ci(renovate): bump indirect Go deps and enable OSV vuln alerts by myasnikovdaniil · Pull Request #3026 · cozystack/cozystack

myasnikovdaniil · 2026-06-24T07:30:21Z

What

Makes Renovate open the dependency PRs that close the OpenSSF Scorecard Vulnerabilities advisories, instead of doing them by hand (as in #3019).

Enable indirect gomod updates (grouped into one rolling "indirect go modules" PR). Renovate skips indirect Go deps by default, which is why golang.org/x/crypto, x/net, and x/sys — the transitive deps carrying the 20 OSV advisories — never got a PR.
Enable osvVulnerabilityAlerts so vulnerable deps get dedicated, mergeable security PRs (labeled security, not the global do-not-merge/hold).

Why #3019 wasn't enough

#3019 bumped x/crypto in the root module only. The repo has 5 go.mod modules; the same advisories live in token-proxy (x/crypto v0.50.0), kubevirt-csi-driver, and kubeovn-webhook (x/net / x/sys). The Scorecard Vulnerabilities check scans repo-wide and is all-or-nothing, so the count never dropped (still 0/10, 21 advisories).

Known gap

This does not fix GO-2025-3512 (kubevirt.io/csi-driver): no fixed version exists upstream and Renovate can't even resolve the module (no-result in the Dependency Dashboard #2996). Until that one advisory is suppressed via .osv-scanner.toml or patched upstream, the Vulnerabilities check stays at 0/10. Tracked separately as a follow-up.

Validation

renovate-config-validator: Config validated successfully.

Summary by CodeRabbit

New Features
- Added support for automated handling of vulnerability alerts.
- Enabled updates for indirect Go module dependencies and grouped them together for easier review.
Chores
- Updated automation settings to label security-related update pull requests appropriately.

gemini-code-assist · 2026-06-24T07:30:34Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the project's dependency management and security automation by refining the Renovate configuration. The changes allow the system to automatically address security advisories found in transitive dependencies, which were previously ignored, thereby improving the repository's OpenSSF Scorecard vulnerability score.

Highlights

OSV Vulnerability Alerts: Enabled osvVulnerabilityAlerts to ensure that vulnerable dependencies trigger dedicated, mergeable security pull requests labeled with 'security'.
Indirect Go Module Updates: Updated the Renovate configuration to include indirect Go module dependencies, which were previously skipped by default, and grouped them into a single rolling pull request.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-06-24T07:30:47Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9f3744cc-176c-45e1-a333-b7b52b6535ce

📥 Commits

Reviewing files that changed from the base of the PR and between e338de6 and 3bad10a.

📒 Files selected for processing (1)

.github/renovate.json

🚧 Files skipped from review as they are similar to previous changes (1)

.github/renovate.json

📝 Walkthrough

Walkthrough

The Renovate configuration adds OSV vulnerability alert handling with labels and a package rule that enables and groups indirect Go module updates.

Changes

Renovate Configuration

Layer / File(s)	Summary
OSV vulnerability alerts `.github/renovate.json`	Enables `osvVulnerabilityAlerts` and configures `vulnerabilityAlerts` with `enabled: true` plus `automated` and `security` labels.
Indirect Go module package rule `.github/renovate.json`	Adds a `packageRules` entry for `gomod` indirect dependencies, enables them, and groups the PRs as `indirect go modules`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

cozystack/cozystack#2850: Also updates .github/renovate.json with Go module dependency update behavior and Renovate rule changes.

Suggested reviewers

kvaps
androndo
lllamnyp

Poem

🐇 A Renovate hop, light and neat,
OSV alerts and labels now meet.
Indirect Go modules in a tidy pen,
Updated burrow, again and again.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main Renovate config changes: indirect Go dependency bumps and OSV vulnerability alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/renovate-indirect-go-deps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request updates the Renovate configuration in .github/renovate.json to enable OSV vulnerability alerts and group indirect Go module updates into a single rolling PR to address transitive dependency vulnerabilities. The review feedback points out that the PR does not comply with the repository's contribution guidelines, specifically noting a missing release note block in the PR description, an invalid commit scope (renovate), and a missing commit sign-off.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-06-24T07:31:26Z

  "automerge": false,
  "platformAutomerge": false,
  "prConcurrentLimit": 5,
+  "osvVulnerabilityAlerts": true,


The pull request does not meet the repository's commit and PR requirements:

