Skip to content

feat: migrate from Dependabot to Renovate for better Terraform support #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jul 28, 2025
Merged

feat: migrate from Dependabot to Renovate for better Terraform support #185

merged 3 commits into from
Jul 28, 2025

Conversation

@lgallard
Copy link
Owner

@lgallard lgallard commented Jul 27, 2025

Summary

Migrates dependency management from Dependabot to Renovate for better Terraform support as part of the module standardization effort (Task 001).

Changes

  • Removed: .github/dependabot.yml - Legacy Dependabot configuration
  • Added: renovate.json - New Renovate configuration with Terraform optimizations

Benefits

  • Better Terraform support: Renovate has superior handling of Terraform providers and modules
  • Standardization: Aligns with other modules in the terraform-aws-* ecosystem
  • Stability: Disables major provider updates to prevent breaking changes
  • Flexibility: More granular control over dependency update policies

Configuration Details

The new renovate.json includes:

  • Base configuration extending config:base
  • Terraform core binary ignored (hashicorp/terraform)
  • Major Terraform provider updates disabled for stability
  • Follows release-please compatible conventional commit patterns

Testing

  • Configuration validated as valid JSON
  • Conventional commit format used for release-please compatibility
  • Clean migration with no breaking changes

This is part of the broader Terraform AWS Modules Standardization effort to ensure consistent tooling and practices across all modules.

@lgallard
Copy link
Owner Author

lgallard commented Jul 27, 2025

codebot hunt

@claude
Copy link
Contributor

claude bot commented Jul 27, 2025 •
edited
Loading

Claude finished @lgallard's task —— View job

🕵️ Bug Hunt Analysis

Analyzing the Dependabot → Renovate migration for critical bugs, security vulnerabilities, and performance issues.

Todo List:

  • Examine the new renovate.json configuration
  • Verify removed dependabot.yml doesn't leave security gaps
  • Check for misconfigurations that could cause issues
  • Analyze security implications of the migration
  • Provide actionable feedback on high-impact issues

Critical Issues Found 🚨

1. SECURITY GAP: Missing Go Module Dependency Management

  • Risk: High - Security vulnerabilities in Go dependencies won't be automatically updated
  • Issue: Old dependabot managed Go modules in /test directory, but new renovate.json omits this
  • Dependencies at risk: terratest v0.50.0, aws-sdk-go v1.55.7, and other test dependencies in test/go.mod

2. SECURITY GAP: Missing GitHub Actions Dependency Management

  • Risk: Medium-High - Outdated workflow dependencies could introduce security vulnerabilities
  • Issue: 6 workflow files found (.github/workflows/*.yml) but no renovate coverage
  • Impact: Actions like security scanning, testing workflows won't receive security updates

3. CONFIGURATION ISSUE: Potentially Too Restrictive Provider Updates

  • Risk: Medium - Important security patches in major provider updates will be blocked
  • Issue: "updateTypes": ["major"], "enabled": false blocks ALL major provider updates
  • Recommendation: Consider allowing major updates with manual approval or security-only exceptions

Recommended Fixes 🔧

Add to renovate.json:

{
  "extends": ["config:base"],
  "terraform": {
    "ignoreDeps": ["hashicorp/terraform"]
  },
  "packageRules": [
    {
      "datasources": ["terraform-provider"],
      "updateTypes": ["major"],
      "enabled": false
    },
    {
      "datasources": ["go"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    },
    {
      "datasources": ["github-actions"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    }
  ]
}

Priority: Address Go modules and GitHub Actions coverage immediately to prevent security vulnerabilities.

@lgallard
Copy link
Owner Author

lgallard commented Jul 27, 2025

codebot hunt

@claude
Copy link
Contributor

claude bot commented Jul 27, 2025 •
edited
Loading

Claude finished @lgallard's task —— View job

🕵️ Bug Hunt Analysis

Analyzing the Dependabot → Renovate migration for critical bugs, security vulnerabilities, and performance issues.

