Switch app-image Renovate to auto-merge, harden PR gates, auto-generate CHANGELOG#44
Merged
Merged
Conversation
wnstfy
enabled auto-merge (squash)
May 21, 2026 16:17
Contributor
Trivy misconfiguration findings (HIGH + CRITICAL)✅ No HIGH or CRITICAL misconfigurations detected. |
Contributor
CVE deltaNet change
Changed images: 14 of 30 Per-image detail
|
…generate CHANGELOG
renovate.json: application images now auto-merge for patch/minor/digest/pinDigest
(matching the existing infrastructure-image rule). Last-rule precedence keeps
`major` bumps gated and labelled `breaking`. Add `minimumReleaseAge: 3 days`
at root so upstream regressions surface before PRs land here; lower
`prConcurrentLimit` from 10 to 5 to limit flood risk.
pr-cve-gate.yml: pass `--fail-on high` to cve-delta.py so any net new CRITICAL
or HIGH CVE makes the workflow's `scan` job exit 2. Since `scan` is the
existing required-status-check on main, this immediately blocks the merge of
any PR that introduces a CVE regression. Sticky comment still posts via
`if: always() && hashFiles('delta.md') != ''`.
pr-misconfig-scan.yml: re-emit Trivy's exit code in a final step so
HIGH/CRITICAL IaC misconfigurations fail the workflow visibly. The job name
remains `misconfig` (not `scan`), so this is currently informational at the
branch-protection layer — add `misconfig` to required_status_checks.contexts
to make it enforce.
weekly-release.yml: between tag-decision and tag-push, build a CHANGELOG
entry from `gh api releases/generate-notes`, prepend it to the CHANGELOG read
from the previous tag (so entries accumulate tag-to-tag), and commit on a
detached HEAD before tagging. Only the tag is pushed — main's CHANGELOG.md
stays at its last manually-touched state, but every release tarball
(`git archive HEAD` at the tag) contains the up-to-date file. Avoids
requiring a branch-protection bypass for the bot.
wnstfy
force-pushed
the
chore/hands-off-renovate-and-harden-gates
branch
from
May 21, 2026 16:21
9ab1664 to
35dca9a
Compare
4 tasks
wnstfy
added a commit
that referenced
this pull request
May 23, 2026
PR #44 made the weekly-release workflow auto-generate the CHANGELOG.md entry into each release tag's commit, not into main. The in-tree CHANGELOG.md (what `git clone` shows) is therefore frozen at the last manually-touched state, while the Releases page and each release tarball's CHANGELOG.md carry the current state. The README sentence at line 232 pointed at the in-tree CHANGELOG.md as the canonical source, which is now misleading for anyone browsing the repo on GitHub. Updated to lead with the Releases page link, with the in-tarball CHANGELOG.md mentioned as the per-release snapshot.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
minimumReleaseAge: 3 days+ lowerprConcurrentLimitto 5.--fail-on highso net-new CRITICAL/HIGH CVEs fail the requiredscancheck → blocks merge.misconfig, not in required_status_checks).Trade-off
main'sCHANGELOG.mdwill drift from the latest release after each weekly cron. The release tarball — what consumers actually download — always has the current file. Anyone browsing the repo on GitHub sees the last manually-touched version. Optional follow-up: updateREADME.md:232to point at the Releases page as the canonical "current notes" source.Test plan
jq empty renovate.json— parsesyamllint+actionlinton all three edited workflows — cleantrivy configon current tree — exit 0 (misconfig-blocking won't auto-fail Renovate PRs)CHANGELOG.md— produces correct output (new dated entry slots between intro and existing sections)scancheck passes on this PR (no compose changes → CVE-gate early-exits)misconfigcheck passes (current tree is clean)