feat(renovate): add coverage check for Bazel http_archive deps

.github/workflows/validate-renovate-deps.yml

@@ -0,0 +1,21 @@
+---
+name: "Validate Renovate coverage of Bazel native deps"
+on:
+  pull_request:
+    paths:
+      - "deps/**"
+      - "renovate.json"
+      - "tasks/renovate.py"
+      - "tasks/BUILD.bazel"
+      - ".github/workflows/validate-renovate-deps.yml"
+
+permissions: {}
+
+jobs:
+  check_coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/bazel-cache
+      - name: Verify every http_archive/http_file in deps/ has Renovate coverage
+        run: bazel run //tasks:check_renovate_bazel_coverage

deps/.renovate-untracked.json

@@ -0,0 +1,59 @@
+{
+  "_comment": "Bazel http_archive and http_file deps in any deps/**/*.MODULE.bazel file that intentionally have no Renovate customManager. Every entry MUST include a non-empty rationale. The check is enforced by tasks/check_renovate_bazel_coverage.py and the validate-renovate-deps.yml workflow. As deps move from this allowlist to a customManager in renovate.json, remove the entry here in the same PR.",
+  "intentionally_untracked": {
+    "xz": "Pending tracking in Phase 2a (github-releases batch).",
+    "zlib": "Pending tracking in Phase 2a (github-releases batch).",
+    "openssl": "Pending tracking in Phase 2a (github-releases batch). Blocked by openssl drift cleanup (AIX 3.5.5, MSI 3.5).",
+    "libffi": "Pending tracking in Phase 2a (github-releases batch).",
+    "pcre2": "Pending tracking in Phase 2a (github-releases batch).",
+    "util-linux": "Pending tracking in Phase 2a (github-releases batch).",
+    "libseccomp": "Pending tracking in Phase 2a (github-releases batch).",
+    "patchelf": "Pending tracking in Phase 2a (github-releases batch).",
+    "nghttp2": "Pending tracking in Phase 2a (github-releases batch).",
+    "popt": "Pending tracking in Phase 2a (github-releases batch).",
+    "libyaml": "Pending tracking in Phase 2a (github-releases batch).",
+    "zstd": "Pending tracking in Phase 2a (github-releases batch).",
+    "lua": "Pending tracking in Phase 2a (github-releases batch).",
+    "xmlsec": "Pending tracking in Phase 2a (github-releases batch).",
+    "krb5": "Pending tracking in Phase 2b (tricky-tag batch — tag krb5-X.Y.Z-final differs from tarball).",
+    "rpm": "Pending tracking in Phase 2b (tricky-tag batch — strip_prefix is rpm-rpm-X.Y.Z-release).",
+    "systemd": "Pending tracking in Phase 2b (tricky-tag batch — single-integer versioning, loose).",
+    "libsepol": "Pending tracking in Phase 2b (SELinux monorepo).",
+    "libselinux": "Pending tracking in Phase 2b (SELinux monorepo).",
+    "openssl_fips": "Pending tracking in Phase 2b. Will be added with `enabled: false` — pinned to 3.0.9 for FIPS 140-2 validation, must NOT auto-update.",
+    "libxml2": "Pending tracking in Phase 2c (GitLab-tags batch).",
+    "libxslt": "Pending tracking in Phase 2c (GitLab-tags batch).",
+    "dbus": "Pending tracking in Phase 2c (GitLab-tags batch).",
+    "sqlite3": "Hard: version is split across a tuple (sqlite_ver = (\"3\", \"53\", \"00\")) and embeds a release-year directory in the URL. Needs a refactor to a single literal before a Renovate regex can target it cleanly. Phase 3.",
+    "bzip2": "Hard: sourceware.org tarballs; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "attr": "Hard: hosted on Savannah (savannah.nongnu.org); no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "gpg-error": "Hard: hosted on gnupg.org FTP; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "gcrypt": "Hard: hosted on gnupg.org FTP; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "unixodbc": "Hard: hosted on unixodbc.org; no native Renovate datasource. Needs a customDatasource. Phase 3.",
+    "acl": "Pending tracking. Hosted on Savannah (download.savannah.nongnu.org); needs a customDatasource. Phase 3.",
+    "curl": "Pending tracking in Phase 2a (github-releases batch). Tarball is on curl.haxx.se but releases are tagged on github.com/curl/curl.",
+    "cpython": "Pending tracking in Phase 2a (github-releases batch). Released on python.org; corresponding GitHub tags exist at github.com/python/cpython.",
+    "freetds": "Pending tracking in Phase 2a (github-releases batch). Tarballs on freetds.org; releases tagged at github.com/FreeTDS/freetds.",
+    "libpcap": "Pending tracking in Phase 2a (github-releases batch). Tarball on tcpdump.org; releases tagged at github.com/the-tcpdump-group/libpcap.",
+    "nfsiostat": "Pending tracking in Phase 2c. Hosted on kernel.org mirrors (no GitHub mirror with reliable tags). Needs a customDatasource.",
+    "openscap": "Pending tracking in Phase 2a (github-releases batch). Released at github.com/OpenSCAP/openscap.",
