Enable Renovate automerge and update Zizmor checks

[rb3ckers]

Enroll agent in the shared Renovate and approval App workflows, with the standard Zizmor action and required CI gates.

Most dependency upgrades arrive through Datadog upstream merges. Suppress all major updates and routine Go module minors, including golang.org/x. Security minor fixes can automerge after required checks. Exclude Datadog dependencies, forks, clients, integrations, tooling and build images from all Renovate PRs, including security fixes. Updatecli owns their controlled updates. Preserve these rules during upstream merges.

Both agent repositories pin every shared preset, the runner and the approval action to the merged fix from StackVista/renovate-config#31 so security alerts respect the exclusions. Apply StackVista/pulumi-infra#413 for App credentials, alerts and Dependabot settings. The updater App needs Dependabot alerts read access.

Validation: Renovate schema, pre-commit and focused engine checks passed, including generated OSV/GitHub security rules, module replacements, custom dependencies and Datadog image exclusions. Authenticated Zizmor 1.31.1 passed with zero findings.

Tracking: StackVista/renovate-config#22
Infrastructure: https://github.com/StackVista/pulumi-infra/pull/413

[LouisParkin]

Verdict: approve-with-nits. The workflow changes are sound: actions are SHA-pinned, permissions are minimal, Zizmor passes, $/ reusable refs run, and commits are signed. Before merging, scope down what enabling gomod turns on.

Medium: Specification

• renovate.json:7: :automerge also auto-merges every gomod require minor update. That applies to all 194 go.mod files in this fork. renovate-config#22 says to auto-merge only module patches and golang.org/x/* minors, and to review other minors by hand. Fix: add a local rule that sets automerge: false for gomod require/replace minor updates outside golang.org/x/**, or fix the preset.
• Dependabot security updates are still enabled on this repo (automated-security-fixes returns enabled: true; Dependabot opened #546 on Oct 15). Neither this PR nor pulumi-infra#413 turns them off, but the description says "keep Dependabot security updates disabled". With gomod and OSV alerts enabled, both bots will raise PRs for the same modules. Fix: disable them through the owning IaC before merging, or correct the description.

Low: Specification

• renovate.json:9,15: enabling gomod together with the Go preset (rangeStrategy: bump for the golang depType) will also bump module go directives. Expect the ~51 go 1.26.0 lines to go into the auto-merged "Go build environment" group, because your golang-version patch rule matches them too. Expect the 141 go 1.25.0 lines to get a minor PR. The repo's own toolchain bump (14159e6) kept these at X.Y.0 and changed only .go-version/go.work. If that convention should hold, add {"matchManagers":["gomod"],"matchDepTypes":["golang"],"enabled":false}.

Low: Standards

• .github/workflows/auto-approve-bot-prs.yml:15: the gate hard-codes refs/heads/stackstate-7.78.2. After the next upstream merge changes the default branch, the approver will stop without any error. Add this rename to the UPSTREAM_MERGE.md checklist.

Merge order: pulumi-infra#413 is still open, and both scheduled workflows depend on it. Lint and DEB CI were still running when this review was written.

[LouisParkin]

Approved with comments

[LouisParkin]

Re-reviewed up to cce0d28. The Renovate policy looks right: majors are off, Go minors only update for security fixes, Datadog deps are left to Updatecli, and the branch guard is documented. Dependabot security updates are now disabled through pulumi-infra#413. I'll approve once CI is green.

Blocker: Workflow security lint (Zizmor) fails with ref-version-mismatch at .github/workflows/auto-approve-bot-prs.yml:23 and .github/workflows/renovate.yml:13. The c5f974f5… # main pins no longer match main after renovate-config moved. Re-pinning to the current main fixes it for now, but it will break again on the next renovate-config merge. The lasting fix is to tag renovate-config releases and pin @<sha> # vX.Y.Z (in files/renovate-caller.yml as well). stackstate-cli and process-agent main are red for the same reason.

Nit: only the base preset is pinned (#c308265f). :go, :docker and :automerge still follow main, so the presets can drift apart. Either pin all four to the same ref or none.