From 43032aab60bc4eb5d7b22659d819ffffe423c297 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 10:56:53 +0200 Subject: [PATCH 1/5] Keep Datadog security updates visible for review --- README.md | 2 +- renovate.json | 14 +++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 2f3c84f9..bca4e1d8 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ ## Build the process agent -Renovate excludes Datadog dependencies, including their forks and build images, even for security fixes. Updatecli owns their controlled updates. +Renovate excludes routine Datadog updates, including their forks and build images. Datadog security fixes open PRs for manual review, without automerge. Updatecli owns their controlled updates. If you want to use a custom version of `datadog-agent-upstream-for-process-agent` use the following script before invoking the build command. diff --git a/renovate.json b/renovate.json index 6b9799e5..4de6e017 100644 --- a/renovate.json +++ b/renovate.json @@ -1,7 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>StackVista/renovate-config#f5d8a69a238645b13ddedc25457daced35834d98", + "github>StackVista/renovate-config", "github>StackVista/renovate-config:go", "github>StackVista/renovate-config:docker", "github>StackVista/renovate-config:automerge" @@ -12,7 +12,19 @@ "/datadog/i", "github.com/StackVista/sketches-go" ], + "matchUpdateTypes": ["major", "minor", "patch", "pin", "digest", "pinDigest", "lockFileMaintenance", "rollback", "replacement"], + "matchJsonata": ["$not(isVulnerabilityAlert = true or $exists(vulnerabilityFixVersion))"], "enabled": false + }, + { + "matchDepNames": [ + "/datadog/i", + "github.com/StackVista/sketches-go" + ], + "matchJsonata": ["isVulnerabilityAlert = true or $exists(vulnerabilityFixVersion)"], + "enabled": true, + "automerge": false, + "rebaseWhen": "conflicted" } ], "customManagers": [ From eba2ac5005994ab85459ae40e66fa3fe03605eb1 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 11:02:03 +0200 Subject: [PATCH 2/5] Restore policy and refresh Renovate preset pin --- README.md | 2 +- renovate.json | 14 +------------- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index bca4e1d8..2f3c84f9 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ ## Build the process agent -Renovate excludes routine Datadog updates, including their forks and build images. Datadog security fixes open PRs for manual review, without automerge. Updatecli owns their controlled updates. +Renovate excludes Datadog dependencies, including their forks and build images, even for security fixes. Updatecli owns their controlled updates. If you want to use a custom version of `datadog-agent-upstream-for-process-agent` use the following script before invoking the build command. diff --git a/renovate.json b/renovate.json index 4de6e017..64f10406 100644 --- a/renovate.json +++ b/renovate.json @@ -1,7 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>StackVista/renovate-config", + "github>StackVista/renovate-config#d039843a9c0360a665860d24640706769886d3c8", "github>StackVista/renovate-config:go", "github>StackVista/renovate-config:docker", "github>StackVista/renovate-config:automerge" @@ -12,19 +12,7 @@ "/datadog/i", "github.com/StackVista/sketches-go" ], - "matchUpdateTypes": ["major", "minor", "patch", "pin", "digest", "pinDigest", "lockFileMaintenance", "rollback", "replacement"], - "matchJsonata": ["$not(isVulnerabilityAlert = true or $exists(vulnerabilityFixVersion))"], "enabled": false - }, - { - "matchDepNames": [ - "/datadog/i", - "github.com/StackVista/sketches-go" - ], - "matchJsonata": ["isVulnerabilityAlert = true or $exists(vulnerabilityFixVersion)"], - "enabled": true, - "automerge": false, - "rebaseWhen": "conflicted" } ], "customManagers": [ From 713fcfb8101d2f5773dc71322e693cd78d55209b Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 12:05:54 +0200 Subject: [PATCH 3/5] Pin the merged Renovate security policy --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 64f10406..f27d4f56 100644 --- a/renovate.json +++ b/renovate.json @@ -1,7 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>StackVista/renovate-config#d039843a9c0360a665860d24640706769886d3c8", + "github>StackVista/renovate-config#c308265fc9a7ee7aecaf1590383094214045049a", "github>StackVista/renovate-config:go", "github>StackVista/renovate-config:docker", "github>StackVista/renovate-config:automerge" From 02b4c20dd2cd4de3583ffcee85327b172dcfca75 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 12:15:13 +0200 Subject: [PATCH 4/5] Refresh shared Renovate workflow pins --- .github/workflows/auto-approve-bot-prs.yml | 2 +- .github/workflows/renovate.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml index ea05eafd..4509a69d 100644 --- a/.github/workflows/auto-approve-bot-prs.yml +++ b/.github/workflows/auto-approve-bot-prs.yml @@ -20,7 +20,7 @@ jobs: pull-requests: read steps: - name: Approve verified Renovate PRs - uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main + uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c308265fc9a7ee7aecaf1590383094214045049a # main with: app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }} app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index f99da021..dac93137 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -10,7 +10,7 @@ permissions: jobs: renovate: - uses: StackVista/renovate-config/.github/workflows/renovate.yml@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main + uses: StackVista/renovate-config/.github/workflows/renovate.yml@c308265fc9a7ee7aecaf1590383094214045049a # main with: docker_registry_1: quay.io docker_registry_1_username: ${{ vars.QUAY_USER }} From 4dafcfec2c414c723218ccf07a27cf87eb143ab8 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 20 Oct 2026 13:07:21 +0200 Subject: [PATCH 5/5] Pin all shared Renovate presets --- renovate.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/renovate.json b/renovate.json index f27d4f56..541cf6ea 100644 --- a/renovate.json +++ b/renovate.json @@ -2,9 +2,9 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "github>StackVista/renovate-config#c308265fc9a7ee7aecaf1590383094214045049a", - "github>StackVista/renovate-config:go", - "github>StackVista/renovate-config:docker", - "github>StackVista/renovate-config:automerge" + "github>StackVista/renovate-config:go#c308265fc9a7ee7aecaf1590383094214045049a", + "github>StackVista/renovate-config:docker#c308265fc9a7ee7aecaf1590383094214045049a", + "github>StackVista/renovate-config:automerge#c308265fc9a7ee7aecaf1590383094214045049a" ], "packageRules": [ {