Skip to content

chore: configure Konflux bot for Python and pipeline dependency updates #1283

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
anik120 wants to merge 1 commit into from
Closed

chore: configure Konflux bot for Python and pipeline dependency updates #1283

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 38 additions & 1 deletion renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,43 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"enabledManagers": [
"tekton"
"tekton",
"pip_requirements",
"pip_setup",
"pep621",
"dockerfile",
"github-actions"
],
"pip_requirements": {
"fileMatch": [
"(^|/)requirements[\\w-]*\\.txt$",
"(^|/)requirements[\\w-]*\\.in$"
]
},
"packageRules": [
{
"description": "Group all Tekton pipeline updates",
"matchManagers": ["tekton"],
"groupName": "Tekton pipelines"
},
{
"description": "Group Python build dependencies",
"matchFiles": ["requirements-build.txt"],
"groupName": "Python build dependencies"
},
{
"description": "Separate security updates for faster merging",
"matchUpdateTypes": ["patch"],
"matchCurrentVersion": "!/^0/",
"automerge": false,
"labels": ["security"]
}
Comment on lines +28 to +34
Copy link
Contributor

@coderabbitai coderabbitai bot Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Renovate packageRules isVulnerabilityAlert security updates

💡 Result:

To handle “security updates” (GitHub/Dependabot vulnerability alerts) in Renovate, you don’t use matchUpdateTypes (it doesn’t include a “vulnerability” update type). Instead you configure the dedicated vulnerabilityAlerts object, and/or match vulnerability-fix upgrades via matchJsonata. [2][1]

1) Configure vulnerability-alert PRs (recommended)

{
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
    "automerge": true
  }
}

Renovate’s vulnerabilityAlerts config controls how vulnerability-fix PRs are created (e.g., labels, automerge, prCreation, branchTopic, fix strategy). [2]

2) Apply packageRules only to vulnerability-fix upgrades

Renovate suggests matching vulnerability fixes using fields like vulnerabilityFixVersion via matchJsonata: [1]

{
  "packageRules": [
    {
      "matchJsonata": ["$exists(vulnerabilityFixVersion)"],
      "labels": ["security"],
      "prPriority": 10
    }
  ]
}

If you specifically want the boolean flag, Renovate’s runtime config for alert rules includes isVulnerabilityAlert: true (seen in logs/debug output), so you can also match that: [4]

{
  "packageRules": [
    {
      "matchJsonata": ["isVulnerabilityAlert = true"],
      "labels": ["security"]
    }
  ]
}

3) Only create PRs when vulnerabilities exist

Use the preset security:only-security-updates (disables all normal updates, enables vulnerability alerts; also enables OSV alerts). [3]

{
  "extends": ["security:only-security-updates"]
}

Sources: Renovate config options for matchJsonata and example expressions [1], Renovate vulnerabilityAlerts behavior/options [2], Renovate security preset security:only-security-updates [3], Renovate discussion/log output showing isVulnerabilityAlert [4].

🌐 Web query:

Renovate vulnerability alerts configuration matchUpdateTypes patch

💡 Result:

matchUpdateTypes can’t be used inside vulnerabilityAlerts. The vulnerabilityAlerts block is only for “PRs needed due to a vulnerability in the existing package version” and has its own set of supported fields (e.g., rangeStrategy, commitMessageSuffix, prCreation, vulnerabilityFixStrategy, etc.).[1]

To apply logic like “only if the vulnerability fix is a patch”, do it with a packageRules rule (because matchUpdateTypes is valid only within packageRules).[2] For vulnerability-fix PRs, you can match them via matchJsonata using the presence of vulnerabilityFixVersion.[3]

Example (automerge only vulnerability-fix PRs that are patch updates):

{
  "vulnerabilityAlerts": {
    "enabled": true
  },
  "packageRules": [
    {
      "description": "Automerge vulnerability fixes only when update type is patch",
      "matchJsonata": ["$exists(vulnerabilityFixVersion)"],
      "matchUpdateTypes": ["patch"],
      "automerge": true
    }
  ]
}

Sources: Renovate vulnerabilityAlerts option[1], matchUpdateTypes (packageRules-only)[2], and matchJsonata example using vulnerabilityFixVersion[3].

