ci: allow nodejs.org in renovate validator workflow

prek provisions a Node.js runtime for the renovate-config-validator hook (which is node-based) and downloads the binary from nodejs.org. Adds the host to the harden-runner allow-list.
ci: allow registry.npmjs.org in renovate validator workflow
2026-05-15 00:33:27 +00:00 · 2026-05-14 17:25:42 +02:00 · 2026-05-14 17:25:42 +02:00 · 2026-05-14 17:25:42 +02:00 · 2026-05-14 17:25:42 +02:00 · 2026-05-14 17:25:42 +02:00
4 changed files with 224 additions and 0 deletions
@@ -0,0 +1,158 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    ":enablePreCommit",
+    ":semanticCommits",
+    ":enableVulnerabilityAlertsWithLabel(security)",
+    "docker:enableMajor",
+    "helpers:pinGitHubActionDigestsToSemver",
+    "helpers:disableTypesNodeMajor",
+    "security:openssf-scorecard",
+    "customManagers:githubActionsVersions",
+    "customManagers:dockerfileVersions"
+  ],
+  "timezone": "Europe/Madrid",
+  "baseBranches": [
+    "master"
+  ],
+  "labels": [
+    "dependencies"
+  ],
+  "dependencyDashboardTitle": "Dependency Dashboard",
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 2,
+  "vulnerabilityAlerts": {
+    "prHourlyLimit": 0,
+    "prConcurrentLimit": 0
+  },
+  "configMigration": true,
+  "minimumReleaseAge": "7 days",
+  "rangeStrategy": "pin",
+  "packageRules": [
+    {
+      "description": "Patches: 1st of every month, Madrid overnight window (22:00-06:00)",
+      "matchUpdateTypes": [
+        "patch"
+      ],
+      "schedule": [
+        "* 22-23,0-5 1 * *"
+      ]
+    },
+    {
+      "description": "Minors: 8th of every 2 months, Madrid overnight window - staggered one week from patches",
+      "matchUpdateTypes": [
+        "minor"
+      ],
+      "schedule": [
+        "* 22-23,0-5 8 */2 *"
+      ]
+    },
+    {
+      "description": "Majors: 15th of every 3 months, Madrid overnight window - staggered two weeks from patches",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "schedule": [
+        "* 22-23,0-5 15 */3 *"
+      ]
+    },
+    {
+      "description": "GitHub Actions - single grouped PR, no changelog, scope=ci",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "groupName": "github-actions",
+      "semanticCommitScope": "ci",
+      "addLabels": [
+        "no-changelog"
+      ]
+    },
+    {
+      "description": "Docker images - single grouped PR, no changelog, scope=docker",
+      "matchManagers": [
+        "dockerfile",
+        "docker-compose"
+      ],
+      "groupName": "docker",
+      "semanticCommitScope": "docker",
+      "addLabels": [
+        "no-changelog"
+      ]
+    },
+    {
+      "description": "Pre-commit hooks - single grouped PR, scope=pre-commit",
+      "matchManagers": [
+        "pre-commit"
+      ],
+      "groupName": "pre-commit hooks",
+      "semanticCommitScope": "pre-commit",
+      "addLabels": [
+        "no-changelog"
+      ]
+    },
+    {
+      "description": "Helm charts - single grouped PR, scope=helm",
+      "matchManagers": [
+        "helmv3"
+      ],
+      "groupName": "helm charts",
+      "semanticCommitScope": "helm",
+      "addLabels": [
+        "no-changelog",
+        "helm"
+      ]
+    },
+    {
+      "description": "UI - scope=ui",
+      "matchFileNames": [
+        "ui/**"
+      ],
+      "semanticCommitScope": "ui"
+    },
+    {
+      "description": "API - scope=api",
+      "matchFileNames": [
+        "api/**"
+      ],
+      "semanticCommitScope": "api"
+    },
+    {
+      "description": "MCP server - scope=mcp",
+      "matchFileNames": [
+        "mcp_server/**"
+      ],
+      "semanticCommitScope": "mcp"
+    },
+    {
