3.3 Live Renovate

Overview

Merge a real renovate-bot pull request that updates stale lightwell-pins.properties on lw-student/spring-boot-lw-poc. A hand-edited commit fails this Check. Copying the worked example fails too.

MintMaker is the hosted Konflux name for this bot. This cluster does not install hosted Konflux. It uses an in-cluster CronJob. The term map is in Konflux mapping.

Why it matters

Pin refresh cannot depend on a human noticing a new Lightwell version. Remediations arrive as pull requests against your git. You review and merge them. A student-authored commit on the pins file is not that control.

Lightwell Network catalog bumps (.rhlw-00000 to .rhlw-00001, dest Hummingbird digest) are what this bot is seeded to see. Clearinghouse Premier member-specific versions would appear the same way once Nexus has metadata the bot can read. During a Premier embargo, merge the pin. Do not paste the CVE or advisory text into a public PR description.

What does it solve

  • Manual pin edits that drift

  • Student-authored commits pretending to be the bot

  • Pasting advisory text into a public PR during embargo

Why a bot PR

Renovate (or MintMaker on hosted Konflux) opens PRs against your git when a vetted version exists. Here the git is Gitea. Do not use github.com for this Check.

Stale seed (do not “fix” these yourself). The bot opens one grouped PR that moves both lines:

  • commons-lang3=3.14.0.rhlw-00000 → remediated 3.14.0.rhlw-00001 in Nexus

  • hummingbird-digest all-zero → dest digest after 1.2

Merging only the Maven bump used to leave a second digest PR unmergeable on the same file. Do not hand-edit the leftover line.

The CronJob retries about every 20 minutes.

Confirm the bot is on this cluster

The chart is default-off. If the CronJob is missing, this cluster did not enable components.renovate. Tell an instructor. Do not fake a PR.

oc -n renovate get cronjob
oc -n renovate get configmap demo-userinfo-renovate -o yaml
oc -n renovate get configmap renovate-docs \
  -o jsonpath='{.data.example-renovate-pr\.md}'

Worked example (not the Check)

A hand commit by student on pom.xml / Jackson. If that is what landed on main, the Check fails.

# Worked example ONLY — wrong author, wrong file. Do not commit this as the Check.
git commit --author='student <student@example.invalid>' \
  -m 'Bump jackson-databind' pom.xml

Your change: merge the renovate-bot PR

  1. In Gitea, open lw-student/spring-boot-lw-poc → Pull Requests.

  2. The scored PR author is renovate-bot. Files must include lightwell-pins.properties. Both seed values (rhlw-00000 and the all-zero digest) should move in that one PR.

  3. Review, then merge on Gitea (do not git commit the same hunk as student).

Gitea pull request authored by renovate-bot on lightwell-pins.properties

If no PR yet: wait for the next CronJob; check Job logs in namespace renovate. Maven bump should appear once Nexus remotes are up. Dest Docker bump needs 1.2. Retry. Do not push a student commit that edits the pins file.

After merge, refresh the clone
cd /tmp/spring-boot-lw-poc
git fetch origin
git checkout main
git pull --ff-only origin main
git log -1 --format='%an %ae %s'
cat lightwell-pins.properties

Check: merged commit is the bot

Pass when:

  • Latest merge (or the merge commit) author is renovate-bot, not student

  • lightwell-pins.properties moved off rhlw-00000 / all-zero digest

  • You did not recreate that diff as a hand commit

Fill the report

The Job also grades ConfigMap report-07-live-renovate key who_changed_pins. Set it to renovate-bot. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-07-live-renovate

The scored Check is Job validate-07-live-renovate in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-07-live-renovate --ignore-not-found
TPL='job-07.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-07-live-renovate

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

Honor system: Track 4 still opens. The Validate Job still rejects a seeded or student-authored pin bump.

Callout: pip pins

Renovate on a PyPI app watches requirements.txt (or pyproject.toml) for +rhlw.* bumps the same way this Check watches lightwell-pins.properties. This Check is the Maven pins file on Gitea.

Callout: Artifactory datasources

In many organizations, Renovate (or MintMaker) often reads Maven metadata from Artifactory remotes or virtuals instead of in-cluster Nexus. The Check is still a renovate-bot PR on Gitea against this cluster’s Nexus.

Official documentation

Key takeaways

  • TSSC pin refresh is a bot PR on your git (Gitea here, not github.com).

  • Lightwell Network catalog bumps are this Check. Clearinghouse Premier member versions would use the same bot against the same proxy.

  • During embargo, merge the pin. Do not paste the advisory into the PR body.

  • Binding FROM and the pom default was 3.2. This Check is who changed the pins file.

cd ~/ocp5-rhacs-showroom
bash setup/lab-cleanup.sh --module tssc-07