Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.140.0' (#96) from renovate/renovate-self-update into main

Reviewed-on: #96

.gitea/tests/deploy-validation.sh

@@ -73,6 +73,20 @@ fi
 grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
 # API/rendering errors must not produce an empty reference list and pass.
 kubectl() { return 1; }
+if ! skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/vmagent.yaml"; then
+  echo 'VMAgent preflight did not skip an uninstalled CRD' >&2
+  exit 1
+fi
+kubectl() { return 0; }
+if skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/vmagent.yaml"; then
+  echo 'VMAgent preflight skipped an installed CRD' >&2
+  exit 1
+fi
+if skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/victoria.yaml"; then
+  echo 'VMAgent preflight skipped an unrelated manifest' >&2
+  exit 1
+fi
+kubectl() { return 1; }
 if check_referenced_secrets >"$scratch/secrets.log"; then
   echo 'Secret check accepted a failed manifest render' >&2
   exit 1

.gitea/workflows/ci.yaml

@@ -338,11 +338,20 @@ jobs:
       - name: Detect changed docker-built services
         id: services
         shell: bash
+        env:
+          PUSH_BEFORE: ${{ github.event.before }}
         run: |
           set -euo pipefail
-          base="${{ github.event.before }}"
-          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
-            base="$(git rev-list --max-parents=0 HEAD)"
+          base="${PUSH_BEFORE:-}"
+          empty_tree="$(git hash-object -t tree /dev/null)"
+          if [[ "$base" =~ ^0{40}$ ]]; then
+            base="$empty_tree"
+          elif [[ ! "$base" =~ ^[0-9a-fA-F]{40}$ ]] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            # Some Gitea push payloads expose `before` as multiple root commits
+            # joined by newlines. It is not a usable diff base; use this push's
+            # first parent so image changes in the current commit are still built.
+            base="$(git rev-parse "${GITHUB_SHA}^" 2>/dev/null || printf '%s' "$empty_tree")"
+            echo "::warning::invalid push-before value; comparing against ${base}"
           fi
 
           # A failed diff used to leave changed_files empty, which reads exactly

.gitea/workflows/deploy-lib.sh

@@ -705,6 +705,9 @@ check_referenced_secrets() {
   local missing=()
   refs=""
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    if skip_uninstalled_vmagent_crd "$m"; then
+      continue
+    fi
     objects="$(kubectl create --dry-run=client --validate=false -f "$m" -o json)" || return 1
     extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
     refs+="$extracted"$'\n'
@@ -731,6 +734,18 @@ check_referenced_secrets() {
   fi
 }
 
+# The VMAgent CRD is installed by the VictoriaMetrics Operator Helm release in
+# stage_apply_k8s, after this preflight stage. Skip only its dry-run until then.
+skip_uninstalled_vmagent_crd() {
+  local manifest="$1"
+  if [[ "$manifest" == "$REPO/prometheus-stack/k8s/vmagent.yaml" ]] \
+    && ! kubectl get crd vmagents.operator.victoriametrics.com >/dev/null 2>&1; then
+    echo "  skip: VMAgent CRD is installed by Helm during apply: ${manifest#"$REPO"/}"
+    return 0
+  fi
+  return 1
+}
+
 stage_validate() {
   check_prune_mode || return 1
   cd "$REPO"
@@ -748,6 +763,9 @@ stage_validate() {
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    if skip_uninstalled_vmagent_crd "$m"; then
+      continue
+    fi
     kubectl apply --dry-run=client -f "$m" >/dev/null
   done
   for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
@@ -755,6 +773,9 @@ stage_validate() {
   done
   log "Validate k8s manifests (kubectl dry-run=server)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    if skip_uninstalled_vmagent_crd "$m"; then
+      continue
+    fi
     kubectl apply --dry-run=server -f "$m" >/dev/null
   done
   for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do

prometheus-stack/k8s/grafana-values.yaml

@@ -60,6 +60,10 @@ grafana:
 
 prometheus:
   prometheusSpec:
+    # VM trial: vmagent scrapes and remote-writes to VictoriaMetrics, so the
+    # Prometheus server itself stands down. Encoded here (not a kubectl patch)
+    # so helm keeps owning spec.replicas and upgrades do not conflict on it.
+    replicas: 0
     retention: 60d
     retentionSize: 32GB
     storageSpec:

renovate/k8s/cronjob.yaml

@@ -19,7 +19,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.139.0
+              image: renovate/renovate:44.140.0
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea