ci: configure Renovate, skip Rekor tlog, fix prometheus build

[SNThrailkill]

Summary

All CI/CD workflow runs have been failing for months. This addresses the three issues behind it and sets up Renovate to keep actions current going forward.

Changes

1. Configure Renovate to manage GitHub Actions (renovate.json)

renovate.json was effectively empty (just the schema), so Renovate never produced PRs for outdated actions — only the default dockerfile manager bumped the base image. Many pinned actions are well behind and several still run on Node 20 (now deprecated, forced to Node 24 with warnings):

Action	Pinned	Latest
actions/checkout	v4	v7
docker/metadata-action	v5	v6
redhat-actions/buildah-build	v2	v3
sigstore/cosign-installer	v3.8.1	v4.1.2
docker/login-action	v3	v4
actions/upload-artifact	v4	v7
… and others

The new config enables the github-actions and dockerfile managers with a dependency dashboard, a Monday schedule (America/Chicago), grouped GitHub Actions updates, digest+version pinning, and dashboard approval required for major Docker base-image bumps (so e.g. a Fedora major bump doesn't auto-merge and break builds).

Also removed the broken .github/dependabot.yml — it had an empty package-ecosystem: "" (a no-op) and would have conflicted with Renovate.

2. Skip the Rekor transparency log on cosign sign/attest (.github/workflows/reusable-build-image.yml)

The Add SBOM Attestation step (and, on a future run, Sign container image) failed with:

Post "https://rekor.sigstore.dev/api/v1/log/entries": ... giving up after 4 attempt(s)

Research confirms this is a common, well-documented problem: the public Rekor instance (rekor.sigstore.dev) is a shared service with a 99.5% SLO and is intermittently unavailable. Since cosign 2.0, cosign sign and cosign attest upload to it by default — even for key-based signing — so a Rekor hiccup fails the pipeline. It's transient; our own logs showed cosign sign succeeding while cosign attest seconds later failed (sigstore/cosign#3602, GitHub community discussions#144833).

Fix: both steps now always run with --tlog-upload=false. The signature/attestation is stored in the OCI registry alongside the image, where it can be verified manually. The public Rekor transparency-log entry is skipped entirely — it isn't needed for the key-based signer. Verify with:

cosign verify --key cosign.pub --insecure-ignore-tlog=true <image>
cosign verify-attestation --key cosign.pub --insecure-ignore-tlog=true <image>

Trade-off: this loses the public audit record in exchange for a reliable build.

3. Fix the prometheus image build (Containerfile)

The prometheus stage's dnf install loki grafana -y failed with curl error 77 (CURLE_SSL_CACERT_BADFILE — "error adding trust anchors from file: /etc/pki/tls/certs/ca-bundle.crt") reaching the grafana yum repo. This means the CA bundle was missing/empty in the bootc build container, not that the grafana cert was untrusted (that would be error 60).

Fix: run dnf update -y && update-ca-trust before adding the grafana repo. This refreshes ca-certificates (whose %post extracts the bundle) and re-extracts the trust store even when ca-certificates is already current. Ordering matters: it must run before the grafana repo is configured, otherwise dnf tries to refresh grafana's metadata against the still-broken bundle and fails identically.

Validation

• renovate.json parses as valid JSON.
• .github/workflows/reusable-build-image.yml parses as valid YAML.
• Branch verified on remote: 1 commit ahead of main, 0 behind, with the expected 5 file changes.

Notes

• Added AGENTS.md documenting the CI/CD layout, the Renovate setup, and both known issues for future contributors/automation.
• Once Renovate picks up the new config it should open grouped PRs bumping the outdated actions, which CI will validate.

This PR was created by an AI agent (OpenHands) on behalf of SNThrailkill.

@SNThrailkill can click here to continue refining the PR