🔒 feat: test what the presets decide, not just how they are written

README-cs.md

@@ -157,10 +157,34 @@ Pozor na jedno omezení: **`renovate-config-validator` nevaliduje názvy
 managerů.** `matchManagers: ["npm", "pnpm", "yarn"]` projde čistě a nematchuje
 nic. Gate pokrývá schéma, ne význam.
 
-## Pod vlastním účtem
+### Co gate kontroluje
 
-Repozitář si zkopíruj, ale **neforkuj ho pro každou organizaci zvlášť.**
-Dědění je levnější:
+`validate.sh` pouští dvě věci a ta druhá je důležitější:
+
+- `renovate-config-validator --strict` — presety jsou správně zapsané
+- `tooling/test_policy.py` — presety **rozhodují** to, co mají
+
+Validátor kontroluje tvar, ne význam. Každá chyba, kterou tenhle preset vydal,
+jím prošla: neukotvený vzor dávající důvěru namespace, který nikdo nevlastní,
+pravidlo zařazené tak, že rušilo to nad sebou, dva neexistující názvy managerů.
+Policy test je má zmrazené jako případy a spadne, kdyby obnova lockfilu zase
+dostala automerge.
+
+Renovate matching reimplementuje, místo aby volal Renovate, takže se od
+skutečného enginu může rozejít. Selhání je důvod se podívat; průchod je slabší
+důkaz než dry run.
+
+## Tři způsoby, jak si to vzít, a co který stojí
+
+**Jen dědit.** Opravy k tobě dorazí ve chvíli, kdy vzniknou. Nic neudržuješ.
+
+```json
+{ "extends": ["github>ownctrl/supply-chain"] }
+```
+
+**Dědit a přebít.** Totéž plus vlastní doplňky. Tohle použij pro druhou značku
+nebo tým místo forku — jedna bezpečnostní oprava by se neměla dělat tolikrát,
+kolik máš kopií.
 
 ```json
 {
@@ -169,7 +193,59 @@ Dědění je levnější:
 }
 ```
 
-Fork znamená opravit každou bezpečnostní vadu tolikrát, kolik máš kopií.
+**Vzít si kopii.** Tenhle repozitář je GitHub template. Sáhni po něm, když
+politiku potřebuješ vlastnit — odstřižené prostředí, požadavek na compliance,
+nesouhlas s nějakým rozhodnutím tady.
+
+Ale ber to s cenovkou: **kopie přestane dostávat opravy.** V tomhle presetu
+se našly čtyři vady, na které by nikdo nepřišel čtením dokumentace, a kopie
+vzatá před kteroukoli z nich si ji nechala. U bezpečnostní politiky je tohle
+ten drahý směr.
+
+Když chceš vlastní adresu **i** opravy, ať tvoje kopie dědí odsud:
+
+```json
+{
+  "extends": ["github>ownctrl/supply-chain"],
+  "packageRules": [ /* jen tvoje odchylky */ ]
+}
+```
+
+Workflow `Setup Owner` po ručním spuštění přepíše reference a LICENSE na
+nového vlastníka.
+
+## Co to nedělá
+
+Preset rozhoduje, které aktualizace závislostí smějí přistát bez lidského
+pohledu. To je celý jeho rozsah a stojí za to říct natvrdo, kde končí:
+
+- **Hlídá aktualizace, ne to, co už máš.** Hostilní verze, která ti už leží
+  v lockfilu, je mimo jeho dosah. Zkontroluj lockfile přímo a rotuj všechno, na
+  co ten balíček mohl dosáhnout.
+- **Není to skener.** Neprohlíží obsah balíčků, neověřuje, že vydaný artefakt
+  odpovídá zdrojáku, ani nedetekuje kompromitaci. Kombinuj ho s něčím, co to
+  umí.
+- **Odstup není záruka.** `minimumReleaseAge` kupuje čas, aby si někdo jiný
+  všiml špatného vydání. Nemusí si všimnout nikdo. Shai-Hulud zůstal
+  u některých balíčků nepovšimnutý déle než sedm dní.
+- **Watch list je snímek.** 428 balíčků známých z jednoho útoku v listopadu
+  2025. O tom příštím neříká nic.
+- **Policy test reimplementuje Renovate matching**, místo aby volal Renovate,
+  takže se od skutečného enginu může rozejít.
+
+Poskytováno tak, jak je, bez záruky, pod [licencí MIT](./LICENSE). Rozhodnutí,
+co smí tvůj projekt sloučit bez dozoru, je tvoje; tenhle preset je výchozí bod
+s odůvodněním, ne náhrada za to rozhodnutí.
+
+## Workflow `Setup Owner`
+
+`.github/workflows/setup-owner.yml` je tu pro cestu s kopií. Po ručním
+spuštění přepíše reference presetu a copyright v LICENSE na nového vlastníka
+a pak sám sebe smaže.
+
+Běží s `contents: write` a pushuje na výchozí větev, což k té práci potřebuje.
+Je jen `workflow_dispatch` — nic ho nespouští automaticky. Když preset dědíš
+místo kopírování, nikdy ho nepustíš.
 
 ## Verzování
 

README.md

@@ -2,7 +2,7 @@
 
 <div align="center">
 
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![License: MIT](https://img.shields.io/badge/License-MIT-brightgreen.svg)](https://opensource.org/licenses/MIT)
 [![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)
 ![Ecosystems](https://img.shields.io/badge/ecosystems-10+-blue.svg)
 
@@ -160,11 +160,17 @@ Pin a release if you do not want your policy to change under you:
 { "extends": ["github>ownctrl/supply-chain#v1.0.0"] }
 ```
 
-### Using it under your own account
+### Three ways to adopt this, and what each costs
 
-Copy this repo, then reference your own copy. Do **not** fork it per
-organisation — inherit instead, so one security fix does not have to be applied
-once per copy:
+**Just extend it.** Fixes reach you the moment they land. Nothing to maintain.
+
+```json
+{ "extends": ["github>ownctrl/supply-chain"] }
+```
+
+**Extend it and override.** Same, plus your own additions. Use this for a
+second brand or team rather than forking — one security fix should not have to
+be applied once per copy.
 
 ```json
 {
@@ -173,8 +179,26 @@ once per copy:
 }
 ```
 
-The `Setup Owner` workflow rewrites the examples and LICENSE to the new owner
-when you dispatch it manually.
+**Take a copy.** This repo is a GitHub template. Use it when you need to own
+the policy outright — an air-gapped mirror, a compliance requirement, a
+disagreement with a decision here.
+
+Be clear about the price: **a copy stops receiving fixes.** Four faults were
+found in this preset that no amount of reading the documentation would have
+surfaced, and a copy taken before each one kept it. For a security policy that
+is the expensive direction.
+
+If you want your own address *and* the fixes, have your copy extend upstream:
+
+```json
+{
+  "extends": ["github>ownctrl/supply-chain"],
+  "packageRules": [ /* your deviations, and only those */ ]
+}
+```
+
+The `Setup Owner` workflow rewrites the preset references and LICENSE to the
+new owner when you dispatch it manually.
 
 ### JavaScript runtimes and package managers
 
@@ -246,6 +270,23 @@ ln -s ../../tooling/validate.sh .git/hooks/pre-push
 A local hook is a convenience, not a boundary — anyone can skip it. CI stays the
 real gate.
 
+### What the gate checks
+
+`validate.sh` runs two things, and the second matters more:
+
+- `renovate-config-validator --strict` — the presets are well formed
+- `tooling/test_policy.py` — the presets *decide* what they should
+
+The validator checks shape, not meaning. Every fault this preset has shipped
+passed it: an unanchored pattern granting trust to a namespace nobody owns, a
+rule ordered so it undid the one above it, two manager names that do not exist.
+The policy test freezes those as cases, and fails if lockfile maintenance ever
+gets automerge back.
+
+It reimplements Renovate's matching rather than calling Renovate, so it can
+drift from the real engine. A failure is a reason to look; a pass is weaker
+evidence than a dry run.
+
 ## Testing locally
 
 You can test this config locally before deploying:
@@ -309,6 +350,40 @@ The full list lives in [`default.json`](./default.json). Affected version ranges
 
 ---
 
+## What this does not do
+
+This preset decides which dependency updates may merge unattended. That is its
+whole scope, and it is worth being blunt about the edges:
+
+- **It gates updates, not what you already have.** A hostile version already in
+  your lockfile is outside its reach. Check the lockfile directly and rotate
+  anything the package could have read.
