NO-JIRA: Add renovate config validation workflow and make target#2385
NO-JIRA: Add renovate config validation workflow and make target#2385jeff-roche wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@jeff-roche: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThis PR introduces renovate.json validation infrastructure and updates the renovate configuration. A GitHub Actions workflow and make target are added to validate the renovate config via Konflux CI's validator. The renovate.json file is updated with two additional Mintmaker presets, reformatted for compactness, and the ChangesRenovate config validation and updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
size/M
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jeff-roche The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
release/konflux.make (1)
51-51: ⚡ Quick winPin image tag to immutable digest for reproducible validation.
Line 51 uses
:latest, which can cause validation behavior to drift over time. Replace with a pinned digest via a variable for deterministic, reproducible builds.Suggested fix
+MINTMAKER_RENOVATE_IMAGE ?= quay.io/konflux-ci/mintmaker-renovate-image@sha256:01cfae2158374cab0349842b035f4afe1f4037118e4c98a9c574cc96af2643d2 + .PHONY: validate-renovate-config validate-renovate-config: $(IMAGE_BUILD_CMD) run --rm \ -v $(shell pwd)/renovate.json:/workspace/renovate.json:ro,Z \ - quay.io/konflux-ci/mintmaker-renovate-image:latest \ + $(MINTMAKER_RENOVATE_IMAGE) \ renovate-config-validator /workspace/renovate.json🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@release/konflux.make` at line 51, Replace the floating tag "quay.io/konflux-ci/mintmaker-renovate-image:latest" with an immutable digest variable to ensure reproducible validation; update the reference in the release/konflux.make target that uses "quay.io/konflux-ci/mintmaker-renovate-image:latest" to use a pinned variable (e.g., MINTMAKER_RENOVATE_IMAGE) that contains the full image@sha256:... digest and read that variable where the image is consumed so builds always use the exact digest rather than :latest.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/renovate-config-validation.yaml:
- Line 24: The workflow's config_file setting currently points to
test/renovate.json which doesn't match the workflow trigger on the root
renovate.json; update the config_file value under the Renovate validation step
(the config_file key) to the intended path (e.g., renovate.json) or make it
parameterized so the workflow validates the same file the trigger watches.
- Around line 21-22: Replace floating refs for the GitHub Actions with pinned
commit SHAs: change uses: actions/checkout@v4 to uses:
actions/checkout@<commit-sha> and uses:
konflux-ci/renovate-config-validator-action@main to uses:
konflux-ci/renovate-config-validator-action@<commit-sha>, and harden the
checkout step by adding the persist-credentials: false option to the
actions/checkout invocation; update the workflow occurrences referencing
actions/checkout and konflux-ci/renovate-config-validator-action accordingly.
---
Nitpick comments:
In `@release/konflux.make`:
- Line 51: Replace the floating tag
"quay.io/konflux-ci/mintmaker-renovate-image:latest" with an immutable digest
variable to ensure reproducible validation; update the reference in the
release/konflux.make target that uses
"quay.io/konflux-ci/mintmaker-renovate-image:latest" to use a pinned variable
(e.g., MINTMAKER_RENOVATE_IMAGE) that contains the full image@sha256:... digest
and read that variable where the image is consumed so builds always use the
exact digest rather than :latest.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 3fe55358-5e5f-4298-9827-0df4178450a7
📒 Files selected for processing (3)
.github/workflows/renovate-config-validation.yamlrelease/konflux.makerenovate.json
jeff-roche
force-pushed
the
chore/renovate-config-updates
branch
from
9e5665b to
09559ef
Compare
…arget Add a GitHub Actions workflow to validate renovate.json on PRs and pushes to main. Add a make target in release/konflux.make to run the same validation locally using the mintmaker-renovate-image container. Update renovate.json to extend mintmaker-presets for rpm-lockfile refresh and disable-minor-updates. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jeff-roche
force-pushed
the
chore/renovate-config-updates
branch
from
09559ef to
a7f5185
Compare
|
/override ci/prow/unit-test |
|
@jeff-roche: Overrode contexts on behalf of jeff-roche: ci/prow/unit-test DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@jeff-roche: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| persistant-credentials: false |
There was a problem hiding this comment.
Should this be persist-credentials? https://github.com/actions/checkout/blob/v4/action.yml#L52
3 participants
Summary
renovate.jsonon PRs and pushes to mainvalidate-renovate-configmake target inrelease/konflux.makefor local validation using thequay.io/konflux-ci/mintmaker-renovate-imagecontainerrenovate.jsonto extendmintmaker-presetsfor rpm-lockfile refresh and disable-minor-updatesImportant Note
I don't actually know if this will work as intended. The addition to the extends should trigger the PR to do container and RPMs together but I don't know if our other configs override that functionality. I will monitor after merge and open follow up PRs if it overlaps. There is no way to test this prior to merge unfortunately.
🤖 Generated with Claude Code
Summary by CodeRabbit