[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
FerrLabs/.github (changelog)	workflow	digest	39502a0 → d0c7073

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Digest-only bump of FerrLabs/.github (39502a0 → e056bc5) across the four reusable workflow refs in ci.yml, pr-title.yml, release.yml, security-scan.yml.

There is exactly one commit between the two SHAs (FerrLabs/.github#361, "resolve ferrlabs-* crates from crates.io instead of Kellnr"), and it only touches default.json and snippets/deny.toml — the Renovate preset and a cargo-deny snippet. None of the four reusable workflow files this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed content at all between the old and new digest. So there's nothing for this repo's CI to actually pick up from the bump.

Note this repo's renovate.json extends github>FerrLabs/.github unpinned, so the crates.io-vs-Kellnr resolution change already applies to FerrVault's own Renovate runs regardless of this PR — it's not gated by this digest bump.

Checks running at review time are green where completed, nothing failed.

[ferrfleet]

Re-review: Renovate moved the target digest since my last approval (was 39502a0→e056bc5, now 39502a0→b6a08e6), so this is a fresh diff, not a no-op rebase.

Of the four reusable workflows this repo pins, two (reusable-pr-title.yml, reusable-security-scan.yml) are byte-identical between old and new digest. The other two have real content changes, both benign for this repo:

• reusable-ci-go.yml: added continue-on-error: true to the two coverage-artifact upload steps (with a comment explaining a flaky upload shouldn't fail the gate). Only loosens a failure mode, doesn't affect ci.yml's build-paths/enable-sonar usage.
• reusable-ferrflow-release.yml: bumps the pinned FerrLabs/FerrFlow action v7.21.7 → v7.25.0 and adds an optional tag-signing feature (new TAG_SIGNING_KEY secret, tag_signing_key/name/email inputs). release.yml:15-19 only passes FERRLABS_DISPATCH_TOKEN and sets no TAG_SIGNING_NAME/TAG_SIGNING_EMAIL vars, so signing stays disabled here — no-op for this repo.

Checks completed so far (gitleaks, osv-scanner, PR title, snyk, zizmor) are all green; CI Test/Lint/Security, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: Renovate moved the target digest again since my last approval (was 39502a0→b6a08e6, now 39502a0→42a0645), so this is a new diff.

Of the four reusable workflows this repo pins, three (reusable-ci-go.yml, reusable-pr-title.yml, reusable-security-scan.yml) are byte-identical to the versions I already reviewed at b6a08e6. Only reusable-ferrflow-release.yml changed further:

• Adds an opt-in crates-io-trusted-publishing input plus a rust-lang/crates-io-auth-action step, and switches CARGO_REGISTRY_TOKEN from the static secrets.CARGO_FERRLABS_REGISTRY_TOKEN to that step's OIDC-minted output (only populated when the new input is true).
• release.yml:15-18 in this repo doesn't set crates-io-trusted-publishing and doesn't pass secrets: inherit or CARGO_FERRLABS_REGISTRY_TOKEN, so CARGO_REGISTRY_TOKEN was empty before this change and stays empty after — no-op here. This repo's .ferrflow also sets deferPublish: true, and crates.io publish actually happens through this repo's own .github/workflows/publish.yml, not through the reusable release workflow's token at all.

Checks on the head commit were still in progress at review time (CI, Secrets+CVE scans, kind smoke test); nothing has failed so far.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→42a0645, now 39502a0→1a21d234c).

Only one commit separates the two: FerrLabs/.github#382, "build fuzz targets for the toolchain host, not cargo-fuzz's own triple," which touches only reusable-fuzz-rust.yml. None of the four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed. No-op for this repo.

All completed checks on the head commit are green (CI Security, gitleaks, osv-scanner, snyk, zizmor, PR title); CI Test/Lint, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→1a21d23, now 39502a0→6b7ce7f).

One commit separates the two: FerrLabs/.github#383, "chore(renovate): resolve @FerrLabs packages from npmjs". It touches default.json plus reusable-ci-node.yml and reusable-ci-astro.yml. All four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) are byte-identical between the two digests, as is .github/actions/. No-op for FerrVault's CI.

As before, this repo's renovate.json extends github>FerrLabs/.github unpinned, so the npmjs preset change already applies to FerrVault's Renovate runs independently of this digest bump.