+- **It is not a scanner.** It does not inspect package contents, verify that a
+  published artifact matches its source, or detect compromise. Pair it with
+  something that does.
+- **A delay is not a guarantee.** `minimumReleaseAge` buys time for someone
+  else to notice a bad release. Nobody may notice. Shai-Hulud went unnoticed
+  for longer than seven days in some packages.
+- **The watch list is a snapshot.** 428 packages known compromised in one
+  attack, in November 2025. It says nothing about the next one.
+- **The policy test reimplements Renovate's matching** rather than calling
+  Renovate, so it can drift from the real engine.
+
+Provided as is, without warranty, under the [MIT licence](./LICENSE). Deciding
+what your project may merge unattended is your decision; this preset is a
+starting point with reasoning attached, not a substitute for making it.
+
+## The `Setup Owner` workflow
+
+`.github/workflows/setup-owner.yml` exists for the copy path. Dispatch it
+manually after taking a copy and it rewrites the preset references and the
+LICENSE copyright to whoever now owns the repo, then deletes itself.
+
+It runs with `contents: write` and pushes to the default branch, which is what
+it needs to do that job. It is `workflow_dispatch` only — nothing triggers it
+automatically. If you are extending this preset rather than copying it, you
+will never run it.
+
 ## Versioning
 
 `main` is what an unpinned `github>ownctrl/supply-chain` resolves to, so every

SECURITY.md

@@ -0,0 +1,45 @@
+# Security policy
+
+## Reporting
+
+Report a problem with this preset through
+[private vulnerability reporting](https://github.com/ownctrl/supply-chain/security/advisories/new),
+not a public issue.
+
+Worth reporting:
+
+- a rule that lets something merge unattended when it should not
+- a matcher that is broader than it reads — an unanchored pattern over a
+  package prefix nobody owns is the fault this preset has shipped most often
+- a package on the watch list that should not be, or one missing that should
+- remediation text pointing somewhere a reader cannot follow
+
+## What this preset is and is not
+
+It decides **which dependency updates may land without a human looking at
+them.** That is all. It does not scan code, detect compromise, or verify that a
+published package matches its source.
+
+It cannot protect a repository that has already installed a hostile version. It
+gates *updates*, so a compromised package already in your lockfile is outside
+its reach — check the lockfile directly and rotate anything the package could
+have read.
+
+## Known limitations
+
+- `renovate-config-validator` does not validate manager names. A typo'd manager
+  silently disables the rule containing it. `tooling/test_policy.py` checks the
+  names this preset uses against a hardcoded list, which needs updating when
+  Renovate adds a manager.
+- `tooling/test_policy.py` reimplements Renovate's matching rather than calling
+  Renovate. It can drift from the real engine. A failure is a reason to look; a
+  pass is weaker evidence than a Renovate dry run.
+- `minimumReleaseAge` does not apply to `pin`, `lockFileMaintenance`,
+  `lockfileUpdate`, `rollback`, `bump` or `replacement`. This preset disables
+  automerge for lockfile maintenance because of it.
+- Renovate has a hosted app on GitHub.com only. On every other forge you run it
+  yourself, and its token can write to all of your repositories.
+
+## Supported versions
+
+The latest tag. Older tags do not get fixes — move the pin.

aggressive.json