Missing Release Note: The PR body is missing the required release-note block. Please add a release note block to the PR description following this format:

```release-note type(scope): human-readable changelog entry

Invalid Commit Scope: The commit scope renovate in ci(renovate): bump indirect Go deps and enable OSV vuln alerts is not a valid scope. According to the repository style guide, valid scopes are:

System: dashboard, platform, cilium, kube-ovn, linstor, fluxcd, cluster-api

Apps: postgres, mariadb, redis, kafka, clickhouse, kubernetes, virtual-machine

Meta: api, hack, tests, ci, docs

Package-specific: any <package-name> matching a directory under packages/

Please update the commit message to use a valid scope (e.g., ci(ci) or ci if appropriate) and ensure the commit is signed off (git commit --signoff).

References

PR body must contain a release note block and commits must follow Conventional Commits format with valid scopes and signoff. ^(link)

IvanHunters · 2026-06-24T09:58:17Z

Verdict

LGTM with non-blocking notes

Config validates strictly (renovate-config-validator --strict against Renovate 37.440.7), JSON is well-formed, the two new packageRules target real gomod depTypes (indirect is distinct from golang, no conflict with the existing toolchain-disable rule), the labels referenced (automated, security, do-not-merge/hold) all exist in .github/labels.yml, and vulnerabilityAlerts.labels correctly omits do-not-merge/hold so security PRs remain mergeable. All five go.mod modules (root + api/apps/v1alpha1 + token-proxy + kubevirt-csi-driver + kubeovn-webhook) are picked up by the unrestricted gomod manager. No dependabot.yml exists, so no duplicate-PR conflict. Two downstream-impact heads-ups below are worth folding into the PR description before merge.

Risks to downstream consumers

These are not blockers but should be acknowledged in the Known gap section, since the Scorecard Vulnerabilities claim implicitly promises closure:

Forked apimachinery stays outside Renovate's reach. go.mod carries replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c. Renovate's gomod manager does not bump replace targets without an explicit matchPackageNames rule, and this PR adds none. If a future CVE lands in apimachinery, Renovate will open a PR for the upstream coordinate while the actual compiled artifact keeps using the forked pinned commit — the advisory closes on paper but not in the binary. Worth either a matchPackageNames: ["github.com/cozystack/apimachinery"] packageRule, or an explicit note in Known gap alongside GO-2025-3512.
gomodUpdateImportPaths now applies across ~190 indirect deps. With matchDepTypes: ["indirect"] enabled, the existing postUpdateOptions: ["gomodUpdateImportPaths"] will now run on every grouped indirect bump. On a major-version transitive bump (e.g. some indirect dep going vX/ to v(X+1)/), Renovate will rewrite import statements in repo source as part of an automated-labeled PR that looks like "just go.sum churn" by line count. Reviewers should be told to diff source files in indirect-bump PRs, not just dependency files.

Findings

[NIT] PR body — empty release-note fenced block

.github/PULL_REQUEST_TEMPLATE.md carries a ```release-note ... ``` fenced block as a placeholder. The PR body has detailed "What" / "Why" / "Known gap" sections but omits the fenced block entirely. No workflow currently parses this block (verified by grep -r release-note .github/ — only the template itself references it), so this is pure template hygiene; ignore if the project doesn't enforce it for CI-only changes.

Red-team concerns

[INFO] First-activation burst: with 21 currently-open OSV advisories and osvVulnerabilityAlerts: true newly enabled, Renovate will queue dedicated security PRs for each fixable advisory on the next run. prConcurrentLimit: 5 paces them, but expect a multi-day backlog of security-labeled PRs and one large grouped "indirect go modules" PR appearing simultaneously. This is the stated intent of the PR — just confirm reviewer bandwidth on the self-hosted runners is lined up for the wave.

[INFO] Grouped indirect bump rebase churn on self-hosted CI: the indirect go modules group PR will touch go.sum across all five modules and postUpdateOptions: ["gomodTidy", "gomodUpdateImportPaths"] runs on each rebase. With prConcurrentLimit: 5 and runs-on: [self-hosted] everywhere, a frequently-rebasing group PR can starve security PRs of CI slots. Watch the first few cycles; if starvation appears, consider groupSlug per-module or splitting by matchFileNames.

[INFO] kubevirt-csi-driver carries 26 replace directives pinning k8s.io/* to v0.36.0. Renovate will open indirect-bump PRs that the replace block silently overrides — visually they look like a change but resolve to no-op after go mod tidy. Cosmetic noise, not a correctness issue.

[INFO] Backports to release-X.Y branches are not automated. auto-release.yaml supports the last 2 minor lines (SUPPORTED_LINE_COUNT = 2); Renovate pushes only to main. Security fixes will reach customers only after the next minor cuts. Customers on N-2 lines get nothing from this PR.

