diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f1ffea..b77c251 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -89,6 +89,7 @@ repository still gets a decision, never by following the link; no release carrie - build(deps): bump actions/attest from 4.2.1 to 4.2.2 - build(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0 - build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3 +- :fire: chore(deps): drop dormant Renovate; Dependabot is the updater ### Documentation - :memo: docs(decisions): record D-126 (D-031 domain deferred) and D-127 (SEC-05 PAT rotation scheduled) diff --git a/GUIDELINES.md b/GUIDELINES.md index 5f07515..c22c0a1 100644 --- a/GUIDELINES.md +++ b/GUIDELINES.md @@ -46,7 +46,7 @@ holds the *how*. Conflicts: ADRs win; update this file via PR when they do. - Prefer stdlib; new deps need: active maintenance (commits within 6 months), >1 effective maintainer, compatible license (Apache-2.0/MIT/BSD), and no heavyweight transitive tail into the single static binary (ADR-0001, ADR-0013's dependency-health bar). -- SHA-pin CI actions; renovate/dependabot keep them current. +- SHA-pin CI actions; Dependabot keeps them current. ## Repository discipline diff --git a/Taskfile.yml b/Taskfile.yml index 6a1d64b..29a20f6 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -116,6 +116,14 @@ tasks: # .github/workflows/**, so without this line an unpinned workflow is caught # only by CI — and only for as long as the CI step itself survives. - task: lint-workflow-pins-test + # Operator 2026-08-13: Dependabot is the updater; a reintroduced + # renovate.json would otherwise merge green. + - task: ci-audit-test + + ci-audit-test: + desc: "E9-S04 + Dependabot-only: single CodeQL workflow; no Renovate config" + cmds: + - bash hack/release/ci_audit_test.sh lint-workflow-pins-test: desc: "AUD-S09/S14 gate: workflow supply-chain pins are present and the checks can fail (REQ-AUD-S09-01, REQ-AUD-S14-01/02)" diff --git a/docs/planning/ci-hardening-status.md b/docs/planning/ci-hardening-status.md index da96f18..b0db7de 100644 --- a/docs/planning/ci-hardening-status.md +++ b/docs/planning/ci-hardening-status.md @@ -13,7 +13,7 @@ Last reviewed: 2026-08-04 (E9-S04). | **govulncheck** (weekly) | ✅ Exists | `.github/workflows/vulncheck.yaml` | Schedule-only sweep; complements push gate. | | **gitleaks** | ✅ Exists | `.github/workflows/verify.yaml` (`gitleaks` step) | HEAD-scoped history scan; CLI (no paid org action). | | **SHA-pinned Actions** | ✅ Exists | All `.github/workflows/*.yaml` | Full commit SHAs + version comments (D-045). | -| **Dependabot** | ✅ Exists | `.github/dependabot.yml` | `gomod`, `github-actions`, `pip` (docs) weekly. | +| **Dependabot** | ✅ Exists | `.github/dependabot.yml` | `gomod`, `github-actions`, `pip` (docs), `npm` (hack/schemas-validator) weekly. **Chosen updater** (operator 2026-08-13); Renovate is not used. | | **actionlint** | ✅ Exists | `.github/workflows/actionlint.yaml` | Lint workflow YAML on workflow changes (E9-S04 residual). | ## Residual gaps (operator / later lanes) @@ -22,13 +22,13 @@ Last reviewed: 2026-08-04 (E9-S04). | --- | --- | --- | | Branch protection + required status checks on `main` | Gap | Operator (D-045 residual) | | codecov / coverage badge | Gap | Deferred (not in D-045 scope) | -| renovate (vs Dependabot-only) | Gap | Optional; Dependabot covers actions + modules | ## Explicit non-actions (D-102) - Do **not** add a second CodeQL workflow or matrix. - Do **not** duplicate govulncheck on every push (weekly job in `vulncheck.yaml` is sufficient). - Do **not** add a second Scorecard job. +- Do **not** add Renovate (Dependabot is the chosen updater). Verify locally: diff --git a/docs/planning/oss-playbook.md b/docs/planning/oss-playbook.md index 4c2ca92..891da65 100644 --- a/docs/planning/oss-playbook.md +++ b/docs/planning/oss-playbook.md @@ -12,7 +12,7 @@ surface). Ordered backlog for assent; "when" anchors each item to the meta-plan. | 2 | Community files: CODE_OF_CONDUCT (Contributor Covenant 2.1), CONTRIBUTING with a **standards map** (each doc owns exactly one concern), GOVERNANCE with maintainer-continuity note | CoC + templates now; CONTRIBUTING with GUIDELINES.md; GOVERNANCE before going public | 🔶 | | 3 | README formula: logo → ≤6 badges → one-line value prop + tagline → status callout → why-bullets with ADR links → mermaid hero diagram → quick start → **honest