Repository navigation
ci: add Go-scoped Renovate configuration - #2850
Conversation
Raise the OpenSSF Scorecard Dependency-Update-Tool check (was 0/10) by adding a Renovate config. Renovate is already the cozystack org standard (active on ansible-cozystack, talm, boot-to-talos), so the app is authorized org-wide and this file is picked up without a new credential. Scoped deliberately so automated bumps only ever touch Go dependencies: - enabledManagers: [gomod] — Renovate ignores Dockerfiles, Helm charts, shipped component/operator versions, and GitHub Actions. Components and images stay hand-managed, per the 2026-05-27 decision. - gomodTidy + gomodUpdateImportPaths run after each bump; the gomod manager auto-discovers both the root module and the api/apps/v1alpha1 submodule. - controller-runtime and k8s.io/** are grouped so client-go and controller-runtime never bump out of lockstep. - The Go toolchain directive is pinned (matchDepTypes golang disabled): go.mod is generated and a toolchain bump needs a matching setup-go and a codegen run, out of scope for an automated PR. - automerge/platformAutomerge are off and every Renovate PR is labeled do-not-merge/hold + automated, so bumps are held until tests pass and a maintainer reviews them by hand. Validated with renovate-config-validator (config validated successfully). Signed-off-by: Myasnikov Daniil <[email protected]> Assisted-By: Claude <[email protected]>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a scoped Renovate configuration to automate Go dependency updates while maintaining strict control over the process. By targeting only Go modules and enforcing manual review through labels and disabled auto-merge, the changes improve the project's OpenSSF Scorecard rating without introducing risk to the existing build and deployment workflows. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
github-actions
Bot
added
size/S
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRenovate automation configuration added to the repository. The configuration restricts Renovate to Go module updates only, enforces post-update tidying and import-path normalization, applies hold and automation labels, disables automerge, caps concurrent update PRs at 5, groups Kubernetes-related dependencies together, and prevents automatic Go toolchain directive version bumps. ChangesDependency Automation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a Renovate configuration file (.github/renovate.json) to automate Go module dependency updates. The reviewer identified that because k8s.io/apimachinery is replaced by a custom fork in go.mod, automated updates to other Kubernetes libraries and controller-runtime will break compilation. To prevent broken pull requests, the reviewer suggested disabling automated updates for these packages entirely.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| { | ||
| "description": "Keep controller-runtime and the Kubernetes libraries in lockstep. A split bump breaks compilation because a given controller-runtime release expects a matching client-go / apimachinery line.", | ||
| "groupName": "kubernetes", | ||
| "matchManagers": ["gomod"], | ||
| "matchPackageNames": ["sigs.k8s.io/controller-runtime", "k8s.io/**"] | ||
| }, |
There was a problem hiding this comment.
Since k8s.io/apimachinery is replaced by a custom fork (github.com/cozystack/apimachinery) in go.mod, any automated update to other k8s.io/* packages (like k8s.io/client-go or k8s.io/api) or sigs.k8s.io/controller-runtime will lead to compilation failures. This is because all Kubernetes libraries must be kept in strict lockstep, and the custom fork cannot be automatically updated by Renovate. It is highly recommended to disable automated updates for these packages entirely to avoid broken PRs.
| { | |
| "description": "Keep controller-runtime and the Kubernetes libraries in lockstep. A split bump breaks compilation because a given controller-runtime release expects a matching client-go / apimachinery line.", | |
| "groupName": "kubernetes", | |
| "matchManagers": ["gomod"], | |
| "matchPackageNames": ["sigs.k8s.io/controller-runtime", "k8s.io/**"] | |
| }, | |
| { | |
| "description": "Disable updates for Kubernetes libraries and controller-runtime because k8s.io/apimachinery is replaced by a custom fork and updating other k8s.io packages out of lockstep will break compilation.", | |
| "matchManagers": ["gomod"], | |
| "matchPackageNames": ["sigs.k8s.io/controller-runtime", "k8s.io/**"], | |
| "enabled": false | |
| }, |
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
LGTM — adds a valid, gomod-scoped Renovate config that turns the Scorecard Dependency-Update-Tool check green on merge; automerge is off and every bot PR is held, so nothing can land unreviewed.
Business context: raise the OpenSSF Scorecard Dependency-Update-Tool check (was 0/10) by shipping a recognized dependency-update config, scoped to Go modules per the team decision.
Verified: the config is valid JSON against the Renovate schema; enabledManagers: ["gomod"] limits Renovate to Go modules; automerge/platformAutomerge are both off and every PR is labeled do-not-merge/hold + automated, and stale.yaml already exempts do-not-merge/hold, so held bumps are parked rather than auto-merged or auto-closed.
Non-blocking follow-ups
- The
kubernetesgroup (k8s.io/**+sigs.k8s.io/controller-runtime) will still produce non-compiling bump PRs:k8s.io/apimachineryis areplaceonto thegithub.com/cozystack/apimachineryfork pinned at a pseudo-version that capsk8s.io/apiat the v0.34.x line, and Renovate cannot move the fork in lockstep with the non-replacedk8s.io/*packages. The group keeps the non-replaced libraries in step with each other but not with the forked apimachinery, so eachk8s.io/apiminor bump yields a PR that fails to build. The held-PR design makes these noise rather than breakage, but disabling updates for these packages (or capping them to the fork's supported line) until the fork moves to release-1.35 would avoid the churn.
2 participants
What this PR does
Raises the OpenSSF Scorecard Dependency-Update-Tool check (was 0/10) by adding a Renovate configuration at
.github/renovate.json. Scorecard scores this check on the presence of a recognized config file, so the check turns green as soon as this merges.Why Renovate (not Dependabot)
Renovate is already the cozystack org standard — it actively raises and merges PRs on
cozystack/ansible-cozystack, andcozystack/talm+cozystack/boot-to-talosalready shiprenovate.json. The Renovate GitHub App is authorized on the org, so this config is picked up without creating a new credential. There is no Dependabot usage anywhere in the org.Scoped to Go dependencies only (per the 2026-05-27 decision)
enabledManagers: ["gomod"]— Renovate only ever touches Go modules. It will not open PRs for Dockerfiles, Helm charts, shipped component/operator versions, or GitHub Actions. Components and images stay hand-managed.gomodTidy+gomodUpdateImportPathsrun after each bump. Thegomodmanager auto-discovers both the root module and theapi/apps/v1alpha1submodule.sigs.k8s.io/controller-runtime+k8s.io/**) soclient-go/apimachinerynever bump out of lockstep with controller-runtime (a split bump fails to compile).matchDepTypes: ["golang"]disabled) —go.modis generated and a toolchain bump needs a matchingsetup-go+ codegen run, out of scope for an automated PR."do not merge" on every bot PR (requirement)
automergeandplatformAutomergeare off.do-not-merge/hold+automatedon creation. Both labels already exist in.github/labels.yml;stale.yamlalready exemptsdo-not-merge/holdPRs from auto-close, so held bumps won't rot.Verification
renovate-config-validator(Renovate v42): Config validated successfully.Release note
Summary by CodeRabbit