Todo List:

  • Examine the new renovate.json configuration
  • Verify removed dependabot.yml doesn't leave security gaps
  • Check for misconfigurations that could cause issues
  • Analyze security implications of the migration
  • Provide actionable feedback on high-impact issues

🚨 CRITICAL SECURITY GAPS FOUND

1. Missing Go Module Dependency Management

  • Risk: HIGH - Security vulnerabilities in Go test dependencies won't be auto-updated
  • Impact: test/go.mod contains critical dependencies like:
    • terratest v0.50.0 - Testing framework with potential vulns
    • aws-sdk-go v1.55.7 - AWS SDK with security implications
    • golang.org/x/crypto v0.36.0 - Crypto libraries need regular updates
  • Previous coverage: Dependabot managed /test gomod weekly
  • Current coverage: ❌ NONE

2. Missing GitHub Actions Security Updates

  • Risk: MEDIUM-HIGH - Outdated workflow dependencies create attack vectors
  • Impact: 6 workflow files with action dependencies:
    • actions/checkout@v4, actions/setup-go@v5, actions/setup-python@v5
    • hashicorp/setup-terraform@v3, aws-actions/configure-aws-credentials@v4
    • github/codeql-action/upload-sarif@v3
  • Previous coverage: Dependabot managed GitHub Actions weekly
  • Current coverage: ❌ NONE

3. Missing Terraform Examples Dependency Management

  • Risk: MEDIUM - 15+ example directories lose automatic provider updates
  • Impact: Examples like secure_backup_configuration/, complete_plan/ with provider constraints in versions.tf files
  • Previous coverage: Dependabot managed /examples terraform weekly
  • Current coverage: ❌ NONE

4. Overly Restrictive Provider Policy

  • Risk: MEDIUM - Security patches in major provider versions blocked
  • Issue: "updateTypes": ["major"], "enabled": false prevents ALL major AWS provider updates
  • Impact: Critical security fixes in major releases won't be applied

🔧 IMMEDIATE FIXES REQUIRED

Update renovate.json to restore security coverage:

{
  "extends": ["config:base"],
  "terraform": {
    "ignoreDeps": ["hashicorp/terraform"]
  },
  "packageRules": [
    {
      "datasources": ["terraform-provider"],
      "updateTypes": ["major"],
      "enabled": false
    },
    {
      "datasources": ["go"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    },
    {
      "datasources": ["github-actions"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    }
  ]
}

Priority: Address Go modules and GitHub Actions coverage immediately - these contain the highest security risk dependencies.

@lgallard
Copy link
Owner Author

lgallard commented Jul 27, 2025 via email

@claude
Copy link
Contributor

claude bot commented Jul 27, 2025 •
edited
Loading

Claude finished @lgallard's task —— View job

✅ Security Gaps Addressed

Todo List:

  • Read current renovate.json configuration
  • Update renovate.json to include Go module dependency management
  • Add GitHub Actions security updates coverage
  • Ensure Terraform examples dependency management
  • Commit and push the improved configuration
  • Validate all security gaps are addressed

🔒 Critical Security Issues Fixed

✅ Go Module Dependency Management

  • Now monitors test/go.mod for security updates
  • Covers terratest, aws-sdk-go, golang.org/x/crypto and other test dependencies
  • Scheduled for Monday mornings

✅ GitHub Actions Security Updates

  • Now monitors workflow files for action dependency updates
  • Covers actions/checkout, aws-actions/configure-aws-credentials, etc.
  • Scheduled for Monday mornings

✅ Terraform Examples Coverage

  • Base config (config:base) includes terraform provider management
  • Examples in subdirectories will receive provider updates

✅ Improved Configuration

  • Maintains stability by blocking major Terraform provider updates
  • Adds targeted security coverage for high-risk dependencies
  • Uses scheduled updates to minimize disruption

📝 Changes Made

  • File: renovate.json
  • Commit: 65b567e - Added Go modules and GitHub Actions dependency management
  • Branch: Updated in feat/migrate-to-renovate

The renovate configuration now provides comprehensive dependency security coverage while maintaining the stability requirements for Terraform providers.