[1] (docs.renovatebot.com)
[2] (docs.renovatebot.com)
[3] (docs.renovatebot.com)

Citations:

🌐 Web query:

Renovate "isVulnerabilityAlert" matcher packageRules

💡 Result:

isVulnerabilityAlert is not a supported packageRules matcher you can write in renovate.json. It’s an internal flag Renovate adds to the generated “alert package rules” it builds when processing GitHub (Dependabot) vulnerability alerts (you’ll see it in debug logs as alertPackageRules entries with "isVulnerabilityAlert": true). [2]

How to configure vulnerability-alert PRs (the supported way)

1) GitHub Dependabot alerts → use the top-level vulnerabilityAlerts object

This is the documented configuration hook for PRs created to fix an existing vulnerable version. [1]

{
  "vulnerabilityAlerts": {
    "labels": ["security"],
    "automerge": true,
    "commitMessageSuffix": "[SECURITY]",
    "vulnerabilityFixStrategy": "lowest"
  }
}

Renovate docs list vulnerabilityAlerts as “Config to apply when a PR is needed due to a vulnerability in the existing package version.” [1]

2) OSV-based alerts → enable osvVulnerabilityAlerts

If you want Renovate to open PRs based on OSV (osv.dev) vulnerability data, enable:

{
  "osvVulnerabilityAlerts": true
}

This is a separate feature flag. [1]

If your goal is “apply packageRules only to vulnerability PRs”

There’s no documented matcher like isVulnerabilityAlert for that. matchUpdateTypes also won’t help here because Renovate’s documented matchUpdateTypes values don’t include a “vulnerability” type. [1]

Sources: Renovate configuration docs for vulnerabilityAlerts, osvVulnerabilityAlerts, and matchUpdateTypes allowed values [1], plus Renovate discussion/log output showing alertPackageRules entries marked with isVulnerabilityAlert: true [2].

The security updates rule may not work as intended.

This rule matches all patch updates (matchUpdateTypes: ["patch"]) rather than actual security/vulnerability updates. The matchUpdateTypes field doesn't include a "vulnerability" type, so this rule will label any non-0.x patch update as "security" even when it's not security-related.

For handling vulnerability-triggered updates, use Renovate's dedicated vulnerabilityAlerts configuration object at the top level:

🔧 Recommended configuration for security updates 
+    "vulnerabilityAlerts": {
+      "enabled": true,
+      "automerge": false,
+      "labels": ["security"]
+    },
     "packageRules": [
         {
             "description": "Separate security updates for faster merging",
-            "matchUpdateTypes": ["patch"],
-            "matchCurrentVersion": "!/^0/",
-            "automerge": false,
-            "labels": ["security"]
         }

Alternatively, if you need to apply packageRules only to vulnerability-fix PRs, use matchJsonata with $exists(vulnerabilityFixVersion):

         {
             "description": "Separate security updates for faster merging",
+            "matchJsonata": ["$exists(vulnerabilityFixVersion)"],
             "matchUpdateTypes": ["patch"],
             "matchCurrentVersion": "!/^0/",
             "automerge": false,
             "labels": ["security"]
         }
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@renovate.json` around lines 28 - 34, The current package rule in
renovate.json uses matchUpdateTypes: ["patch"] and matchCurrentVersion: "!/^0/"
which will label any patch (non-0.x) as "security" even when not a
vulnerability; replace this by using Renovate's top-level vulnerabilityAlerts
configuration for true vulnerability PR handling, or change the package rule to
matchJsonata with $exists(vulnerabilityFixVersion) to target only
vulnerability-fix PRs (remove or stop using matchUpdateTypes ["patch"] for
security labeling and keep labels: ["security"] only for matches that pass the
vulnerability check).

],
"vulnerabilityAlerts": {
"enabled": true,
"labels": ["security"]
},
"schedule": [
"before 6am on Monday"
]
}
Loading