From 85d790200dd3eada982d0b5d1ec5b7e13c7a10cb Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 13:42:21 +0200 Subject: [PATCH 1/6] Enable Renovate automerge and image updates --- .github/workflows/auto-approve-bot-prs.yml | 26 ++++++++++++++++++++++ .github/workflows/ci.yml | 10 ++++----- .github/workflows/renovate.yml | 19 ++++++++++++++++ BCI.dockerfile | 4 ++-- renovate.json | 19 ++++++++++++++++ 5 files changed, 71 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/auto-approve-bot-prs.yml create mode 100644 .github/workflows/renovate.yml create mode 100644 renovate.json diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml new file mode 100644 index 00000000..67298d18 --- /dev/null +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -0,0 +1,26 @@ +name: Renovate Auto-Approve + +on: + schedule: + - cron: "7 * * * *" + workflow_dispatch: + +permissions: {} + +concurrency: + group: renovate-auto-approve + +jobs: + approve: + if: github.ref == 'refs/heads/master' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + pull-requests: read + steps: + - name: Approve verified Renovate PRs + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@f390d2bef95ac180f581d8263b288ded387c085c # main + with: + app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} + app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29019bf0..ace5b73d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,13 +29,13 @@ jobs: - arch: amd64 runner: ubuntu-24.04 llvm-arch: x86_64 - prebuild-image: quay.io/stackstate/datadog_build_system-probe_x64:61b4ad67 - builder-image: quay.io/stackstate/datadog_build_deb_x64:61b4ad67 + prebuild-image: quay.io/stackstate/datadog_build_system-probe_x64:main@sha256:99e15e84fee2a8cc182ccb478dabed47a55571896165ec92e642eed62ebea553 + builder-image: quay.io/stackstate/datadog_build_deb_x64:main@sha256:9208772fc8f640634eef8a1cb5799c6129a3d1f730ce96884fd0a27224fdddf3 - arch: arm64 runner: ubuntu-24.04-arm llvm-arch: arm64 - prebuild-image: quay.io/stackstate/datadog_build_system-probe_arm64:61b4ad67 - builder-image: quay.io/stackstate/datadog_build_deb_arm64:61b4ad67 + prebuild-image: quay.io/stackstate/datadog_build_system-probe_arm64:main@sha256:794ebded2c35f9ad725b5381591a8da14162fbda64f8e23ad47a0dff0aef2644 + builder-image: quay.io/stackstate/datadog_build_deb_arm64:main@sha256:ad9102e44c436a0a503a4275b2e15d061cf8723f754f439591b85fb2217f2593 steps: - name: Check out source commit uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -260,7 +260,7 @@ jobs: description: Process agent collecting per-process and per-container telemetry for SUSE Observability. component: stackstate-k8s-process-agent dockerfile: BCI.dockerfile - base-name: registry.suse.com/bci/bci-micro:15.7 + base-name: registry.suse.com/bci/bci-micro:15.7-61.16@sha256:62a5e3d2574139c4334217e2f342960e3c03ac8b8c7a956504829e4cd79d9e97 - name: Build, publish, and sign architecture image uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63 diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 00000000..3e4cf53c --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,19 @@ +name: Renovate + +on: + schedule: + - cron: "0 1,8 * * *" + workflow_dispatch: + +permissions: + contents: read + +jobs: + renovate: + uses: StackVista/renovate-config/.github/workflows/renovate.yml@f390d2bef95ac180f581d8263b288ded387c085c # main + with: + docker_registry_1: quay.io + docker_registry_1_username: ${{ vars.QUAY_USER }} + secrets: + RENOVATE_GH_APP_PRIVATE_KEY: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }} + DOCKER_REGISTRY_1_PASSWORD: ${{ secrets.QUAY_PASSWORD }} diff --git a/BCI.dockerfile b/BCI.dockerfile index 994f8b97..67d6f3e9 100644 --- a/BCI.dockerfile +++ b/BCI.dockerfile @@ -1,11 +1,11 @@ -FROM registry.suse.com/bci/bci-micro:15.7 AS final +FROM registry.suse.com/bci/bci-micro:15.7-61.16@sha256:62a5e3d2574139c4334217e2f342960e3c03ac8b8c7a956504829e4cd79d9e97 