docs/infrastructure/ci-gitea.md` — two-token model, PAT rotation cadence, OSV-vs-platform, nightly/PR-gate divergence table, runbook for nightly-opened issues - `docs/infrastructure/self-hosted-catalogue.md` — fixed Renovate snippet (daily cron, digest pin, `RENOVATE_TOKEN`, fixed version, no root `automerge: true`) **No `l2-containers.puml` entry** — Renovate is a scheduled CI job, not a long-lived container. Stated here as a decision, not an oversight (ADR-041). ## Manual steps required before the runner is live (not automated) 1. Create a dedicated bot account (e.g. `renovate-bot`) on the Gitea instance 2. Mint `RENOVATE_TOKEN` PAT (scopes: `contents` + `pull_request` + `issues`) → add as Gitea secret 3. Mint `NIGHTLY_AUDIT_TOKEN` PAT (scope: `issues` only) → add as Gitea secret 4. Configure `main` branch protection to forbid the bot pushing directly ## Acceptance criteria status - [x] `renovate.json` deprecated keys migrated; vuln surfacing config enabled - [x] `.gitea/workflows/renovate.yml` exists (digest-pinned, daily cron, fixed version) - [x] `self-hosted-catalogue.md` snippet corrected (4 items) - [x] `nightly.yml` npm-audit job: survives non-zero exit, deduped tracking issue, jq payload, NIGHTLY_AUDIT_TOKEN via env only, heartbeat on clean - [x] ADR-041 records all negative-space decisions - [x] `ci-gitea.md` documents two-token model + runbook - [ ] Phase 0 manual gates: bot account creation, Renovate onboarding PR evidence, Dependency Dashboard screenshot — **requires manual provisioning** - [ ] Dedupe AC verified via `workflow_dispatch` — **requires NIGHTLY_AUDIT_TOKEN secret to be provisioned first** - [ ] `$GITHUB_STEP_SUMMARY` availability on this runner — **verify in first live run** Co-authored-by: Marcel <marcel@familienarchiv> Reviewed-on: #821
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
name: Renovate
|
|
|
|
# Runs Renovate daily to surface newly-published advisories via OSV.dev
|
|
# (osvVulnerabilityAlerts) and open routine update PRs on a weekly batch
|
|
# schedule (see renovate.json §schedule). Security/vulnerability PRs are
|
|
# raised immediately regardless of the weekly schedule window.
|
|
#
|
|
# Required Gitea secrets (see docs/adr/041-renovate-runner-setup.md):
|
|
# RENOVATE_TOKEN — PAT with scopes: contents + pull_request + issues
|
|
# Belongs to a dedicated bot account. Branch protection
|
|
# on main must forbid this bot pushing directly.
|
|
#
|
|
# Platform config is injected via env vars below; the renovate.json in the
|
|
# repo root carries only dependency rules (no platform/endpoint/repos).
|
|
#
|
|
# Digest pin: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd
|
|
# corresponds to release v46.1.15. Update by bumping both the digest and the
|
|
# renovate-version when Renovate publishes a new release. Renovate itself
|
|
# will open a PR to bump this digest once it runs.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 3 * * *" # daily at 03:00 UTC — cuts OSV-alert latency to ≤1 day
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
renovate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Run Renovate
|
|
# Pinned by digest — this action holds contents+pull_request+issues
|
|
# scopes; an unpinned tag is a supply-chain risk (see ADR-041).
|
|
uses: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd # v46.1.15
|
|
with:
|
|
configurationFile: renovate.json
|
|
token: ${{ secrets.RENOVATE_TOKEN }}
|
|
renovate-version: "46.1.15"
|
|
env:
|
|
RENOVATE_PLATFORM: gitea
|
|
RENOVATE_ENDPOINT: https://git.raddatz.cloud
|
|
RENOVATE_REPOSITORIES: '["marcel/familienarchiv"]'
|
|
LOG_LEVEL: info
|