Enable Renovate automerge, Docker updates and Zizmor CI

.github/workflows/auto-approve-bot-prs.yml

@@ -0,0 +1,26 @@
+name: Renovate Auto-Approve
+
+on:
+  schedule:
+    - cron: "7 * * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: renovate-auto-approve
+
+jobs:
+  approve:
+    if: github.ref == 'refs/heads/master' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Approve verified Renovate PRs
+        uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main
+        with:
+          app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }}
+          app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }}

.github/workflows/beest-verification.yml

@@ -47,7 +47,7 @@ jobs:
     steps:
       - name: Mint GitHub App token (dispatch beest workflows)
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.BEEST_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.BEEST_GH_APP_PRIVATE_KEY }}

.github/workflows/ci.yml

@@ -17,6 +17,26 @@ env:
   IMAGE: quay.io/stackstate/stackstate-k8s-process-agent
 
 jobs:
+  workflow-security-lint:
+    name: Workflow security lint (Zizmor)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Audit workflows, composite actions, and Dependabot
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false
+          version: 1.31.1
+          inputs: .
+          collect: workflows,actions,dependabot
+
   build-and-test:
     name: Prebuild, generated-code check, build, and unit tests (${{ matrix.arch }})
     runs-on: ${{ matrix.runner }}
@@ -29,13 +49,13 @@ jobs:
           - arch: amd64
             runner: ubuntu-24.04
             llvm-arch: x86_64
-            prebuild-image: quay.io/stackstate/datadog_build_system-probe_x64:61b4ad67
-            builder-image: quay.io/stackstate/datadog_build_deb_x64:61b4ad67
+            prebuild-image: quay.io/stackstate/datadog_build_system-probe_x64:main@sha256:99e15e84fee2a8cc182ccb478dabed47a55571896165ec92e642eed62ebea553
+            builder-image: quay.io/stackstate/datadog_build_deb_x64:main@sha256:9208772fc8f640634eef8a1cb5799c6129a3d1f730ce96884fd0a27224fdddf3
           - arch: arm64
             runner: ubuntu-24.04-arm
             llvm-arch: arm64
-            prebuild-image: quay.io/stackstate/datadog_build_system-probe_arm64:61b4ad67
-            builder-image: quay.io/stackstate/datadog_build_deb_arm64:61b4ad67
+            prebuild-image: quay.io/stackstate/datadog_build_system-probe_arm64:main@sha256:794ebded2c35f9ad725b5381591a8da14162fbda64f8e23ad47a0dff0aef2644
+            builder-image: quay.io/stackstate/datadog_build_deb_arm64:main@sha256:ad9102e44c436a0a503a4275b2e15d061cf8723f754f439591b85fb2217f2593
     steps:
       - name: Check out source commit
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -203,7 +223,9 @@ jobs:
 
   publish-image:
     name: Publish and sign commit image (${{ matrix.arch }})
-    needs: image-smoke-and-scan
+    needs:
+      - workflow-security-lint
+      - image-smoke-and-scan
     if: >-
       (github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository) ||
@@ -260,7 +282,7 @@ jobs:
           description: Process agent collecting per-process and per-container telemetry for SUSE Observability.
           component: stackstate-k8s-process-agent
           dockerfile: BCI.dockerfile
-          base-name: registry.suse.com/bci/bci-micro:15.7
+          base-name: registry.suse.com/bci/bci-micro:15.7-61.16@sha256:62a5e3d2574139c4334217e2f342960e3c03ac8b8c7a956504829e4cd79d9e97
 
       - name: Build, publish, and sign architecture image
         uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
@@ -314,6 +336,7 @@ jobs:
   ci-success:
     name: Process-agent CI
     needs:
+      - workflow-security-lint
       - build-and-test
       - image-smoke-and-scan
       - publish-image
@@ -346,7 +369,7 @@ jobs:
       failure() &&
       github.ref == 'refs/heads/master' &&
       github.event_name == 'push'
-    uses: ./.github/workflows/cerberus-notify.yml
+    uses: $/.github/workflows/cerberus-notify.yml
     with:
       suite: build
     secrets:

.github/workflows/renovate.yml

@@ -0,0 +1,19 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 1,8 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  renovate:
+    uses: StackVista/renovate-config/.github/workflows/renovate.yml@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main
+    with:
+      docker_registry_1: quay.io
+      docker_registry_1_username: ${{ vars.QUAY_USER }}
+    secrets:
+      RENOVATE_GH_APP_PRIVATE_KEY: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
+      DOCKER_REGISTRY_1_PASSWORD: ${{ secrets.QUAY_PASSWORD }}

.github/workflows/update-datadog-dependency.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Create updatecli GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.UPDATECLI_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.UPDATECLI_GH_APP_PRIVATE_KEY }}

BCI.dockerfile

@@ -1,11 +1,11 @@
-FROM registry.suse.com/bci/bci-micro:15.7 AS final
+FROM registry.suse.com/bci/bci-micro:15.7-61.16@sha256:62a5e3d2574139c4334217e2f342960e3c03ac8b8c7a956504829e4cd79d9e97 AS final
 ARG LONG_ARCH="x86_64"
 ARG SHORT_ARCH="amd64"
 ARG EBPF_SUBFOLDER="x86_64"
 RUN : # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 
 # Temporary build stage image
-FROM registry.suse.com/bci/bci-base:15.7 AS chroot-builder
+FROM registry.suse.com/bci/bci-base:15.7-5.23.49@sha256:b9d19a145a6a7832291fcaf354c61b9d229e38dc4b47ea90e885d9dc02079beb AS chroot-builder
 # Install system packages using builder image that has zypper
 COPY --from=final / /chroot/
 

README.md

@@ -7,6 +7,8 @@
 
 ## Build the process agent
 
+Renovate excludes Datadog dependencies, including their forks and build images, even for security fixes. Updatecli owns their controlled updates.
+
 If you want to use a custom version of `datadog-agent-upstream-for-process-agent` use the following script before invoking the build command.
 
 ```bash

renovate.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "github>StackVista/renovate-config#f5d8a69a238645b13ddedc25457daced35834d98",
+    "github>StackVista/renovate-config:go",
+    "github>StackVista/renovate-config:docker",
+    "github>StackVista/renovate-config:automerge"
+  ],
+  "packageRules": [
+    {
+      "matchDepNames": [
+        "/datadog/i",
+        "github.com/StackVista/sketches-go"
+      ],
+      "enabled": false
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"],
+      "matchStrings": [
+        "(?<depName>(?:quay\\.io/stackstate/datadog_build_(?:system-probe|deb)_(?:x64|arm64)|registry\\.suse\\.com/bci/bci-micro)):(?<currentValue>[^\\s@]+)@(?<currentDigest>sha256:[a-f0-9]{64})"
+      ],
+      "datasourceTemplate": "docker"
+    }
+  ]
+}