AS final ARG LONG_ARCH="x86_64" ARG SHORT_ARCH="amd64" ARG EBPF_SUBFOLDER="x86_64" RUN : # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm # Temporary build stage image -FROM registry.suse.com/bci/bci-base:15.7 AS chroot-builder +FROM registry.suse.com/bci/bci-base:15.7-5.23.49@sha256:b9d19a145a6a7832291fcaf354c61b9d229e38dc4b47ea90e885d9dc02079beb AS chroot-builder # Install system packages using builder image that has zypper COPY --from=final / /chroot/ diff --git a/renovate.json b/renovate.json new file mode 100644 index 00000000..386a7aac --- /dev/null +++ b/renovate.json @@ -0,0 +1,19 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>StackVista/renovate-config", + "github>StackVista/renovate-config:go", + "github>StackVista/renovate-config:docker", + "github>StackVista/renovate-config:automerge" + ], + "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"], + "matchStrings": [ + "(?(?:quay\\.io/stackstate/datadog_build_(?:system-probe|deb)_(?:x64|arm64)|registry\\.suse\\.com/bci/bci-micro)):(?[^\\s@]+)@(?sha256:[a-f0-9]{64})" + ], + "datasourceTemplate": "docker" + } + ] +} From c4df6f2dbc95933453f8100e55a3ef412f97de5e Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 14:08:41 +0200 Subject: [PATCH 2/6] Pin Renovate workflows to merged policy commit --- .github/workflows/auto-approve-bot-prs.yml | 2 +- .github/workflows/renovate.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml index 67298d18..ea05eafd 100644 --- a/.github/workflows/auto-approve-bot-prs.yml +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -20,7 +20,7 @@ jobs: pull-requests: read steps: - name: Approve verified Renovate PRs - uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@f390d2bef95ac180f581d8263b288ded387c085c # main + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main with: app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 3e4cf53c..f99da021 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -10,7 +10,7 @@ permissions: jobs: renovate: - uses: StackVista/renovate-config/.github/workflows/renovate.yml@f390d2bef95ac180f581d8263b288ded387c085c # main + uses: StackVista/renovate-config/.github/workflows/renovate.yml@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main with: docker_registry_1: quay.io docker_registry_1_username: ${{ vars.QUAY_USER }} From 959f6540ec739589b9c6686dd33f8a634c259050 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 14:35:43 +0200 Subject: [PATCH 3/6] Gate process-agent CI with Zizmor --- .github/workflows/beest-verification.yml | 2 +- .github/workflows/ci.yml | 28 +++++++++++++++++-- .../workflows/update-datadog-dependency.yml | 2 +- 3 files changed, 28 insertions(+), 4 deletions(-) diff --git a/.github/workflows/beest-verification.yml b/.github/workflows/beest-verification.yml index 671a4075..f681254d 100644 --- a/.github/workflows/beest-verification.yml +++ b/.github/workflows/beest-verification.yml @@ -47,7 +47,7 @@ jobs: steps: - name: Mint GitHub App token (dispatch beest workflows) id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.BEEST_GH_APP_CLIENT_ID }} private-key: ${{ secrets.BEEST_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ace5b73d..2ba5ab9a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,27 @@ env: IMAGE: quay.io/stackstate/stackstate-k8s-process-agent jobs: + workflow-security-lint: + name: Workflow security lint (Zizmor) + runs-on: ubuntu-24.04 + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Audit workflows, composite actions, and Dependabot + env: + GH_TOKEN: ${{ github.token }} + # renovate: datasource=pypi depName=zizmor + ZIZMOR_VERSION: 1.31.1 + run: | + set -euo pipefail + pipx run --spec "zizmor==${ZIZMOR_VERSION}" zizmor --collect=workflows,actions,dependabot --strict-collection . + build-and-test: name: Prebuild, generated-code check, build, and