@claude @lgallard
fix: add Go modules and GitHub Actions dependency management to Renovate
65b567e 
This addresses critical security gaps identified in the Dependabot migration:
- Adds Go module dependency management for test dependencies
- Adds GitHub Actions security updates coverage
- Schedules both for Monday mornings to minimize disruption

Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
@lgallard
Copy link
Owner Author

lgallard commented Jul 27, 2025 via email

@claude
Copy link
Contributor

claude bot commented Jul 27, 2025 •
edited
Loading

Claude finished @lgallard's task —— View job

🕵️ Bug Hunt Analysis

Analyzing the updated Renovate configuration for critical bugs, security vulnerabilities, and performance issues after previous fixes.

Todo List:

  • Read current renovate.json configuration
  • Verify previous security gaps are properly addressed
  • Check for new security issues or misconfigurations
  • Analyze for performance or stability concerns
  • Provide actionable feedback on critical issues found

🔍 Analysis Results

✅ Previous Critical Issues RESOLVED:

  • Go Module Security: Now covered via "datasources": ["go"] for test dependencies
  • GitHub Actions Security: Now covered via "datasources": ["github-actions"] for workflow updates

🚨 NEW CRITICAL ISSUE DISCOVERED

Missing Terraform Provider Management for Examples

  • Risk: MEDIUM-HIGH - 15+ example directories lose security updates
  • Issue: Previous dependabot explicitly managed /examples terraform weekly, current renovate.json omits this
  • Impact: Examples with provider constraints (>= 4.26, >= 5.0) won't receive provider security updates
  • Evidence: examples/complete_plan/versions.tf:7, examples/secure_backup_configuration/versions.tf:9

⚠️ CONFIGURATION CONCERNS

Potential Autodiscovery Gap

  • Risk: MEDIUM - Base config may not reliably find all Terraform files
  • Issue: Previous dependabot had explicit root Terraform management, current relies on autodiscovery
  • Recommendation: Add explicit Terraform configuration for reliability

🔧 RECOMMENDED FIX

Add explicit Terraform management to renovate.json:

{
  "extends": ["config:base"],
  "terraform": {
    "ignoreDeps": ["hashicorp/terraform"]
  },
  "packageRules": [
    {
      "datasources": ["terraform-provider"],
      "updateTypes": ["major"],
      "enabled": false
    },
    {
      "datasources": ["terraform-provider"],
      "matchFileNames": ["examples/**"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    },
    {
      "datasources": ["go"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    },
    {
      "datasources": ["github-actions"],
      "enabled": true,
      "schedule": ["before 9am on monday"]
    }
  ]
}

Priority: Add explicit Terraform examples coverage to restore security updates for 15+ example configurations.

@lgallard
Copy link
Owner Author

lgallard commented Jul 27, 2025 via email

@claude
Copy link
Contributor

claude bot commented Jul 27, 2025 •
edited
Loading

Claude finished @lgallard's task —— View job

✅ Terraform Examples Security Gap Fixed

Successfully addressed the missing Terraform provider management for examples directories.

Todo List:

  • Read current renovate.json configuration
  • Update renovate.json to include Terraform provider management for examples
  • Commit and push the updated configuration
  • Validate security gaps are addressed

🔒 All Security Issues Resolved

✅ Complete Security Coverage Now in Place:

  1. Go Module Security - Covers test dependencies (terratest, aws-sdk-go, crypto libraries)
  2. GitHub Actions Security - Covers workflow action dependencies
  3. Terraform Examples Security - NEW: Now covers 15+ example directories with provider updates
  4. Stability Maintained - Major provider updates still disabled for main module

📝 Changes Made

  • File: renovate.json
  • Commit: f0aca00 - Added Terraform provider management for examples directories
  • Branch: feat/migrate-to-renovate

🛡️ Final Configuration

The renovate.json now includes:

{
  "datasources": ["terraform-provider"],
  "matchFileNames": ["examples/**"],
  "enabled": true,
  "schedule": ["before 9am on monday"]
}

Result: All previously identified security gaps are now closed while maintaining module stability.