Caveats

renovate-config-validator --strict passes locally against Renovate 37.440.7. This matches the PR claim "Config validated successfully".
osvVulnerabilityAlerts does not strictly require vulnerabilityAlerts.enabled: true, but enabling both — as this PR does — is the documented pattern for OSV-sourced advisories with a custom label set, so the combination is correct.

Recommended follow-ups

Extend Known gap with the github.com/cozystack/apimachinery fork — either Renovate rule it in, or document that it stays out-of-band.
Suppress GO-2025-3512 in .osv-scanner.toml so the Scorecard Vulnerabilities check can actually go green after the security PRs land.
Optional: add groupSlug per go.mod directory if the indirect-group PR becomes too large to review.

Aleksei Sviridkin (lexfrei)

LGTM — APPROVE. The config is valid and meets its stated goal; the notes below are non-blocking.

Business context

Renovate skips indirect Go deps by default, so the transitive golang.org/x/{crypto,net,sys} advisories driving the OpenSSF Scorecard Vulnerabilities check never got a PR; this enables indirect gomod bumps plus OSV-backed security PRs to close them.

Blockers

None. JSON parses and the schema validates (osvVulnerabilityAlerts, vulnerabilityAlerts, and matchDepTypes: ["indirect"] are all valid Renovate options; the ["indirect"] and ["golang"] depTypes are disjoint, so the new rule does not conflict with the existing toolchain-disable rule).

Non-blocking notes

Indirect k8s.io/** deps leave the kubernetes lockstep group. The kubernetes rule matches k8s.io/** by package name with no depType filter, so it also selects indirect k8s modules; the new indirect rule comes later in packageRules and sets groupName: "indirect go modules", and Renovate applies last-match-wins, so indirect k8s deps land in the indirect group instead of the kubernetes group. Impact is low: the lockstep concern is the direct API surface (controller-runtime, client-go, apimachinery, ...), which stays direct and grouped, and indirect deps are reconciled by gomodTidy via MVS. If strict lockstep across indirect k8s modules is wanted, exclude k8s.io/** / sigs.k8s.io/** from the indirect rule or place it before the kubernetes rule.
Evidence: .github/renovate.json:23 (kubernetes rule, matchPackageNames: ["sigs.k8s.io/controller-runtime", "k8s.io/**"], no matchDepTypes) vs .github/renovate.json:34,36 (indirect rule, later, sets groupName); existing indirect target at go.mod:127 (k8s.io/kms v0.34.1 // indirect).
Security PRs intentionally drop the do-not-merge/hold label. vulnerabilityAlerts.labels replaces (not adds to) the global labels, so vulnerability PRs carry only ["automated", "security"] and lose the global do-not-merge/hold gate. This matches the stated intent of mergeable security PRs, so it is a deliberate tradeoff rather than a defect; they still need a manual merge since automerge: false and platformAutomerge: false are unchanged. If the hold gate should also apply to security PRs, use addLabels for security instead of overriding labels.
Evidence: .github/renovate.json:9 (global labels: ["automated", "do-not-merge/hold"]) vs .github/renovate.json:16 (vulnerabilityAlerts.labels: ["automated", "security"]).

Renovate skips indirect gomod deps by default, so transitive modules (golang.org/x/crypto, x/net, x/sys) that carry OSV advisories never get a PR — leaving the OpenSSF Scorecard Vulnerabilities check pinned at 0 even after #3019 bumped x/crypto in the root module only. - enable indirect gomod updates, grouped into one rolling PR - turn on osvVulnerabilityAlerts so vulnerable deps get dedicated, mergeable security PRs (labeled `security`, not `do-not-merge/hold`) Does not address GO-2025-3512 (kubevirt.io/csi-driver): no fixed version exists upstream and Renovate cannot resolve the module, so the Vulnerabilities check stays at 0 until that advisory is suppressed or patched separately. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>

myasnikovdaniil · 2026-06-25T10:57:21Z

Thanks Aleksei Sviridkin (@lexfrei) and IvanHunters for the thorough reviews. Pushed a follow-up (rebased, e338de675 → 3bad10ada):

Changed

Reordered the indirect rule before the kubernetes rule (lexfrei's note Remove would violate PodSecurity "restricted:latest" warnings #1). An indirect k8s.io/** dep matches both rules; with last-match-wins, putting kubernetes last keeps those deps in the lockstep group instead of the "indirect go modules" group. The reasoning is now documented inline in the rule's description.
Rebased onto main to resolve the conflict with the Dockerfile/GitHub-Actions digest-pinning packageRules that merged in the meantime. renovate-config-validator: Config validated successfully.

Intentionally left as-is

do-not-merge/hold dropped on security PRs (lexfrei Automatically remove flannel and kube-proxy #2) — deliberate; the whole point is that OSV security PRs stay mergeable. automerge/platformAutomerge are still false, so they remain a manual merge.
