[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
FerrLabs/.github (changelog)	workflow	digest	39502a0 → be40b72

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Digest-only bump of FerrLabs/.github (39502a0 → e056bc5) across the four reusable workflow refs in ci.yml, pr-title.yml, release.yml, security-scan.yml.

There is exactly one commit between the two SHAs (FerrLabs/.github#361, "resolve ferrlabs-* crates from crates.io instead of Kellnr"), and it only touches default.json and snippets/deny.toml — the Renovate preset and a cargo-deny snippet. None of the four reusable workflow files this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed content at all between the old and new digest. So there's nothing for this repo's CI to actually pick up from the bump.

Note this repo's renovate.json extends github>FerrLabs/.github unpinned, so the crates.io-vs-Kellnr resolution change already applies to FerrVault's own Renovate runs regardless of this PR — it's not gated by this digest bump.

Checks running at review time are green where completed, nothing failed.

[ferrfleet]

Re-review: Renovate moved the target digest since my last approval (was 39502a0→e056bc5, now 39502a0→b6a08e6), so this is a fresh diff, not a no-op rebase.

Of the four reusable workflows this repo pins, two (reusable-pr-title.yml, reusable-security-scan.yml) are byte-identical between old and new digest. The other two have real content changes, both benign for this repo:

• reusable-ci-go.yml: added continue-on-error: true to the two coverage-artifact upload steps (with a comment explaining a flaky upload shouldn't fail the gate). Only loosens a failure mode, doesn't affect ci.yml's build-paths/enable-sonar usage.
• reusable-ferrflow-release.yml: bumps the pinned FerrLabs/FerrFlow action v7.21.7 → v7.25.0 and adds an optional tag-signing feature (new TAG_SIGNING_KEY secret, tag_signing_key/name/email inputs). release.yml:15-19 only passes FERRLABS_DISPATCH_TOKEN and sets no TAG_SIGNING_NAME/TAG_SIGNING_EMAIL vars, so signing stays disabled here — no-op for this repo.

Checks completed so far (gitleaks, osv-scanner, PR title, snyk, zizmor) are all green; CI Test/Lint/Security, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: Renovate moved the target digest again since my last approval (was 39502a0→b6a08e6, now 39502a0→42a0645), so this is a new diff.

Of the four reusable workflows this repo pins, three (reusable-ci-go.yml, reusable-pr-title.yml, reusable-security-scan.yml) are byte-identical to the versions I already reviewed at b6a08e6. Only reusable-ferrflow-release.yml changed further:

• Adds an opt-in crates-io-trusted-publishing input plus a rust-lang/crates-io-auth-action step, and switches CARGO_REGISTRY_TOKEN from the static secrets.CARGO_FERRLABS_REGISTRY_TOKEN to that step's OIDC-minted output (only populated when the new input is true).
• release.yml:15-18 in this repo doesn't set crates-io-trusted-publishing and doesn't pass secrets: inherit or CARGO_FERRLABS_REGISTRY_TOKEN, so CARGO_REGISTRY_TOKEN was empty before this change and stays empty after — no-op here. This repo's .ferrflow also sets deferPublish: true, and crates.io publish actually happens through this repo's own .github/workflows/publish.yml, not through the reusable release workflow's token at all.

Checks on the head commit were still in progress at review time (CI, Secrets+CVE scans, kind smoke test); nothing has failed so far.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→42a0645, now 39502a0→1a21d234c).

Only one commit separates the two: FerrLabs/.github#382, "build fuzz targets for the toolchain host, not cargo-fuzz's own triple," which touches only reusable-fuzz-rust.yml. None of the four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed. No-op for this repo.

All completed checks on the head commit are green (CI Security, gitleaks, osv-scanner, snyk, zizmor, PR title); CI Test/Lint, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→1a21d23, now 39502a0→6b7ce7f).

One commit separates the two: FerrLabs/.github#383, "chore(renovate): resolve @FerrLabs packages from npmjs". It touches default.json plus reusable-ci-node.yml and reusable-ci-astro.yml. All four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) are byte-identical between the two digests, as is .github/actions/. No-op for FerrVault's CI.

