1483529 - Accept updated GitHub permissions for app 'Renovate'

Status: RESOLVED DUPLICATE of bug 1479481

(mozilla.org :: Github: Administration, task)

Description

[Ed Morley [:emorley]]

Hi!

The Renovate GitHub app is requesting additional permissions (access to "Security vulnerability reports") so that is can expedite dependency updates when they are vulnerable (rather than waiting for the normal update schedule):
https://renovatebot.com/blog/github-vulnerability-alerts

Please can a mozilla admin accept the new permissions?
https://github.com/apps/renovate/installations/72227/permissions

Many thanks :-)

Comment 1

[hwine]

Thanks for stating the need -- we do not accept additional permission requests until someone makes a case for it :)

This also translates into an immediate signal that there may be a zero day in the app.

I'll replicate what we did for mozilla-services. I'll open an issue on all current repos using renovate, notifying them of the upcoming change. That will give them a chance to configure to _not_ have the zero-day PR's made for their repos.

I'll update here when I've done that.

Comment 2

[hwine]

woops - got my orgs mixed up -- it's this org that process is underway in :/