From aa940134ead380a815deaf677dd3c7ceb41b0e34 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Sun, 25 Oct 2026 04:10:14 +0100 Subject: [PATCH] docs: record the CI and the Renovate triage --- docs/roadmap.md | 49 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 46 insertions(+), 3 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index bbc278d..57d4990 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -245,9 +245,52 @@ Counted 2026-10-25 over the 73 running containers: 10 Renovate PRs are open, the oldest from February, and nothing checks a PR before Argo CD applies it. -- [ ] A GitHub Actions workflow that renders the Helm apps and runs - kubeconform on every PR, with conftest for this repo's rules -- [ ] Automerge patch versions of low-risk apps once that runs +- [x] `.github/workflows/validate.yaml` runs `tools/ci/validate.py` on + every PR and push (2026-10-25): it renders all 36 apps the way Argo CD + does (the apps chart, every Application's chart with its values, value + files and parameters, kustomizations, plain folders, and + external-snapshotter cloned with its patches) and validates the result + with kubeconform (strict, CRD schemas from the datree catalog), plus a + duplicate-key check on every YAML file. Helm 4.2.1 like Argo CD 3.5, + versions pinned and checksummed, kept current by Renovate through the + `# renovate:` comments. Tested by planting a typo in a Deployment, a + chart version that doesn't exist and a value the immich chart's schema + rejects; all three fail the run. Locally: + `docker run --rm -v $PWD:/repo:ro python /repo/tools/ci/validate.py` + - It found `syncPolicy.automated` twice in + `apps/templates/snapshot-controller-helm.yaml` (once with `prune: true`, + added 2025-03-03); Argo CD kept the last one, without prune. Now listed + once, as it ran. Prune was probably meant; turn it on deliberately if so +- [ ] conftest for this repo's own rules +- [ ] Automerge patch versions of low-risk apps now that CI runs +- [x] Renovate listed external-snapshotter twice (#15 and #24): its + `argocd` manager and a custom `github-tags` regex both matched. The + regex is gone; Renovate should close #15 by itself +- [ ] The open PRs, all validated on 2026-10-25 against main as it is now + (rebases requested, so the checks show on the PRs once Renovate has + pushed). Merging is yours; merging deploys: + - #28 cert-manager v1.21.3: security release, "All users should + upgrade" (drops the compromised eMudhra root, fixes an ARI renewal + loop and a private key copy path). Merge first + - #24 external-snapshotter v8.2.1 → v8.7.0: 8.6 moved VolumeGroupSnapshot + to v1 and 8.7 turns its feature gate on; the cluster already serves the + v1 CRDs. Merge; close #15 + - #25 WordPress chart 0.15.0 → 0.16.7: the image is pinned + (7.1.3-php8.3-apache), so the render only changes labels and + checksums (a pod restart). Merge; #19 (0.15.1) is superseded + - #26 Gitea 1.27.3 → 28.2.0 (Gitea renumbered after 1.27): security + fixes; the breaking changes are to egress host lists + (`ALLOWED_DOMAINS` and friends), none of which are set here. Database + migrations can't be undone, so merge after a fresh backup + - #23 ntfy v2.28.0 → v2.34.0: six releases in 17 days; 2.31.0 had a + database load bug that ntfy.sh rolled back (fixed in 2.31.1). No + breaking migrations. Fine, or wait a few days for 2.34 to settle + - #17 external-secrets 2.13.0 → 2.14.0: no breaking changes in the + notes; every secret goes through it, so merge when there's time to + watch a force-sync + - #27 go-dqlite v3.0.4 for `tools/dqlite-vacuum`: builds; harmless + - #29 yaml.v3 for the same tool: builds, but the code imports yaml.v2, + so it only adds an unused requirement. Close ### 9. One node