Improve renovate

CHANGELOG.md

@@ -11,6 +11,7 @@
 
 ### Fixed
 - Fixed Cargo Deny failure with updating to version 0.19.1 ([#1140](https://github.com/opendevstack/ods-quickstarters/issues/1140))
+- Moving tokens into Kubernetes Secrets and narrowing permissions
 
 ## [4.12.1] - 2026-03-16
 ### Fixed

docs/modules/quickstarters/pages/renovate.adoc

@@ -0,0 +1,40 @@
+= Renovate
+
+== Purpose of this quickstarter
+
+Use this for automating dependency updates in software projects. Lives in your cd-namespace.
+
+== What files / which architecture is generated?
+
+----
+├── README.md
+├── chart
+│   ├── Chart.lock
+│   ├── Chart.yaml
+│   ├── charts
+│   │   └── renovate-46.8.4.tgz
+│   ├── templates
+│   │   ├── configmap.yaml
+│   │   └── secret.yaml
+│   ├── values.yaml
+│   └── values.yaml.secret.example
+├── import-certs.sh
+├── metadata.yml
+└── release-manager.yml
+----
+
+== Frameworks used
+
+* https://docs.renovatebot.com[Renovate]
+
+== Usage - How do you start after you provisioned this quickstarter?
+
+See README.
+
+== Jenkins agent image used
+
+ods/jenkins-agent-base:4.x
+
+== Known limitations
+
+Let us know if you find any. Feel free to open issues and pull requests, thank you!

renovate/Dockerfile.template

@@ -12,9 +12,14 @@ COPY import-certs.sh /usr/local/bin/import-certs.sh
 RUN chmod +x /usr/local/bin/import-certs.sh
 
 # Required for import-certs.sh and update-ca-certificates to work at runtime
-RUN chmod -R 777 /usr/local/share/ca-certificates && \
-    chmod 777 /etc/ssl/certs && \
-    chmod 666 /etc/ca-certificates.conf
+# Recursive only on /usr/local/share/ca-certificates (needs to write cert files there).
+# /etc/ssl/certs and /etc/ca-certificates.conf: directory/file ownership only — existing
+# system cert files stay root-owned, limiting write surface if container is compromised.
+# ca-certificates.crt is the bundle output file rewritten by update-ca-certificates — must be writable.
+RUN chown -R 12021 /usr/local/share/ca-certificates \
+    && chown 12021 /etc/ssl/certs \
+    && chown 12021 /etc/ssl/certs/ca-certificates.crt \
+    && chown 12021 /etc/ca-certificates.conf
 
 # This is required because Node.js doesn't use the system CA store by default
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt    
@@ -23,4 +28,4 @@ ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
 USER 12021
 
 # Debug mode: set -x to show all commands in logs for troubleshooting
-ENTRYPOINT [ "/bin/sh", "-c", "set -x; /usr/local/bin/import-certs.sh && exec /usr/local/sbin/renovate-entrypoint.sh" ]
+ENTRYPOINT [ "/bin/sh", "-c", "set -x; /usr/local/bin/import-certs.sh && exec /usr/local/sbin/renovate-entrypoint.sh" ]

renovate/files/chart/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: renovate
-  repository: https://docs.renovatebot.com/helm-charts
-  version: 45.71.2
-digest: sha256:c90afb616b7e68bea19917cb126b6e5b3e521c4e3cd72f28b3758a5219801509
-generated: "2026-01-12T08:38:13.079663+01:00"
+  repository: oci://ghcr.io/renovatebot/charts
+  version: 46.8.4
+digest: sha256:7d84ee87486bae4ec4ea6698390f686017f8e0c278fd2f6ee4a83cd992149465
+generated: "2026-06-15T08:26:49.837033+02:00"

renovate/files/chart/templates/secret.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.github.token }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: renovate-github-token
+type: Opaque
+stringData:
+  GITHUB_TOKEN: {{ .Values.github.token | quote }}
+{{- end }}

renovate/files/chart/values.yaml

@@ -29,6 +29,12 @@ renovate:
         secretKeyRef:
           name: cd-user-with-password
           key: password
+    - name: GITHUB_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: renovate-github-token
+          key: GITHUB_TOKEN
+          optional: true
 
   # -- Additional volumes to the pod
   extraVolumes:
@@ -51,3 +57,8 @@ renovate:
       cache:
         # -- Allow the cache to persist between runs
         enabled: false
+
+# -- GitHub token for renovate. If set, creates a secret `renovate-github-token`.
+# DO NOT SET IN HERE, THIS FILE IS NOT ENCRYPTED! USE values.yaml.secret
+github:
+  token: ""

renovate/files/chart/values.yaml.secret.example

@@ -1,4 +1,4 @@
-renovate:
-  env:
-    # Used to pull the release changelog from GitHub
-    GITHUB_TOKEN: ""
+github:
+  # Used to pull the release changelog from GitHub.
+  # Stored in a Kubernetes Secret (renovate-github-token) and injected via secretKeyRef.
+  token: ""