unit tests (${{ matrix.arch }}) runs-on: ${{ matrix.runner }} @@ -203,7 +224,9 @@ jobs: publish-image: name: Publish and sign commit image (${{ matrix.arch }}) - needs: image-smoke-and-scan + needs: + - workflow-security-lint + - image-smoke-and-scan if: >- (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || @@ -314,6 +337,7 @@ jobs: ci-success: name: Process-agent CI needs: + - workflow-security-lint - build-and-test - image-smoke-and-scan - publish-image @@ -346,7 +370,7 @@ jobs: failure() && github.ref == 'refs/heads/master' && github.event_name == 'push' - uses: ./.github/workflows/cerberus-notify.yml + uses: $/.github/workflows/cerberus-notify.yml with: suite: build secrets: diff --git a/.github/workflows/update-datadog-dependency.yml b/.github/workflows/update-datadog-dependency.yml index 8e55809e..6a733919 100644 --- a/.github/workflows/update-datadog-dependency.yml +++ b/.github/workflows/update-datadog-dependency.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Create updatecli GitHub App token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.UPDATECLI_GH_APP_CLIENT_ID }} private-key: ${{ secrets.UPDATECLI_GH_APP_PRIVATE_KEY }} From d51bcfc03a2ea2038af71685a2eb97e99f8087a3 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 19 Oct 2026 14:47:44 +0200 Subject: [PATCH 4/6] Use the standard Zizmor action in CI --- .github/workflows/ci.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ba5ab9a..405c65f8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,13 +30,12 @@ jobs: persist-credentials: false - name: Audit workflows, composite actions, and Dependabot - env: - GH_TOKEN: ${{ github.token }} - # renovate: datasource=pypi depName=zizmor - ZIZMOR_VERSION: 1.31.1 - run: | - set -euo pipefail - pipx run --spec "zizmor==${ZIZMOR_VERSION}" zizmor --collect=workflows,actions,dependabot --strict-collection . + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: false + version: 1.31.1 + inputs: . + collect: workflows,actions,dependabot build-and-test: name: Prebuild, generated-code check, build, and unit tests (${{ matrix.arch }}) From 7a1a89c7d3528da6a1eca983d358aff50bb8456c Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 09:38:48 +0200 Subject: [PATCH 5/6] Leave Datadog dependency updates to Updatecli --- README.md | 2 ++ renovate.json | 11 ++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 9f49e7b5..2f3c84f9 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,8 @@ ## Build the process agent +Renovate excludes Datadog dependencies, including their forks and build images, even for security fixes. Updatecli owns their controlled updates. + If you want to use a custom version of `datadog-agent-upstream-for-process-agent` use the following script before invoking the build command. ```bash diff --git a/renovate.json b/renovate.json index 386a7aac..f362b8dc 100644 --- a/renovate.json +++ b/renovate.json @@ -1,11 +1,20 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>StackVista/renovate-config", + "github>StackVista/renovate-config#f5d8a69a238645b13ddedc25457daced35834d98", "github>StackVista/renovate-config:go", "github>StackVista/renovate-config:docker", "github>StackVista/renovate-config:automerge" ], + "packageRules": [ + { + "matchDepNames": [ + "/(^|[/.])datadog(hq)?([/._-]|$)/i", + "github.com/StackVista/sketches-go" + ], + "enabled": false + } + ], "customManagers": [ { "customType": "regex", From 1e1a2e4d18e38a22de483518ff0355573cef391e Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 09:40:08 +0200 Subject: [PATCH 6/6] Exclude all Datadog-named dependencies --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index f362b8dc..6b9799e5 100644 --- a/renovate.json +++ b/renovate.json @@ -9,7 +9,7 @@ "packageRules": [ { "matchDepNames": [ - "/(^|[/.])datadog(hq)?([/._-]|$)/i", + "/datadog/i", "github.com/StackVista/sketches-go" ], "enabled": false