feat(renovate): deprecate updatecli, enable pre-commit manager - #8351
Open
gurevichdmitry wants to merge 4 commits into
Open
feat(renovate): deprecate updatecli, enable pre-commit manager#8351gurevichdmitry wants to merge 4 commits into
gurevichdmitry wants to merge 4 commits into
Conversation
Updatecli has been 401-dead since June 2026 (CLOUDSEC_MACHINE_TOKEN expired). All unique coverage it provided is now on Renovate: - golang/.go-version: already on Renovate (custom regex manager) - hermit packages: already on Renovate (default hermit manager) - go.mod updates: already on Renovate (gomod manager) - pre-commit hook revs: now enabled via Renovate pre-commit manager Changes: - Enable Renovate pre-commit manager; group all hook rev bumps into one PR via a new packageRule; disable pre-commit updates on release branches (matching updatecli's main-only behaviour) - Add custom regex manager for docs/version.asciidoc :go-version: pin so it joins the existing go-version group (was only updated by the now-deleted updatecli golang pipeline; currently stale at 1.26.1 vs .go-version 1.26.6) - Delete .github/workflows/updatecli.yml and unused .ci/updatecli/ pipelines/scripts (golang, hermit, mods); keep update-beats.yml and update-beats.sh which are still used by bump-beats-version.yml - Ignore docs/superpowers/ in git (local planning docs) Resolves: elastic/security-team#19161 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
gurevichdmitry
added
backport-skip
dependencies
Collaborator
Author
|
@elastic-renovate-prod dry-run |
pre-commit is opt-in in Renovate and requires explicit listing in
enabledManagers to be activated. "pre-commit": {"enabled": true} alone
is insufficient. List all currently active managers alongside pre-commit
to avoid disabling auto-detected managers (hermit, terraform, etc.).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updatecli has been 401-dead since June 2026 (
CLOUDSEC_MACHINE_TOKENexpired). All unique coverage it provided is now handled by Renovate or a dedicated workflow..github/workflows/updatecli.ymland the unused.ci/updatecli/pipelines (golang,hermit,mods) — stops the monthly 401 failurespre-commitmanager — covers.pre-commit-config.yamlhook rev pins (last bumped Sept 2025); all updates grouped into one PR; disabled on release branchesdocs/version.asciidoc:go-version:pin — joins the existinggo-versiongroup (was only updated by the deletedgolangpipeline; currently stale at1.26.1vs.go-version1.26.6).ci/updatecli/updatecli.d/update-beats.yml+update-beats.sh— still used bybump-beats-version.ymldocs/superpowers/to.gitignore— housekeeping, prevents local planning notes from being accidentally committedmods(go get -u)gomod(already active)golang(.go-version+ hermitgo)go-versiongroup (already active)golang(docs/version.asciidoc)hermit(package bumps)hermitmanager (already active)hermit(pre-commit autoupdate)pre-commitmanager (enabled in this PR)bump-beats-version.yml(unchanged)Note on
enabledManagersThe
pre-commitmanager is opt-in in Renovate — it does not run unless explicitly listed inenabledManagers. BecauseenabledManagersis a replace (not an add), listing onlypre-commitwould disable all other managers. This PR therefore lists all 10 currently-active managers explicitly to preserve existing behavior.Trade-off: if Renovate auto-detects a new manager for some future file in the repo, it will not run until added to this list. This is the accepted pattern — elastic-agent and fleet-server use the same approach.
Test plan
bump-beats-version.ymlstill runs successfully (references keptupdate-beats.yml+update-beats.sh)pre-commitgroup PR bumping hook revs in.pre-commit-config.yamldocs/version.asciidocbumped from1.26.1→1.26.6in the nextgo-versiongroup PRCloses https://github.com/elastic/security-team/issues/19161
🤖 Generated with Claude Code