feat(renovate): add coverage check for Bazel http_archive deps

Adds a CI lint that fails any PR introducing or modifying an
`http_archive(...)` block in `deps/repos.MODULE.bazel` without a
corresponding `customManager` entry in `renovate.json`.

Without this check, native deps (openssl, krb5, libxml2, …) drift silently
behind upstream — Renovate's `bazel-module` manager only covers
`bazel_dep(...)` declarations from the BCR registry, not the
`http_archive(...)` calls used for natives. None of the 29 such deps in
the repo are tracked today.

Pieces:
- `tasks/renovate.py::check_bazel_coverage` — invoke task that diffs the
  set of `http_archive(name=...)` entries in the bazel module file
  against `customManagers[].depNameTemplate` in `renovate.json`, minus
  an explicit allowlist. Writes a markdown report to
  `$GITHUB_STEP_SUMMARY` on failure.
- `deps/.renovate-untracked.json` — typed allowlist with non-empty
  rationale strings. Currently lists all 29 deps as pending tracking;
  follow-up PRs will move each entry from this file into a
  customManager in `renovate.json`.
- `.github/workflows/validate-renovate-deps.yml` — runs the task on
  PRs touching `deps/`, `renovate.json`, or the task itself.

Run locally with `dda inv -- renovate.check-bazel-coverage`.

Author: chouetz

.github/workflows/validate-renovate-deps.yml

@@ -0,0 +1,23 @@
+---
+name: "Validate Renovate coverage of Bazel native deps"
+on:
+  pull_request:
+    paths:
+      - "deps/**"
+      - "renovate.json"
+      - "tasks/renovate.py"
+      - ".github/workflows/validate-renovate-deps.yml"
+
+permissions: {}
+
+jobs:
+  check_coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Install dda
+        uses: ./.github/actions/install-dda
+        with:
+          features: legacy-tasks
+      - name: Verify every http_archive in deps/ has Renovate coverage
+        run: dda inv -- renovate.check-bazel-coverage

deps/.renovate-untracked.json

@@ -0,0 +1,34 @@
+{
+  "_comment": "Bazel http_archive deps in deps/repos.MODULE.bazel that intentionally have no Renovate customManager. Every entry MUST include a non-empty rationale. The check is enforced by tasks/check_renovate_bazel_coverage.py and the validate-renovate-deps.yml workflow. As deps move from this allowlist to a customManager in renovate.json, remove the entry here in the same PR.",
+  "intentionally_untracked": {
+    "xz": "Pending tracking in Phase 2a (github-releases batch).",
+    "zlib": "Pending tracking in Phase 2a (github-releases batch).",
+    "openssl": "Pending tracking in Phase 2a (github-releases batch). Blocked by openssl drift cleanup (AIX 3.5.5, MSI 3.5).",
+    "libffi": "Pending tracking in Phase 2a (github-releases batch).",
+    "pcre2": "Pending tracking in Phase 2a (github-releases batch).",
+    "util-linux": "Pending tracking in Phase 2a (github-releases batch).",
+    "libseccomp": "Pending tracking in Phase 2a (github-releases batch).",
+    "patchelf": "Pending tracking in Phase 2a (github-releases batch).",
+    "nghttp2": "Pending tracking in Phase 2a (github-releases batch).",
+    "popt": "Pending tracking in Phase 2a (github-releases batch).",
+    "libyaml": "Pending tracking in Phase 2a (github-releases batch).",
+    "zstd": "Pending tracking in Phase 2a (github-releases batch).",
+    "lua": "Pending tracking in Phase 2a (github-releases batch).",
+    "xmlsec": "Pending tracking in Phase 2a (github-releases batch).",
+    "krb5": "Pending tracking in Phase 2b (tricky-tag batch — tag krb5-X.Y.Z-final differs from tarball).",
+    "rpm": "Pending tracking in Phase 2b (tricky-tag batch — strip_prefix is rpm-rpm-X.Y.Z-release).",
+    "systemd": "Pending tracking in Phase 2b (tricky-tag batch — single-integer versioning, loose).",
+    "libsepol": "Pending tracking in Phase 2b (SELinux monorepo).",
+    "libselinux": "Pending tracking in Phase 2b (SELinux monorepo).",
+    "openssl_fips": "Pending tracking in Phase 2b. Will be added with `enabled: false` — pinned to 3.0.9 for FIPS 140-2 validation, must NOT auto-update.",
+    "libxml2": "Pending tracking in Phase 2c (GitLab-tags batch).",
+    "libxslt": "Pending tracking in Phase 2c (GitLab-tags batch).",
+    "dbus": "Pending tracking in Phase 2c (GitLab-tags batch).",
+    "sqlite3": "Hard: version is split across a tuple (sqlite_ver = (\"3\", \"53\", \"00\")) and embeds a release-year directory in the URL. Needs a refactor to a single literal before a Renovate regex can target it cleanly. Phase 3.",
+    "bzip2": "Hard: sourceware.org tarballs; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "attr": "Hard: hosted on Savannah (savannah.nongnu.org); no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "gpg-error": "Hard: hosted on gnupg.org FTP; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "gcrypt": "Hard: hosted on gnupg.org FTP; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "unixodbc": "Hard: hosted on unixodbc.org; no native Renovate datasource. Needs a customDatasource. Phase 3."
+  }
+}

