[rb3ckers]

Use the shared Go, Docker and automerge presets with scheduled Renovate and approval App workflows. Pin BCI bases to release tags and digests, and track their updates explicitly. Add the standard SHA-pinned Zizmor action and require it for publication and CI success.

Exclude Datadog dependencies, client libraries, StackVista replacement modules and builder images from all Renovate PRs, including security fixes. Updatecli owns their controlled updates. Other dependencies retain the shared policy, including routine Go module minors.

Merge StackVista/renovate-config#31 before activation. Both agent repositories pin its fix so security alerts respect the exclusions. Apply StackVista/pulumi-infra#413 for App credentials and alerts. The updater App needs Dependabot alerts read access. Keep Dependabot security updates disabled.

Validation: Renovate schema and focused engine checks passed, including generated OSV/GitHub security rules and image exclusions. Captured Go replay removes seven Datadog updates and retains nine groups. Image extraction, CI gates and authenticated Zizmor also passed.

Tracking: https://github.com/StackVista/stackstate/issues/865
Infrastructure: https://github.com/StackVista/pulumi-infra/pull/413

[LouisParkin]

Verdict: looks good (revised; no blocking findings).

High — Standards: $/ in .github/workflows/ci.yml:372 is not a valid local workflow reference. Retracted: this was wrong. $/ resolves the same-repo workflow. stackstate-agent#547 calls $/.github/workflows/godeps-cache.yml and those jobs ran successfully, and the CI run on d51bcfc parsed this file and passed.

Other checks passed: all commits are signed, action SHAs match their tag comments, no YAML commentary was added, Zizmor gates publication and ci-success, and the tracker is linked by cross-repo URL.

[LouisParkin]

Approved without comments.

[LouisParkin]

Post-merge: Workflow security lint (Zizmor) is red on the default branch. ref-version-mismatch flags auto-approve-bot-prs.yml:23 and renovate.yml:13, whose c5f974f5… # main pins no longer match main since renovate-config moved. Re-pinning fixes it until the next renovate-config merge. The lasting fix is tagged renovate-config releases with # vX.Y.Z pins (see StackVista/stackstate-agent#547).