mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-27 07:50:47 +00:00
Jamie Tanna
238e15a498
Renovate deployments that are deployed across multiple organisations may take advantage of Inherited Config as a means to decentralise some decisions and/or preferences that their organisations would like to use for some self-hosted configuration. Similarly, the decision of which hosts to allowlist may be something that a self-hosted administrator /may/ want to allow their organisation admins to decide. We can make this an opt-in capability to indicate that the self-hosted administrator trusts the Inherited Config moreso, and allows someone who can write to it the ability to allowlist access to internal hosts that may not be intended. If a self-hosted administrator sets `allowInternal: false`, this takes precedence, allowing a "veto", and a self-hosted admin's `headers` are still preferred, too. It's not possible for Inherited Config to set grants for `extends`, as config resolution has already occurred, so this still needs to be performed at the self-hosted config level. This trust is transitive: `hostRules` defined in presets the inherited config `extends` are registered at the same inherited tier once resolved, so this option must only be enabled when those preset sources are trusted too. Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io> Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>