+    "setuptools": "Pending tracking in Phase 2a (github-releases batch). Released at github.com/pypa/setuptools.",
+    "compile_policy_x86_64": "Pending tracking in Phase 2a. DataDog/dd-policy-engine GitHub release; will be tracked as one bundle with the arm64 and windows variants since they share VERSION.",
+    "compile_policy_arm64": "Pending tracking in Phase 2a. Shares VERSION with compile_policy_x86_64; tracked together.",
+    "compile_policy_windows_x86_64": "Pending tracking in Phase 2a. Shares VERSION with compile_policy_x86_64; tracked together.",
+    "gstatus_binary": "Pending tracking in Phase 2a (github-releases batch). Released at github.com/gluster/gstatus.",
+    "msodbcsql18_deb_amd64": "Pending tracking. Microsoft .deb package; no native datasource for packages.microsoft.com. Both arches share VERSION and will be tracked as one bundle when a customDatasource is added. Phase 3.",
+    "msodbcsql18_deb_arm64": "Pending tracking. Shares VERSION with msodbcsql18_deb_amd64; tracked together. Phase 3.",
+    "snmp_traps": "Intentionally untracked. Datadog-internal SNMP traps DB published to dd-agent-omnibus S3; no public upstream to watch. Bumped manually when the traps DB is regenerated.",
+    "cacert_pem": "Intentionally untracked. Bumped via a separate Datadog Synthetics-driven workflow (see deps/cacerts/cacerts.MODULE.bazel) that alerts team-agent-build on header changes; auto-PRs from Renovate would race that flow.",
+    "cacert_license": "Intentionally untracked. Mozilla MPL-2.0 license text accompanying cacert_pem; updated together with cacert_pem via the same out-of-band flow.",
+    "sqlite3_license": "Intentionally untracked here — version is pinned via the shared sqlite_ver tuple in deps/repos.MODULE.bazel and will be tracked together with sqlite3 once that refactor lands (see sqlite3 entry).",
+    "sqlite_win": "Intentionally untracked here. Windows-only SQLite amalgamation; pinned to the same release as sqlite3 (manually kept in sync, see TODO in deps/cpython/cpython.MODULE.bazel). Will be folded in with sqlite3 in Phase 3.",
+    "bzip2_win": "Pending tracking. Loop-emitted Windows variant in deps/cpython/cpython.MODULE.bazel; version pinned via the python_src_deps dict alongside the base bzip2. Will be tracked together with bzip2 (Phase 3 customDatasource).",
+    "mpdecimal_win": "Pending tracking. Loop-emitted Windows variant in deps/cpython/cpython.MODULE.bazel; version pinned via the python_src_deps dict. No upstream `mpdecimal` dep exists today — needs its own customManager.",
+    "xz_win": "Pending tracking. Loop-emitted Windows variant in deps/cpython/cpython.MODULE.bazel; version pinned via the python_src_deps dict alongside the base xz. Will be tracked together with xz (Phase 2a).",
+    "zlib_win": "Pending tracking. Loop-emitted Windows variant in deps/cpython/cpython.MODULE.bazel; version pinned via the python_src_deps dict alongside the base zlib. Will be tracked together with zlib (Phase 2a).",
+    "libffi_win": "Pending tracking. Loop-emitted Windows variant in deps/cpython/cpython.MODULE.bazel; version pinned via the python_bin_deps dict. Note: pinned to 3.4.4 (cpython-bin-deps), independent of the base libffi version — must be tracked separately.",
+    "tcltk_win": "Pending tracking. Loop-emitted Windows variant in deps/cpython/cpython.MODULE.bazel; version pinned via the python_bin_deps dict. No upstream `tcltk` dep — needs its own customManager (cpython-bin-deps tags)."
+  }
+}

tasks/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@rules_python//python:py_binary.bzl", "py_binary")
 load("@rules_python//python:py_library.bzl", "py_library")
 
 package(default_visibility = ["//visibility:private"])
@@ -13,3 +14,14 @@ py_library(
 )
 
 exports_files(["core_checks.py"])
+
+# No `data = [...]` for renovate.json / deps/ / .renovate-untracked.json on
+# purpose: the script resolves them via $BUILD_WORKSPACE_DIRECTORY (set by
+# `bazel run`) so it reads the live workspace, not the bazel sandbox. Adding
+# them as data deps would silently shadow the real files.
+py_binary(
+    name = "check_renovate_bazel_coverage",
+    srcs = ["renovate.py"],
+    main = "renovate.py",
+    deps = ["@py_dev_requirements//invoke"],
+)

tasks/__init__.py

@@ -69,6 +69,7 @@
     python_version,
     quality_gates,
     release,
+    renovate,
     rtloader,
     sbomgen,
     schema,
@@ -240,6 +241,7 @@
 ns.add_collection(setup)
 ns.add_collection(systray)
 ns.add_collection(release)
+ns.add_collection(renovate)
 ns.add_collection(rtloader)
 ns.add_collection(system_probe)
 ns.add_collection(process_agent)