Phase 20a: Dependency Scanning (Renovate)

phase-platform-20a-dependency-scanning Phase

phase

Project

Phase 20a: Dependency Scanning (Renovate)

Goal: Automated dependency update PRs across all repos via Renovate. Absorbs scope from Phase 11 (deferred).

Owner: Dev agent

Repo: forgejo_admin/pal-e-platform (Renovate deployment) + per-repo renovate.json configs

Depends on: Phase 6 (CI Pipeline — Renovate PRs need CI validation)

DORA: CFR — automated dependency updates reduce the risk of running vulnerable or outdated packages.

Scope

Deploy Renovate as a CronJob in k3s (self-hosted, not SaaS)
Forgejo integration via API token + scheduled scan (no webhook needed)
Per-repo renovate.json: automerge patch, PR for minor/major
Group related updates (e.g., all Terraform providers in one PR, all Python deps in one PR)
Dashboard issue in each repo tracking pending updates
Grafana panel: dependency freshness across repos

Deliverables

TBD — filled after completion

phase-platform-20-security-deepening — parent phase
phase-pal-e-platform-dependency-scanning — Phase 11 (deferred, this subphase absorbs its scope)
plan-pal-e-platform — parent plan