fix(renovate): decrypt values BEFORE renovate edits them (retract broken post-bump round-trip)

The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong:
Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER
Renovate rewrites the file. These values.yaml are SOPS documents whose
sops.mac authenticates the whole file, so editing a plaintext image.tag
invalidates the MAC and 'sops -d' then fails (data-integrity error). The
claimed decrypt-after-bump therefore could never work.

boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate
extracts/edits them, committing the decrypted tree locally (never pushed,
so no plaintext secrets enter remote git). postUpgradeTasks is reduced to
'sops -e -i' only (the file is already plaintext when Renovate edits it).

Validated: kustomize build passes for the whole kubernetes/ tree.

kubernetes/code/renovate/boot.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+#
+# Renovate runner bootstrap / entrypoint.
+#
+# Renovate has NO preUpgradeTasks hook (schema only exposes postUpgradeTasks),
+# and postUpgradeTasks runs AFTER Renovate has already edited the dependency
+# files. That matters because these `values.yaml` files are SOPS documents:
+# the `sops:` metadata block carries a `mac:` that authenticates the whole
+# file, so ANY edit (even to a plaintext `image.tag`) invalidates it and makes
+# `sops -d` fail with a MAC/data-integrity error. You cannot decrypt the file
+# *after* Renovate has touched it.
+#
+# So we decrypt BEFORE Renovate extracts any dependency info:
+#   1. clone the repo into the exact checkout path Renovate will reuse
+#   2. `sops -d -i` every values.yaml in place (plaintext, no `sops:` block)
+#   3. local-commit the decrypted working tree onto the local base branch
+#      (NOT pushed -> encrypted blobs stay in remote git, no plaintext secrets
+#      ever leave the runner)
+#   4. run Renovate. It now reads plaintext tags and edits plaintext files.
+#      postUpgradeTasks only needs `sops -e -i` (encrypt) to rebuild a valid
+#      SOPS document containing the bumped tag.
+#
+# The local commit is important: step 3 makes `git checkout <base>` restore the
+# decrypted content from the LOCAL branch rather than the encrypted remote blob,
+# so Renovate's branch operations don't silently resurrect the encrypted file
+# and re-introduce the MAC-mismatch problem.
+
+set -eu
+
+# SOPS PGP private key must be available to decrypt AND to re-encrypt.
+if [ -f /etc/renovate/gpg/git-renovate-gpg.key ]; then
+    gpg --batch --import /etc/renovate/gpg/git-renovate-gpg.key || true
+fi
+
+# Renovate stores repos under $RENOVATE_BASE_DIR/repos/<platform>/<org>/<repo>.
+BASE_DIR="${RENOVATE_BASE_DIR:-/tmp/renovate}"
+REPO_DIR="${BASE_DIR}/repos/github/vhaudiquet/homeprod"
+REPO_URL="https://x-access-token:${RENOVATE_TOKEN}@github.com/vhaudiquet/homeprod.git"
+DEFAULT_BRANCH="${DEFAULT_BRANCH:-main}"
+
+mkdir -p "$(dirname "$REPO_DIR")"
+
+# 1. Ensure a fresh, valid checkout of the base branch exists.
+if [ -d "${REPO_DIR}/.git" ]; then
+    git -C "$REPO_DIR" fetch --all --prune
+    git -C "$REPO_DIR" -c advice.detachedHead=false checkout "$DEFAULT_BRANCH" \
+        && git -C "$REPO_DIR" reset --hard "origin/${DEFAULT_BRANCH}"
+else
+    git clone --no-tags --single-branch --branch "$DEFAULT_BRANCH" "$REPO_URL" "$REPO_DIR"
+    git -C "$REPO_DIR" config user.name  renovate
+    git -C "$REPO_DIR" config user.email renovate@localhost
+fi
+
+# 2. Decrypt every values.yaml still carrying SOPS metadata (in-place).
+#    Skips files that are already plaintext (no `sops:` block) so the bootstrap
+#    is idempotent across re-runs.
+find "$REPO_DIR" -name 'values.yaml' -type f \
+    -exec grep -l -m1 '^sops:' {} + 2>/dev/null \
+    | xargs -r -n1 sops -d -i
+
+# 3. Local commit (never pushed) so Renovate's checkout of the base branch
+#    keeps working on decrypted files.
+git -C "$REPO_DIR" add -A
+if ! git -C "$REPO_DIR" diff --cached --quiet; then
+    git -C "$REPO_DIR" commit -m "chore(renovate): decrypt values for update (local bootstrap)" --quiet
+fi
+
+# 4. Run Renovate itself.
+exec renovate "$@"