maturity table** (frontends / forges / providers as Core·Beta·Planned) → community/security tables | with first public push (E9) | ⏳ | | 4 | Release engineering: tag-triggered workflow, git-cliff notes, cosign keyless signing, SLSA provenance + SBOM attestation — **plus goreleaser for CLI binaries** (`go install`, brew, curl+checksum): the one piece the siblings lack and a CLI must have | E9 | ⏳ | -| 5 | CI hardening: gitleaks, CodeQL, OpenSSF Scorecard (+badge), govulncheck, SHA-pinned actions, dependabot+renovate, codecov | E9, incrementally from first code | ⏳ | +| 5 | CI hardening: gitleaks, CodeQL, OpenSSF Scorecard (+badge), govulncheck, SHA-pinned actions, dependabot, codecov | E9, incrementally from first code | ⏳ | | 6 | Branding pack via reproducible source assets and generator script (logos, social cards, favicons) | before going public | ✅ | | 7 | mkdocs-material site + GH Pages docs workflow | E9 | ✅ | | 8 | Compatibility-promise doc (`API_STABILITY.md` equivalent): what policy schema / decision contract / test-format guarantee per version, graduation criteria — **high trust signal for a gate tool** | Phase 3 (contracts freeze) | ⏳ | diff --git a/hack/release/README.md b/hack/release/README.md index 23bad43..0e2b126 100644 --- a/hack/release/README.md +++ b/hack/release/README.md @@ -171,7 +171,7 @@ explicit `permissions:` block sets every unlisted scope to `none`, so this is no | --- | --- | | `task release-snapshot` | Local goreleaser snapshot under `dist/` | | `hack/release/snapshot_test.sh` | REQ-E9-S02 gate: archives, checksums, stamped version | -| `hack/release/ci_audit_test.sh` | REQ-E9-S04 gate: no duplicate CodeQL workflow | +| `hack/release/ci_audit_test.sh` | REQ-E9-S04 gate: no duplicate CodeQL workflow; Dependabot-only (no Renovate config) | ## Install script (E9-S07a) diff --git a/hack/release/ci_audit_test.sh b/hack/release/ci_audit_test.sh index c46586c..cc4d49f 100755 --- a/hack/release/ci_audit_test.sh +++ b/hack/release/ci_audit_test.sh @@ -16,4 +16,18 @@ if ! grep -q codeql.yaml docs/planning/ci-hardening-status.md; then exit 1 fi -echo "OK: CI audit — single CodeQL workflow; hardening inventory present" +# Operator 2026-08-13: Dependabot is the live updater; Renovate config is dormant +# and must not return. Negative files are listed explicitly so a renamed +# renovate.json5 / .github/renovate.json cannot hide. +if [[ ! -f .github/dependabot.yml ]]; then + echo "FAIL: .github/dependabot.yml must exist (Dependabot is the version updater)" >&2 + exit 1 +fi +for stale in renovate.json renovate.json5 .github/renovate.json .renovaterc .renovaterc.json; do + if [[ -e "$stale" ]]; then + echo "FAIL: $stale must not exist — Dependabot is the updater; Renovate is not" >&2 + exit 1 + fi +done + +echo "OK: CI audit — single CodeQL workflow; hardening inventory present; Dependabot-only" diff --git a/openspec/specs/p5-e11-rego-backend/spec.md b/openspec/specs/p5-e11-rego-backend/spec.md index 909484d..febc74a 100644 --- a/openspec/specs/p5-e11-rego-backend/spec.md +++ b/openspec/specs/p5-e11-rego-backend/spec.md @@ -197,7 +197,7 @@ made silently by a story. *Supply chain, separately:* OPA is a large dependency with a large transitive tree on a project shipping cosign signing, SLSA-grade provenance, `govulncheck`, and Scorecard. It -materially changes binary size, vulnerability surface, and `renovate` load. S03 pins it and +materially changes binary size, vulnerability surface, and Dependabot load. S03 pins it and records the size delta. *Status (2026-08-10) — the two halves have diverged and must not be conflated:* @@ -377,7 +377,7 @@ human dependency. - Verify: `go test ./internal/core/... -run TestRegoCompileErrorIsHardError` - Level: L1 - **REQ-E11-S03-03** — Given judgment call (d), when OPA is added to `go.mod`, then the - version is pinned, `govulncheck` and `renovate` cover it, and the binary-size delta is + version is pinned, `govulncheck` and Dependabot cover it, and the binary-size delta is recorded in the story's notes. **This REQ may not be started before (d) is answered** — it is the adoption itself, not a consequence of it. - Test: `go.mod`, `go.sum` diff --git a/renovate.json b/renovate.json deleted file mode 100644 index 5c6984b..0000000 --- a/renovate.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:recommended"], - "labels": ["dependencies"], - "postUpdateOptions": ["gomodTidy"] -}