+      "description": "Python SDK (root) - scope=sdk",
+      "matchFileNames": [
+        "pyproject.toml",
+        "poetry.lock",
+        "util/prowler-bulk-provisioning/**"
+      ],
+      "semanticCommitScope": "sdk"
+    },
+    {
+      "description": "Lockfile maintenance - no changelog (scope inherits from component rules above)",
+      "matchUpdateTypes": [
+        "lockFileMaintenance"
+      ],
+      "addLabels": [
+        "no-changelog"
+      ]
+    },
+    {
+      "description": "UI devDependencies - no changelog",
+      "matchFileNames": [
+        "ui/**"
+      ],
+      "matchDepTypes": [
+        "devDependencies"
+      ],
+      "addLabels": [
+        "no-changelog"
+      ]
+    }
+  ]
+}
@@ -0,0 +1,57 @@
+name: 'CI: Renovate Config Validate'
+
+on:
+  pull_request:
+    branches:
+      - 'master'
+    paths:
+      - '.github/renovate.json'
+      - '.pre-commit-config.yaml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  # renovate: datasource=pypi depName=prek
+  PREK_VERSION: '0.4.0'
+
+jobs:
+  validate:
+    name: Validate Renovate config
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            codeload.github.com:443
+            release-assets.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
+            registry.npmjs.org:443
+            nodejs.org:443
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+
+      - name: Install prek
+        run: uv tool install "prek==${PREK_VERSION}"
+
+      - name: Validate Renovate config
+        run: prek run renovate-config-validator --files .github/renovate.json
@@ -49,6 +49,14 @@ repos:
        files: ^\.github/(workflows|actions)/.+\.ya?ml$|^\.github/dependabot\.ya?ml$
        priority: 30

+  ## RENOVATE
+  - repo: https://github.com/renovatebot/pre-commit-hooks
+    rev: 43.150.0
+    hooks:
+      - id: renovate-config-validator
+        files: ^\.github/renovate\.json$
+        priority: 10
+
  ## BASH
  - repo: https://github.com/koalaman/shellcheck-precommit
    rev: v0.11.0
@@ -1,2 +1,3 @@
 .envrc
 ui/.env.local
+openspec/
Author	SHA1	Message	Date
Pablo F.G	fb97f6548a	ci: allow nodejs.org in renovate validator workflow prek provisions a Node.js runtime for the renovate-config-validator hook (which is node-based) and downloads the binary from nodejs.org. Adds the host to the harden-runner allow-list.	2026-05-14 17:25:42 +02:00
Pablo F.G	87ec00c200	ci: allow registry.npmjs.org in renovate validator workflow The renovate-config-validator hook (renovatebot/pre-commit-hooks) is node-based and resolves its npm package set against registry.npmjs.org during the prek setup phase. Adds the host to the harden-runner allow-list alongside the GitHub and PyPI endpoints.	2026-05-14 17:25:42 +02:00
Pablo F.G	5aeaf309e9	ci: allow release-assets.githubusercontent.com in renovate validator workflow setup-uv downloads the uv binary from GitHub release assets; the harden-runner egress block was rejecting it. Adds the host to the allow-list alongside the other GitHub endpoints.	2026-05-14 17:25:42 +02:00
Pablo F.G	c59d893879	chore(ci): exempt vulnerability alerts from Renovate rate caps	2026-05-14 17:25:42 +02:00
Pablo F.G	9f27b77d7a	chore(ci): add Renovate baseline config	2026-05-14 17:25:42 +02:00
Pablo F.G	84332cb74a	ci: added renovate config check workflow	2026-05-14 17:25:42 +02:00
Pablo F.G	1352b8ae84	chore: add renovate config check to pre commit	2026-05-14 17:25:42 +02:00
Pablo F.G	445f1e5796	chore(worktree): include openspec/ in copy-ignored allowlist Ensures `wt switch --create` copies the nested openspec/ clone into new worktrees alongside .envrc and ui/.env.local, so each branch can carry its own openspec state.	2026-05-14 17:25:42 +02:00