@claude @lgallard
feat: add Terraform provider management for examples directories
f0aca00 
This addresses the security gap where examples directories weren''t receiving
Terraform provider updates. The new configuration specifically targets
examples/** files for provider updates on Monday mornings while maintaining
stability by keeping major provider updates disabled for the main module.

Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
@lgallard
Copy link
Owner Author

lgallard commented Jul 28, 2025

codebot

@claude
Copy link
Contributor

claude bot commented Jul 28, 2025 •
edited
Loading

Claude finished @lgallard's task —— View job

🕵️ Bug Hunt Analysis

Analyzing the Dependabot → Renovate migration for critical bugs, security vulnerabilities, and performance issues.

Todo List:

  • Read current renovate.json configuration
  • Review git history to understand previous Dependabot coverage
  • Analyze for security gaps and misconfigurations
  • Check for critical bugs or performance issues
  • Provide actionable feedback on high-impact problems

🔍 Analysis Results

✅ Previous Security Issues RESOLVED:

  • Go Module Security: Properly covered via "datasources": ["go"] for test dependencies (terratest, aws-sdk-go, golang.org/x/crypto)
  • GitHub Actions Security: Properly covered via "datasources": ["github-actions"] for workflow dependencies (actions/checkout@v4, aws-actions/configure-aws-credentials@v4, github/codeql-action/upload-sarif@v3, etc.)
  • Terraform Examples Coverage: Examples are covered through the specific rule for "matchFileNames": ["examples/**"]

✅ Configuration Analysis - NO CRITICAL ISSUES FOUND

Security Coverage Comparison:

  • Previous Dependabot: 4 package ecosystems (gomod, github-actions, terraform root, terraform examples)
  • Current Renovate: All 4 areas properly covered with equivalent or better configuration

Configuration Quality:

  • ✅ JSON Syntax: Valid JSON structure
  • ✅ Base Config: Extends config:base for standard dependency management
  • ✅ Terraform Binary: Correctly ignores hashicorp/terraform binary updates
  • ✅ Provider Stability: Major provider updates disabled for stability
  • ✅ Scheduling: Consistent Monday morning schedule across all dependency types
  • ✅ Targeted Coverage: Specific rules for Go modules, GitHub Actions, and Terraform examples

🛡️ Security Assessment

Current Security Posture: EXCELLENT

  • All previously identified security gaps have been addressed
  • Dependency coverage is comprehensive and equivalent to previous Dependabot setup
  • Configuration follows Renovate best practices
  • No misconfigurations or syntax errors detected

📊 Coverage Summary

Dependency Type Previous (Dependabot) Current (Renovate) Status
Go Modules (/test) ✅ Weekly ✅ Monday mornings COVERED
GitHub Actions ✅ Weekly ✅ Monday mornings COVERED
Terraform Root ✅ Weekly ✅ Base config COVERED
Terraform Examples ✅ Weekly ✅ Explicit rule COVERED

🎯 Final Assessment

NO CRITICAL BUGS OR SECURITY VULNERABILITIES DETECTED

The migration from Dependabot to Renovate has been executed successfully with comprehensive security coverage maintained. All dependency types are properly managed, and the configuration follows security best practices.

@lgallard lgallard merged commit e9ed95b into master Jul 28, 2025
38 checks passed
@lgallard lgallard deleted the feat/migrate-to-renovate branch July 28, 2025 00:53
@github-actions github-actions bot mentioned this pull request Jul 28, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lgallard