feat(gate): L0 automerge gate with customer-shipping human-signoff floor

Andrew Dunnrequested to merge
renovate/l0-gate-public-sector into main

Summary

Adds the L0 CI verification gate to the catalog: two composable CI/CD components that let Renovate automerge be a consequence of how much a project's CI can vouch for, with a hard human-signoff floor for customer-shipping artifacts.

Components

  • osv-verdict runs osv-scanner in PR-diff mode (only newly-introduced findings fail on an MR; pre-existing findings do not block an unrelated bump) and emits CHECK_OSV=pass|fail as a dotenv verdict. osv-scanner installs as a checksum-verified binary release on the ci-tools image, matching the catalog idiom used for cosign, syft, glab, and yq. osv-scanner exit 128 (no scannable sources) maps to clean; real scan errors fail closed.

  • automerge-gate is the terminal, fail-closed decision job. GitLab cannot gate automerge on a named check, so the decision must live in a terminal CI job. The gate consumes per-check dotenv verdicts over needs: (optional: true + artifacts: true) and blocks unless every required check is present and pass. v1 required check: OSV.

Customer-shipping work-floor

Artifacts that ship to a customer (base images, released components) always require human signoff. They never silently automerge, regardless of CI gate or agent confidence. This is enforced as a hard floor:

  • customer_shipping defaults to true. When set, the gate evaluates and prints the verdict for an audit trail, then always routes the update to the human lane and exits nonzero. Confidence can only ever downgrade to human review, never upgrade past the floor.
  • Only non-shipping classes (internal toolchain, dev tooling, lockfile) set customer_shipping: false and become automerge-eligible on a green gate.

The floor is enforced at two layers: this gate, and the shared preset (renovate-config.json) keeping platformAutomerge: false estate-wide. Both must agree before any dependency merges without a human, and the automerge flip remains intentionally deferred.

Validation

  • renovate-config-validator --strict passes on renovate-config.json, renovate.json, and presets/renovate.json.
  • scripts/lint-templates.py passes on all 20 templates including the two new ones (v2 canonical shape).

Proof on this pipeline

sim-automerge-gate exercises the seam end-to-end on this MR's own pipeline: sim-osv-verdict emits CHECK_OSV, sim-gate-nonshipping consumes it and goes green, and sim-gate-shipping confirms the customer-shipping floor routes to the human lane even when the check is green (its nonzero exit is the expected behavior and is allow_failure).

Review note

Review-gated estate: this MR is opened for human review and is not set to automerge.

Merge request reports