tasks/__init__.py

@@ -69,6 +69,7 @@
     python_version,
     quality_gates,
     release,
+    renovate,
     rtloader,
     sbomgen,
     schema,
@@ -240,6 +241,7 @@
 ns.add_collection(setup)
 ns.add_collection(systray)
 ns.add_collection(release)
+ns.add_collection(renovate)
 ns.add_collection(rtloader)
 ns.add_collection(system_probe)
 ns.add_collection(process_agent)

tasks/renovate.py

@@ -0,0 +1,108 @@
+"""
+Renovate maintenance tasks.
+
+So far this module exposes a single check that verifies every native dep in
+``deps/repos.MODULE.bazel`` is either tracked by a Renovate ``customManager`` in
+``renovate.json`` or listed in ``deps/.renovate-untracked.json`` with a
+rationale. It runs in CI via ``.github/workflows/validate-renovate-deps.yml``.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+from pathlib import Path
+
+from invoke import task
+from invoke.context import Context
+from invoke.exceptions import Exit
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+MODULE_FILE = REPO_ROOT / "deps" / "repos.MODULE.bazel"
+RENOVATE_FILE = REPO_ROOT / "renovate.json"
+ALLOWLIST_FILE = REPO_ROOT / "deps" / ".renovate-untracked.json"
+
+HTTP_ARCHIVE_NAME_RE = re.compile(r'http_archive\s*\(\s*name\s*=\s*"([^"]+)"')
+
+
+def _parse_module_bazel(path: Path) -> set[str]:
+    return set(HTTP_ARCHIVE_NAME_RE.findall(path.read_text()))
+
+
+def _parse_renovate_json(path: Path) -> set[str]:
+    raw = path.read_text()
+    # renovate.json is JSON5 (trailing commas allowed); strip them so json.loads accepts.
+    stripped = re.sub(r",(\s*[}\]])", r"\1", raw)
+    data = json.loads(stripped)
+    return {cm["depNameTemplate"] for cm in data.get("customManagers", []) if "depNameTemplate" in cm}
+
+
+def _parse_allowlist(path: Path) -> dict[str, str]:
+    if not path.exists():
+        return {}
+    data = json.loads(path.read_text())
+    entries = data.get("intentionally_untracked", {})
+    bad = [k for k, v in entries.items() if not (isinstance(v, str) and v.strip())]
+    if bad:
+        raise Exit(
+            f"Allowlist {path} has empty rationale for: {', '.join(bad)}. "
+            "Every entry must include a non-empty justification string."
+        )
+    return entries
+
+
+def _emit_failure_report(untracked: set[str], allowlist: dict[str, str]) -> str:
+    lines = [
+        "## ❌ Renovate coverage check failed",
+        "",
+        f"The following deps in `{MODULE_FILE.relative_to(REPO_ROOT)}` have no "
+        f"matching `customManager` in `renovate.json`:",
+        "",
+        "| dep | suggested fix |",
+        "|---|---|",
+    ]
+    for dep in sorted(untracked):
+        lines.append(
+            f"| `{dep}` | Add a `customManagers` entry with "
+            f'`depNameTemplate: "{dep}"`, or add to '
+            "`deps/.renovate-untracked.json` with a rationale. |"
+        )
+    lines += [
+        "",
+        "See `renovate.json` for existing patterns (linux-images, windows-images, ...).",
+        "",
+        f"Currently allowlisted ({len(allowlist)}): "
+        + (", ".join(f"`{k}`" for k in sorted(allowlist)) if allowlist else "_none_"),
+    ]
+    return "\n".join(lines)
+
+
+@task
+def check_bazel_coverage(_: Context) -> None:
+    """
+    Fail if any http_archive in deps/repos.MODULE.bazel lacks a Renovate customManager.
+
+    A dep is considered covered when either:
+      * its name appears as `depNameTemplate` in one of `renovate.json`'s customManagers, or
+      * it is listed in `deps/.renovate-untracked.json` with a non-empty rationale.
+
+    Writes a markdown report to ``$GITHUB_STEP_SUMMARY`` when running in GitHub Actions.
+    """
+    bazel_names = _parse_module_bazel(MODULE_FILE)
+    tracked_names = _parse_renovate_json(RENOVATE_FILE)
+    allowlist = _parse_allowlist(ALLOWLIST_FILE)
+
+    untracked = bazel_names - tracked_names - set(allowlist)
+    if untracked:
+        report = _emit_failure_report(untracked, allowlist)
+        summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+        if summary_path:
+            Path(summary_path).write_text(report + "\n", encoding="utf-8")
+        raise Exit(report, code=1)
+
+    print(
+        f"OK: {len(bazel_names)} http_archive deps, "
+        f"{len(bazel_names) - len(allowlist)} tracked by Renovate, "
+        f"{len(allowlist)} intentionally untracked."
+    )