As before, this repo's renovate.json extends github>FerrLabs/.github unpinned, so the npmjs preset change already applies to FerrVault's Renovate runs independently of this digest bump.

Completed checks on the head commit are green (gitleaks, osv-scanner, snyk, PR title, CI Detect Go module); CI Test/Lint/Security, opengrep, zizmor and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→6b7ce7f, now 39502a0→30bd2ef).

Two commits separate them, both touching only default.json:

• FerrLabs/.github#385, widens the Renovate Dockerfile schedule from before 6am on monday to on monday.
• FerrLabs/.github#386, rewords that rule's description only.

None of the four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed, nor did .github/actions/. No-op for FerrVault's CI. As before, this repo's renovate.json extends github>FerrLabs/.github unpinned, so the schedule change already applies to FerrVault's Renovate runs independently of this digest bump.

Completed checks on the head commit are green (gitleaks, osv-scanner, snyk, zizmor, PR title, CI Detect Go module); CI Test/Lint/Security, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet-interne]

Re-review: since my last approval the target digest moved from 12a610e to 3e9da88, and mcp-ci.yml has joined the diff (it goes from 9796e97 to 3e9da88).

Upstream, 9796e97...3e9da88 changes only reusable-ci-rust.yml (#395, #397) and reusable-ci-node.yml (#396). The node change is the only one that reaches this repo. mcp-ci.yml sets enable-audit: true, so with this bump a failure of npm's bulk advisory endpoint now produces a warning and skips the audit step instead of failing it. A real vulnerability exit still fails. That is a small loosening of the gate, but osv-scanner still covers dependency CVEs in the security scan, and it is the intended upstream behaviour. Nothing else this repo pins changed. I did not check CI status on the head commit.

[ferrfleet-interne]

Re-review: the target digest moved from 3e9da88 (my last approval) to 2c2284f.

There is one commit between them, FerrLabs/.github#398. It only adds an optional SNYK_TOKEN entry under secrets: in reusable-security-scan.yml. security-scan.yml here passes secrets: inherit, so the token still reaches the workflow. Declaring it explicitly is harmless for this repo. None of the other pinned workflows changed. I did not check CI status on the head commit.

[ferrfleet-interne]

Re-review: the target digest moved from 2c2284f (my last approval) to 40aa5d1.

One commit separates them, FerrLabs/.github#399, and it changes only reusable-docker-build.yml (adds an optional maxmind license build secret). FerrVault does not pin that workflow, and none of the five it does pin changed, so this bump does nothing to its CI. Checks on the head commit were still running when I looked. Nothing had failed.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to 6cbce94.

One commit separates them, FerrLabs/.github#404. It moves ${{ inputs.* }} interpolation out of run: blocks into env: vars in reusable-ci-go.yml, reusable-ci-node.yml, reusable-security-scan.yml and the sast-external-issues action, among others. This is template-injection hardening, and the expansion stays unquoted, so word splitting and globbing work as before. The inputs this repo passes (build-paths: ./cmd/..., madge-paths: packages/*/src, install-args: "", plus defaults) expand the same way under the new form. There's no behaviour change for FerrVault's CI.

Checks on the head commit were still running when I looked. The ones that had finished (snyk, PR title, Detect Go module) passed.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to 660965a. dco.yml has also joined the diff, going from 7c84741 to 660965a.

Three upstream commits separate them:

• #404 moves caller inputs out of run: blocks and into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. The variables are still expanded unquoted, so word splitting and globbing behave as before. That covers madge-paths: packages/*/src in mcp-ci.yml and build-paths: ./cmd/... in ci.yml.
• #405 adds reusable-dco.yml. reusable-dco.yml is byte-identical between 7c84741 and 660965a, so the dco.yml re-pin is a no-op.
• #403 adds sha256 checks for the gitleaks, osv-scanner, opengrep and trufflehog downloads in reusable-security-scan.yml. It also pins the opengrep-rules tarball to a commit and replaces trufflehog's curl | sh installer with a pinned 3.99.7 release. This tightens supply-chain checks. The one new failure mode: if an upstream asset changes, the scan fails at install. That is the point of the change.

reusable-pr-title.yml and reusable-ferrflow-release.yml did not change. Checks on the head commit were still running when I looked. A duplicate sign-off run was cancelled by the DCO concurrency group and one PR title run was skipped; nothing had failed.

