Commits on Aug 13, 2026

1. fix(deps): update go dependencies (non-major) (#111)

   Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

   

   renovate[bot] authored Aug 13, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 8ae6fcf
   • Browse repository at this point

   Copy the full SHA

   8ae6fcf View commit details

   Browse the repository at this point in the history

2. Enable Renovate automerge (#109)

   * Enable Renovate automerge for non-major RIE dependency bumps
   
   Automerge non-major gomod bumps (minor/patch), Go-toolchain bumps, and
   non-major GitHub Actions updates so Go-dep/stdlib CVE fixes land without
   manual review. Security updates get their own ungrouped, automerged path
   via vulnerabilityAlerts so a CVE fix is never blocked behind the grouped
   batch. Majors stay manual (automerge explicitly set to false).
   
   Automerge still waits for green CI before merging.
   
   * Add Renovate cooldown for non-security dependency updates
   
   * Pin Renovate automerge strategy to squash
   
   * Add Trivy dependency scan as a PR quality gate

   

   carole-lavillonniere authored Aug 13, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 87ea526
   • Browse repository at this point

   Copy the full SHA

   87ea526 View commit details

   Browse the repository at this point in the history

3. Weekly publish of pre-release (#108)

   * Add weekly auto-release workflow for the LocalStack RIE
   
   Cut a new patch release once a week when there are new commits on
   localstack, so Go-dep/stdlib CVE fixes self-publish without a manual tag.
   
   - weekly-release.yml: Friday cron + workflow_dispatch; discovers the latest
     published release, patch-bumps, skips if no new commits, then calls build.yml.
   - build.yml: add workflow_call with an optional version input so the same
     test -> build -> release path publishes the computed version (no PAT needed).
   
   * Push the release tag after tests and build
   
   * Publish weekly releases as pre-releases pending validation
   
   * Correct stale scheduling rationale in weekly-release comment
   
   * Alert the team on Slack when the weekly release fails
   
   * Document the weekly auto-release and promotion flow

   

   carole-lavillonniere authored Aug 13, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 3cf0464
   • Browse repository at this point

   Copy the full SHA

   3cf0464 View commit details

   Browse the repository at this point in the history

4. chore(renovate): enable updates for indirect Go dependencies (#118)

   Renovate's gomod manager skips deps marked `// indirect` unless a rule
   enables them, so transitive modules were never proposed for update. That
   is where Go CVEs usually land.
   
   golang.org/x/net is the current example: v0.56.0 has been available since
   2026-06-09 and fixes CVE-2026-46600 (HIGH), but go.mod still pins v0.55.0
   because the dep is indirect. The last bump to v0.55 (#110) was hand-written
   for the same reason.
   
   The new rule only sets `enabled`, so the grouping and automerge from the
   "Go dependencies (non-major)" rule still apply, and it is placed before the
   major rule so major bumps stay disabled.
   
   Validated with renovate-config-validator.

   

   carole-lavillonniere authored Aug 13, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 4a8b502
   • Browse repository at this point

   Copy the full SHA

   4a8b502 View commit details

   Browse the repository at this point in the history

5. chore(deps): update go dependencies (non-major) (#119)

   Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

   

   renovate[bot] authored Aug 13, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for f26ee0e
   • Browse repository at this point

   Copy the full SHA

   f26ee0e View commit details

   Browse the repository at this point in the history