@@ -1,20 +1,14 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "description": "Low-friction: updates any time, no release-age floor, higher PR limit. Not for use during an active supply-chain incident.",
-  "extends": [
-    "local>ownctrl/supply-chain"
-  ],
-  "schedule": [
-    "at any time"
-  ],
+  "extends": ["local>ownctrl/supply-chain"],
+  "schedule": ["at any time"],
   "prConcurrentLimit": 10,
   "minimumReleaseAge": null,
   "packageRules": [
     {
       "description": "Top-level minimumReleaseAge cannot lift the inherited npm rule -- a packageRule outranks it, so drop the floor here too",
-      "matchDatasources": [
-        "npm"
-      ],
+      "matchDatasources": ["npm"],
       "minimumReleaseAge": null
     }
   ]

default.json

@@ -140,7 +140,14 @@
     },
     {
       "description": "Python: group together",
-      "matchManagers": ["pip_requirements", "pip-compile", "poetry", "pep621", "pipenv", "setup-cfg"],
+      "matchManagers": [
+        "pip_requirements",
+        "pip-compile",
+        "poetry",
+        "pep621",
+        "pipenv",
+        "setup-cfg"
+      ],
       "groupName": "Python",
       "separateMinorPatch": false
     },
@@ -182,7 +189,15 @@
     },
     {
       "description": "Kubernetes: group together",
-      "matchManagers": ["kubernetes", "helmv3", "helm-values", "helm-requirements", "helmfile", "flux", "argocd"],
+      "matchManagers": [
+        "kubernetes",
+        "helmv3",
+        "helm-values",
+        "helm-requirements",
+        "helmfile",
+        "flux",
+        "argocd"
+      ],
       "groupName": "Kubernetes",
       "separateMinorPatch": false
     },

lockdown.json

@@ -1,37 +1,26 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "description": "🔒 Lockdown: no automerge anywhere, 14-day floor, every update waits for dashboard approval. For use during an active supply-chain incident.",
-  "extends": [
-    "local>ownctrl/supply-chain"
-  ],
-  "schedule": [
-    "before 06:00 on monday"
-  ],
+  "extends": ["local>ownctrl/supply-chain"],
+  "schedule": ["before 06:00 on monday"],
   "minimumReleaseAge": "14 days",
   "prConcurrentLimit": 2,
   "dependencyDashboardApproval": true,
   "packageRules": [
     {
       "description": "LOCKDOWN: npm floor to 14 days -- must be a packageRule, the top-level value is outranked by the inherited npm rule",
-      "matchDatasources": [
-        "npm"
-      ],
+      "matchDatasources": ["npm"],
       "minimumReleaseAge": "14 days"
     },
     {
       "description": "LOCKDOWN: Disable ALL automerge",
       "automerge": false,
       "dependencyDashboardApproval": true,
-      "matchPackageNames": [
-        "*"
-      ]
+      "matchPackageNames": ["*"]
     },
     {
       "description": "LOCKDOWN: Production deps require manual approval",
-      "matchDepTypes": [
-        "dependencies",
-        "peerDependencies"
-      ],
+      "matchDepTypes": ["dependencies", "peerDependencies"],
       "prPriority": -50,
       "prBodyNotes": [
         "🔒 **LOCKDOWN MODE ACTIVE**",
@@ -47,9 +36,7 @@
     },
     {
       "description": "LOCKDOWN: Block all major updates",
-      "matchUpdateTypes": [
-        "major"
-      ],
+      "matchUpdateTypes": ["major"],
       "enabled": false
     }
   ]

no-automerge.json

@@ -1,15 +1,11 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "description": "Disable automerge entirely, keeping every other policy from the base preset.",
-  "extends": [
-    "local>ownctrl/supply-chain"
-  ],
+  "extends": ["local>ownctrl/supply-chain"],
   "packageRules": [
     {
       "automerge": false,
-      "matchPackageNames": [
-        "*"
-      ]
+      "matchPackageNames": ["*"]
     }
   ]
 }