kubernetes/code/renovate/cronjob.yaml

@@ -1,11 +1,13 @@
 # Self-hosted Renovate runner.
 #
 # Runs the managed `renovatebot/renovate` image on a schedule against the
-# `vhaudiquet/homeprod` repo (see config.json). Because we need to run SOPS
-# during postUpgradeTasks (re-encrypting values.yaml), Renovate cannot run on
-# the Mend-hosted app — it must be self-hosted with the sops command allow-listed
+# `vhaudiquet/homeprod` repo (see config.json). Because our `values.yaml` are
+# SOPS-encrypted and must be decrypted *before* Renovate edits them (and
+# re-encrypted before the PR commit), Renovate cannot run on the Mend-hosted
+# app — it must be self-hosted with the sops command allow-listed
 # (see config.json -> allowedPostUpgradeCommands) and the SOPS PGP private key
-# loaded (renovate-gpg secret below).
+# loaded (renovate-gpg secret below). boot.sh performs the pre-extraction
+# decrypt; postUpgradeTasks performs the re-encrypt.
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -38,20 +40,21 @@ spec:
                   value: /etc/renovate/config.json
                 - name: LOG_LEVEL
                   value: info
+              # boot.sh decrypts values.yaml BEFORE Renovate extracts/edits them
+              # (Renovate has no preUpgradeTasks hook; see boot.sh for why),
+              # then runs renovate. postUpgradeTasks only re-encrypts.
               command:
                 - /bin/sh
-                - -ec
-                - |
-                  set -eu
-                  # Import the SOPS PGP private key so rebuild/enable SOPS
-                  # re-encryption in postUpgradeTasks works.
-                  gpg --batch --import /etc/renovate/gpg/git-renovate-gpg.key || true
-                  exec renovate
+                - /etc/renovate/boot.sh
               volumeMounts:
                 - name: config
                   mountPath: /etc/renovate/config.json
                   subPath: config.json
                   readOnly: true
+                - name: boot
+                  mountPath: /etc/renovate/boot.sh
+                  subPath: boot.sh
+                  readOnly: true
                 - name: gpg
                   mountPath: /etc/renovate/gpg
                   readOnly: true
@@ -66,6 +69,9 @@ spec:
             - name: config
               configMap:
                 name: renovate-config
+            - name: boot
+              configMap:
+                name: renovate-config
             - name: gpg
               secret:
                 name: renovate-gpg

kubernetes/code/renovate/kustomization.yaml

@@ -10,13 +10,14 @@ configMapGenerator:
   - name: renovate-config
     files:
       - config.json=config.json
+      - boot.sh=boot.sh
 secretGenerator:
   - name: renovate-secrets
     envs:
       - renovate.env
-  # SOPS PGP private key needed by the renovate runner to re-encrypt
-  # values.yaml during postUpgradeTasks. Mounted into the pod and imported
-  # into the container gpg keyring at startup.
+  # SOPS PGP private key needed by the renovate runner to decrypt values.yaml
+  # at boot and to re-encrypt them during postUpgradeTasks. Mounted into the
+  # pod and imported into the container gpg keyring at startup.
   - name: renovate-gpg
     files:
       - git-renovate-gpg.key

renovate.json

@@ -10,14 +10,14 @@
     "helmv3"
   ],
   "postUpgradeTasks": {
-    "description": "SOPS round-trip on encrypted values.yaml. Renovate has no preUpgrade hook, so the decrypt must happen here: after the tag bump but before commit, decrypt the file, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values and corrupt them.",
+    "description": "Re-encrypt values.yaml after Renovate bumps an image tag. These files are decrypted to plaintext by the runner's boot.sh BEFORE Renovate extracts/edits them (Renovate has no preUpgradeTasks hook, and a post-edit decrypt would fail: editing a SOPS file invalidates its mac). So by the time this task runs, the file is plaintext and `sops -e -i` safely rebuilds a valid SOPS document carrying the bumped tag. branch mode re-encrypts each changed file once, after all deps on the branch are updated.",
     "commands": [
-      "sops -d {{packageFile}} > {{packageFile}}.plain && mv {{packageFile}}.plain {{packageFile}} && sops -e -i {{packageFile}}"
+      "sops -e -i {{packageFile}}"
     ],
     "fileFilters": [
       "**/values.yaml"
     ],
-    "executionMode": "update"
+    "executionMode": "branch"
   },
   "packageRules": [
     {