Forked apimachinery (IvanHunters): Renovate can't meaningfully track a self-owned fork pinned to a pseudo-version commit (replace … => github.com/cozystack/apimachinery), so a matchPackageNames rule wouldn't help — it stays an out-of-band update. Noting it here as a known gap.
GO-2025-3512 is tracked separately in Scorecard: resolve GO-2025-3512 (kubevirt.io/csi-driver) — not fixable by Renovate #3027.
The grouped-indirect-bump import-path-rewrite heads-up is noted for reviewers of those future PRs.

Aleksei Sviridkin (lexfrei)

LGTM — re-review on the current head; config validates strictly (renovate-config-validator --strict).

Business context: Renovate skips indirect Go deps by default, so the transitive golang.org/x/{crypto,net,sys} advisories driving the OpenSSF Scorecard Vulnerabilities check never got a PR; this enables indirect gomod bumps plus OSV-backed security PRs to close them.

Scoped exactly as described: against main the PR adds osvVulnerabilityAlerts, the vulnerabilityAlerts block, and the indirect go modules rule. (The dockerfile/github-actions managers and pinDigests already live on main — they show up in a branch-to-branch diff but are not part of this PR.)

Resolved since the earlier (now-dismissed) review: the indirect rule is placed before the kubernetes rule, so an indirect k8s.io/** dep stays in the kubernetes lockstep group via Renovate's last-match-wins — the rule order and the in-file comment both confirm it.

Non-blocking (carried over)

vulnerabilityAlerts.labels replaces (not adds to) the global labels, so security PRs carry ["automated","security"] and drop the global do-not-merge/hold gate. This is deliberate (mergeable security PRs) and they still require a manual merge (automerge/platformAutomerge remain false), so it's acceptable — flagging only in case the hold gate should also cover security PRs (use addLabels instead of labels). No blockers.

myasnikovdaniil requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp) and Kirill Ilin (sircthulhu) as code owners June 24, 2026 07:30

dosubot Bot added area/ci Issues or PRs related to CI workflows, GitHub Actions, automation security Security-related issues and features labels Jun 24, 2026

github-actions Bot added the area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review label Jun 24, 2026

myasnikovdaniil mentioned this pull request Jun 24, 2026

Scorecard: resolve GO-2025-3512 (kubevirt.io/csi-driver) — not fixable by Renovate #3027

Closed

gemini-code-assist Bot reviewed Jun 24, 2026

View reviewed changes

github-actions Bot added the size/S This PR changes 10-29 lines, ignoring generated files label Jun 24, 2026

IvanHunters previously approved these changes Jun 24, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) previously approved these changes Jun 24, 2026

View reviewed changes

myasnikovdaniil dismissed stale reviews from Aleksei Sviridkin (lexfrei) and IvanHunters via 3bad10a June 25, 2026 10:46

myasnikovdaniil force-pushed the fix/renovate-indirect-go-deps branch from e338de6 to 3bad10a Compare June 25, 2026 10:46

myasnikovdaniil requested a review from Aleksei Sviridkin (lexfrei) June 25, 2026 11:08

Aleksei Sviridkin (lexfrei) approved these changes Jun 26, 2026

View reviewed changes

myasnikovdaniil merged commit f5c408d into main Jun 27, 2026
15 of 16 checks passed

myasnikovdaniil deleted the fix/renovate-indirect-go-deps branch June 27, 2026 10:18

coderabbitai Bot mentioned this pull request Jun 29, 2026

ci(renovate): force chore(deps) commits and add area/dependencies label #3015

Merged

Navigation Menu

Repository navigation

ci(renovate): bump indirect Go deps and enable OSV vuln alerts - #3026

ci(renovate): bump indirect Go deps and enable OSV vuln alerts#3026
myasnikovdaniil merged 1 commit into
mainfrom
fix/renovate-indirect-go-deps

myasnikovdaniil commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jun 24, 2026

Uh oh!

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 24, 2026

Uh oh!

IvanHunters commented Jun 24, 2026

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Uh oh!

myasnikovdaniil commented Jun 25, 2026

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

myasnikovdaniil commented Jun 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why #3019 wasn't enough

Known gap

Validation

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jun 24, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

IvanHunters commented Jun 24, 2026

Verdict

Risks to downstream consumers

Findings

Red-team concerns

Caveats

Recommended follow-ups

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Choose a reason for hiding this comment

Business context

Blockers

Non-blocking notes

Uh oh!

myasnikovdaniil commented Jun 25, 2026

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Choose a reason for hiding this comment

Non-blocking (carried over)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

myasnikovdaniil commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading