fix(renovate): move the Talos machinery pin with Talos and list the manual pins on the PR

[devantler]

🤖 Generated by the Agentic Engineer

Why

Every Talos upgrade arrives with failing checks because two related pins do not move with it. Each time, someone has to rediscover that by hand, one CI cycle per missing pin.

What

The Talos library the compatibility check reads now updates in the same pull request as Talos itself. Each Talos pull request also carries a checklist of the pins that cannot be updated automatically, including where to find the checksum value. Proof comes with the next Talos release, so the issue moves to Verifying after merge.

Fixes #3734

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[devantler]

🤖 Generated by the Agentic Engineer

Readiness record @de68c389:

• Tested: CI green. .github/renovate.json parses. Renovate's config validator reports the same 23 findings for this branch and for main. They all come from a locally cached Renovate that predates managerFilePatterns, so this change adds none.
• Tried as a user: this is configuration read by the hosted Renovate app, so there is nothing I can run here. A local renovate@latest dry run refuses this machine's Node version. I traced the effect instead. The group rule matches both siderolabs/talos (the custom managers in ksail.prod.yaml and setup-talosctl.sh) and the machinery Go module that Renovate already updates (fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0 #3716). It is the last rule for these packages, so it keeps automerge: false. The checklist is taken from what chore(deps): update dependency siderolabs/talos to v1.14.0 - abandoned #3713 actually hit: the checksum pin, then the AppArmor tripwire.
• Proof in production: the next Talos release. It should arrive as one pull request carrying the machinery bump and this checklist. Talos bumps land red: the digest and machinery pins never move with the version #3734 moves to Verifying on merge until then.

[coderabbitai]

@devantler: I will review pull request #4043.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7fba5122-919d-44a6-b9b6-6443d713e331

📥 Commits

Reviewing files that changed from the base of the PR and between b9cbd07 and de68c38.

📒 Files selected for processing (1)

• .github/renovate.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (1)

.github/renovate.json (1)

216-218: LGTM!

Also applies to: 220-223

---

📝 Walkthrough

Walkthrough

The Talos Renovate rule now groups github.com/siderolabs/talos/pkg/machinery with siderolabs/talos. It keeps automerge disabled and retains the talos label. The rule now lists manual updates for TALOSCTL_SHA256, the Hetzner iso, kubernetesVersion, and expected_talos_version. Its description explains the grouped update and SHA handling.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to de68c

This change groups related Talos updates and documents the manual pins required for a complete upgrade. No material merge risk remains.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Linked Issues check	❌ Error	The change addresses the coding objectives in #3734 by grouping github.com/siderolabs/talos/pkg/machinery with the Talos rule and by listing TALOSCTL_SHA256, the Hetzner iso ID, and `kubernetesV…	Verify the next real Talos bump. Confirm that the grouped machinery update is included and that validate-talos-kubernetes-compatibility runs without manual correction of TALOSCTL_SHA256 or the machinery pin. Add the verification evidenc…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The change is limited to .github/renovate.json. The group rule and the checklist directly support the Talos pin coordination requirements in #3734. No unrelated change is demonstrated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title clearly summarizes the main changes: grouping the Talos machinery pin with Talos and documenting manual pins.
Description check	✅ Passed	The description explains why the Renovate changes are needed and what they add. It directly relates to the pull request changes.

Full details: Linked Issues check

Explanation

The change addresses the coding objectives in #3734 by grouping github.com/siderolabs/talos/pkg/machinery with the Talos rule and by listing TALOSCTL_SHA256, the Hetzner iso ID, and kubernetesVersion as manual pins. It also lists the AppArmor Talos-version pin. However, the evidence states that verification with a real Talos release is planned for a future release. It does not show a Talos bump that reaches validate-talos-kubernetes-compatibility without manual edits. This leaves the third acceptance criterion unmet.

Resolution

Verify the next real Talos bump. Confirm that the grouped machinery update is included and that validate-talos-kubernetes-compatibility runs without manual correction of TALOSCTL_SHA256 or the machinery pin. Add the verification evidence to this change or its review record.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}