Completed checks on the head commit are green (gitleaks, osv-scanner, snyk, PR title, CI Detect Go module); CI Test/Lint/Security, opengrep, zizmor and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→6b7ce7f, now 39502a0→30bd2ef).

Two commits separate them, both touching only default.json:

• FerrLabs/.github#385, widens the Renovate Dockerfile schedule from before 6am on monday to on monday.
• FerrLabs/.github#386, rewords that rule's description only.

None of the four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed, nor did .github/actions/. No-op for FerrVault's CI. As before, this repo's renovate.json extends github>FerrLabs/.github unpinned, so the schedule change already applies to FerrVault's Renovate runs independently of this digest bump.

Completed checks on the head commit are green (gitleaks, osv-scanner, snyk, zizmor, PR title, CI Detect Go module); CI Test/Lint/Security, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to 660965a. dco.yml has also joined the diff, going from 7c84741 to 660965a.

Three upstream commits separate them:

• #404 moves caller inputs out of run: blocks and into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. The variables are still expanded unquoted, so word splitting and globbing behave as before. That covers madge-paths: packages/*/src in mcp-ci.yml and build-paths: ./cmd/... in ci.yml.
• #405 adds reusable-dco.yml. reusable-dco.yml is byte-identical between 7c84741 and 660965a, so the dco.yml re-pin is a no-op.
• #403 adds sha256 checks for the gitleaks, osv-scanner, opengrep and trufflehog downloads in reusable-security-scan.yml. It also pins the opengrep-rules tarball to a commit and replaces trufflehog's curl | sh installer with a pinned 3.99.7 release. This tightens supply-chain checks. The one new failure mode: if an upstream asset changes, the scan fails at install. That is the point of the change.

reusable-pr-title.yml and reusable-ferrflow-release.yml did not change. Checks on the head commit were still running when I looked. A duplicate sign-off run was cancelled by the DCO concurrency group and one PR title run was skipped; nothing had failed.

[ferrfleet-interne]

Re-review: since my last approval the target digest moved from 40aa5d1 to fbe42a0, and dco.yml has joined the diff (7c84741 → fbe42a0).

There are four upstream commits between those digests. Two of them reach this repo:

• FerrLabs/.github#404 moves caller inputs out of run: blocks and into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. The variables stay unquoted, so word splitting and globbing work as before. build-paths: ./cmd/... and madge-paths: packages/*/src expand the same way they did.
• FerrLabs/.github#403 adds sha256 checks for gitleaks, osv-scanner and opengrep. It also pins opengrep-rules to a fixed commit and swaps trufflehog's curl | sh installer for a release tarball whose checksum is verified. The gitleaks and osv-scanner jobs on the head commit passed, so those checksums match.

#405 only adds reusable-dco.yml (already pinned on main) and #406 only touches workflow-templates/. reusable-dco.yml is the same at both digests.

On the head commit, the finished checks are green, and that includes sign-off and MCP Test & Build. CI Test/Lint/Security, opengrep and the kind smoke test were still running when I looked.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to fbe42a0, and dco.yml has joined the diff (7c84741 → fbe42a0).

The four upstream commits in between are #403, #404, #405 and #406. Here is what reaches this repo:

• reusable-ci-go.yml, reusable-ci-node.yml, reusable-security-scan.yml (#404): caller inputs move from inline ${{ }} in run: into env: vars, still expanded unquoted. Behaviour is unchanged for the plain values this repo passes (./cmd/... and so on).
• reusable-security-scan.yml and the sast-external-issues action (#403): add sha256 checks for gitleaks, osv-scanner, opengrep and trufflehog, pin trufflehog to v3.99.7 instead of piping install.sh from main, and pin opengrep-rules to a commit. This tightens the supply chain. The scan will fail if an upstream asset is ever re-uploaded, which is the point of the check.
• reusable-dco.yml is byte-identical between 7c84741 and fbe42a0, so dco.yml only re-pins.
• default.json gains a Renovate Signed-off-by commit body. It already applies here, because renovate.json extends the preset unpinned.

reusable-pr-title.yml and reusable-ferrflow-release.yml did not change. Checks were still running at review time. PR title and snyk passed. One sign-off run shows cancelled, with a newer one pending.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to be40b72. The diff now also re-pins dco.yml (7c84741 to be40b72).

