[mortyops]

This PR contains the following updates:

Package	Update	Change
docker.io/library/busybox (source)	digest	fd7dc98 → a46257e

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[mortyops]

--- Deployment home-automation/home-assistant
+++ Deployment home-automation/home-assistant
@@ -153,7 +153,7 @@
           value: e5badaaacaa63cfd6fe733924a05e76d75058836190398598fb24de57cd47ccd
         - name: OIDC_VERSION
           value: v1.2.1
-        image: docker.io/library/busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+        image: docker.io/library/busybox:1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
         name: install-oidc
         securityContext:
           allowPrivilegeEscalation: false

[mortyops]

--- HelmRelease home-automation/home-assistant
+++ HelmRelease home-automation/home-assistant
@@ -135,7 +135,7 @@
               OIDC_VERSION: v1.2.1
             image:
               repository: docker.io/library/busybox
-              tag: 1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+              tag: 1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
             securityContext:
               allowPrivilegeEscalation: false
               capabilities:

--- MutatingAdmissionPolicy system/volsync-mover-jitter
+++ MutatingAdmissionPolicy system/volsync-mover-jitter
@@ -40,7 +40,7 @@
             op: "add", path: "/spec/template/spec/initContainers/-",
             value: Object.spec.template.spec.initContainers{
               name: "jitter",
-              image: "docker.io/library/busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e",
+              image: "docker.io/library/busybox:1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4",
               imagePullPolicy: "IfNotPresent",
               command: ["sh", "-c", "sleep $(shuf -i 0-90 -n 1)"]
             }

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a pure digest bump of docker.io/library/busybox:1.38.0 in two manifests. The tag stays the same; only the SHA-256 digest changes. No functional behavior is altered.

Change-by-change findings

kubernetes/apps/base/home-automation/home-assistant/app/helmrelease.yaml

• Line 41: install-oidc init container image digest updated from fd7dc98 to a46257e.
• This container runs wget + sha256sum + unzip to install the hass-oidc-auth Home Assistant custom component. Busybox is used only for its wget, sha256sum, unzip, mkdir, rm, mv, cat, echo utilities — all of which are stable across busybox digests. No API surface, no new flags, no new binaries.
• The OIDC_SHA256 env var (pinned to e5bada...) is unchanged, so the OIDC component checksum verification is unaffected.
• No resource limits, no new env vars, no new probes, no new volumes.

kubernetes/apps/base/system/volsync/app/mutatingadmissionpolicy.yaml

• Line 44: jitter init container image digest updated from fd7dc98 to a46257e.
• This container runs sleep $(shuf -i 0-90 -n 1) — a trivial jitter to stagger VolSync mover startup. Busybox is used only for sleep and shuf. Again, no behavioral change.

Required Checks Disposition

Check	Status	Rationale
validate manifest against target cluster version	satisfied	The diff changes only image.tag digest values. No API version, no new fields, no structural changes. The HelmRelease schema and MutatingAdmissionPolicy schema are unchanged.
check for resource quota / limit changes	satisfied	No resources.requests or resources.limits lines are modified in either file. The only changed lines are the two tag: / image: digest values.

Standards Compliance

• No plaintext secrets: Neither changed line contains a secret. The OIDC_SHA256 env var is a public GitHub release asset hash, not a secret.
• No postRenderer with bash: Not applicable — no postRenderer present.
• Flux schema comment: Both files retain their # yaml-language-server: $schema=... header.
• Naming: helmrelease.yaml and mutatingadmissionpolicy.yaml follow kebab-case conventions.
• No ${...} substitution collision: The changed lines contain no literal ${...} tokens.
• healthChecks: targets rendered workload: Not applicable — this PR does not touch healthChecks:.
• security.cephx.csi / rgw_sigv4_insecure: Not applicable — no Ceph config touched.

Unknowns / Needs Verification

• Digest provenance: The OCI revision labels for docker.io/library/busybox are missing from the provenance data, so I cannot confirm whether a46257e is a newer build of the same 1.38.0 tag or a re-published digest. This is a low-risk assessment: busybox digests are stable and the tag is pinned to 1.38.0. The change is a digest-only bump, which the repo's own standards say is "normally fine."

Tool Harness Findings

• The related-code scan identified install-oidc as a consumer of the changed init container. The .renovate/autoMerge.json5 rule at line 79 explicitly blocks auto-merge for christiaangoossens/hass-oidc-auth (the OIDC component), but this PR does not touch that package — it only bumps the busybox digest used by the init container. The automerge guard is irrelevant here.

Summary

A safe, low-risk digest-only bump. No functional change, no new permissions, no new resources, no new secrets. The two busybox consumers (install-oidc and jitter) are trivial utility containers. Approved.