[ferrfleet-interne]

Re-review: since my last approval the target digest moved from 40aa5d1 to fbe42a0, and dco.yml has joined the diff (7c84741 → fbe42a0).

There are four upstream commits between those digests. Two of them reach this repo:

• FerrLabs/.github#404 moves caller inputs out of run: blocks and into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. The variables stay unquoted, so word splitting and globbing work as before. build-paths: ./cmd/... and madge-paths: packages/*/src expand the same way they did.
• FerrLabs/.github#403 adds sha256 checks for gitleaks, osv-scanner and opengrep. It also pins opengrep-rules to a fixed commit and swaps trufflehog's curl | sh installer for a release tarball whose checksum is verified. The gitleaks and osv-scanner jobs on the head commit passed, so those checksums match.

#405 only adds reusable-dco.yml (already pinned on main) and #406 only touches workflow-templates/. reusable-dco.yml is the same at both digests.

On the head commit, the finished checks are green, and that includes sign-off and MCP Test & Build. CI Test/Lint/Security, opengrep and the kind smoke test were still running when I looked.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to fbe42a0, and dco.yml has joined the diff (7c84741 → fbe42a0).

The four upstream commits in between are #403, #404, #405 and #406. Here is what reaches this repo:

• reusable-ci-go.yml, reusable-ci-node.yml, reusable-security-scan.yml (#404): caller inputs move from inline ${{ }} in run: into env: vars, still expanded unquoted. Behaviour is unchanged for the plain values this repo passes (./cmd/... and so on).
• reusable-security-scan.yml and the sast-external-issues action (#403): add sha256 checks for gitleaks, osv-scanner, opengrep and trufflehog, pin trufflehog to v3.99.7 instead of piping install.sh from main, and pin opengrep-rules to a commit. This tightens the supply chain. The scan will fail if an upstream asset is ever re-uploaded, which is the point of the check.
• reusable-dco.yml is byte-identical between 7c84741 and fbe42a0, so dco.yml only re-pins.
• default.json gains a Renovate Signed-off-by commit body. It already applies here, because renovate.json extends the preset unpinned.

reusable-pr-title.yml and reusable-ferrflow-release.yml did not change. Checks were still running at review time. PR title and snyk passed. One sign-off run shows cancelled, with a newer one pending.

[ferrfleet-interne]

Re-review: the target digest moved from 40aa5d1 (my last approval) to be40b72. The diff now also re-pins dco.yml (7c84741 to be40b72).

Upstream changes between them that reach this repo:

• #404 moves caller inputs out of run: blocks into env: in reusable-ci-go.yml, reusable-ci-node.yml and reusable-security-scan.yml. I read the node and security-scan versions at the new SHA. The env-var forms ($PKG_MANAGER install $INSTALL_ARGS, $SCRIPT_RUNNER $TEST_SCRIPT) still word-split, so mcp-ci.yml's multi-word script-runner/install-args keep working. I did not read the Go file; the change there follows the same pattern.
• #403 adds sha256sum -c verification for the gitleaks, osv-scanner, opengrep and trufflehog downloads in reusable-security-scan.yml. This only fails if a pinned checksum is wrong. gitleaks and osv-scanner already passed on this head commit.
• #405/#406 are DCO-related: the reusable DCO workflow was already pinned here, and only the starter template and the README changed after it.

Nothing else pinned here changed. No breaking change touches this repo. Most checks (CI, Test, Quality, the SAST and zizmor jobs, kind smoke test) were still running when I looked. gitleaks, osv-scanner and snyk are green and nothing has failed.