Upstream changes between them that reach this repo:

• #404 moves caller inputs out of run: blocks into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. I read the node and security-scan versions at the new SHA. The env-var forms ($PKG_MANAGER install $INSTALL_ARGS, $SCRIPT_RUNNER $TEST_SCRIPT) still word-split, so mcp-ci.yml's multi-word script-runner/install-args keep working. I did not read the Go file; the change there follows the same pattern.
• #403 adds sha256sum -c verification for the gitleaks, osv-scanner, opengrep and trufflehog downloads in reusable-security-scan.yml. This only fails if a pinned checksum is wrong. gitleaks and osv-scanner already passed on this head commit.
• #405/#406 are DCO-related: the reusable DCO workflow was already pinned here, and only the starter template and the README changed after it.

Nothing else pinned here changed. No breaking change touches this repo. Most checks (CI, Test, Quality, the SAST and zizmor jobs, kind smoke test) were still running when I looked. gitleaks, osv-scanner and snyk are green and nothing has failed.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to 3cca253. dco.yml and mcp-ci.yml also appear in the diff because main pinned them to older digests.

Upstream changes that reach this repo:

• #403 and #404 harden reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. Caller inputs move from run: blocks into env, and downloaded tool binaries are checksum-verified. These are internal changes; the inputs this repo passes (build-paths, enable-sonar, working-directory, node-version, run-on-private) are unchanged.
• #405 adds reusable-dco.yml, which dco.yml already uses.
• #418 bumps FerrFlow to v7.35.3 in reusable-ferrflow-release.yml. release.yml only passes dry-run and the dispatch token, so the new version is not exercised by PR CI. Any problem would show up on the next release run.

Checks on the head commit are green: CI Build, Lint, Test and Security, Secrets + CVE scans, zizmor, gitleaks, osv-scanner, DCO and the kind smoke test. The skipped SonarQube jobs and one cancelled duplicate sign-off run are not failures.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to ca4906e. dco.yml and mcp-ci.yml are now in the diff only because main pinned them to older digests.

What changed upstream that reaches this repo:

• #404 moves caller inputs out of run: blocks into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. This is injection hardening and the inputs keep their names and meaning, so the with: values in ci.yml (build-paths, enable-sonar), mcp-ci.yml and security-scan.yml are unaffected.
• #403 verifies checksums of tool binaries downloaded by reusable-security-scan.yml. A bad checksum would fail the scan, but it passed here.
• #418 bumps the FerrFlow action to v7.35.3 in reusable-ferrflow-release.yml. release.yml passes only dry-run and the secret, so nothing to adapt.
• #405 and #406 add the DCO workflow and a template, #399 and #419 add docker-build and Kani workflows this repo does not pin, #412 is a README edit.

Nothing needs changing here. All 25 checks on the head commit are green or skipped (CI Test/Lint/Security, Test / Quality, security scans, DCO sign-off, kind smoke test). The one cancelled sign-off run is a superseded duplicate; the other one passed.

[ferrfleet-interne]

Re-review: target digest moved from 40aa5d1 (my last approval) to d0c7073. dco.yml and mcp-ci.yml are now in the diff too (they were pinned at 7c84741 and 9796e97 on main).

What reaches this repo:

• #404 and #403 (security hardening): caller inputs moved from ${{ }} in run: blocks into env: vars in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. Unquoted $VAR keeps the same word-splitting as before. The values passed here (build-paths: ./cmd/..., node/pnpm script names) contain no shell metacharacters, so behaviour is unchanged. The security scan now verifies SHA256 of the gitleaks, osv-scanner, opengrep and trufflehog binaries, and pins the opengrep rules to a commit instead of main. trufflehog is now installed from a pinned release rather than the main install script.
• #418: reusable-ferrflow-release.yml moves to FerrFlow v7.35.3 (a patch-level Renovate bump).
• #405: adds reusable-dco.yml, already pinned by dco.yml on main and unchanged since.

Not relevant here: #419 (Kani workflow), #421 (lfs input on reusable-ci-rust.yml), docs and starter-template commits. reusable-pr-title.yml is unchanged.

CI on the head commit was still queued or running when I looked, with nothing failed. The checksum steps are the one thing worth watching in the Secrets + CVE jobs, but a mismatch would show as a clear sha256sum failure.