[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/kimdre/doco-cd	minor	0.129.1 → 0.130.0

---

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

v0.130.0

Compare Source

Security: Git credentials are now host-scoped

[!IMPORTANT]
User action required!
See also GHSA-ggcr-c46c-q2gj

Previously a global Git access token or GitHub App credential could be sent to any HTTP(S) host selected through a repository URL. Global credentials now require GIT_AUTH_DOMAINS, otherwise doco-cd will not start.

Add every Git host that should receive the global credential:

environment:
  GIT_ACCESS_TOKEN: ${GIT_ACCESS_TOKEN}
  GIT_AUTH_DOMAINS: |
    - domains: [github.com, git.example.com]

This also applies to global GitHub App credentials.

Insecure opt-out

If you deliberately accept the risk of sending global credentials to unmatched hosts, you can set GIT_AUTH_ALLOW_ANY_HOST: "true".

[!WARNING]
This is insecure and not recommended.

Documentation

• Credential Scope
• Migrating from Global Credentials
• Disabling the Scope

Fetching external secrets in Bulk

If a stack needs many secrets, you do not have to list each one in external_secrets anymore. Set external_secrets_paths to a list of provider paths instead. Doco-CD fetches every secret below each path and makes it available as a variable:

name: myapp
external_secrets_paths:
  - path: 0db45926-c97c-40d4-a3aa-fefd5d5fb492:prod:/myapp/   # Provider specific path, see the provider pages
    prefix: MYAPP_                                           # Optional, added in front of every variable name
    recursive: true                                          # Optional, also fetch secrets in sub folders

More info in the wiki.

What's Changed

🚨 Breaking Changes

• fix(git)!: scope HTTP(S) credentials to GIT_AUTH_DOMAINS hosts by @​kimdre in GHSA-ggcr-c46c-q2gj

✨ Features

• feat(secrets): fetch external secrets in bulk by path by @​kimdre in #​2101

🌟 Improvements

• feat: include resolved revision in per-stack log lines by @​acouvreur in #​2094

📦 Dependencies

• chore(deps): update docker:29-dind docker digest to 9e79b87 by @​renovate[bot] in #​2099
• fix(deps): update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​2100
• chore(deps): update dependency zensical to v0.0.72 by @​renovate[bot] in #​2103
• chore(deps): update gcr.io/distroless/base-debian13 docker digest to f5e9519 by @​renovate[bot] in #​2105
• fix(deps): update module github.com/getkin/kin-openapi to v0.152.0 by @​renovate[bot] in #​2104

New Contributors

• @​acouvreur made their first contribution in #​2094

Full Changelog: kimdre/doco-cd@v0.129.1...v0.130.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mpdavis]

✅ Safe to merge

• Breaking change does not apply here. v0.130.0 requires GIT_AUTH_DOMAINS when global GIT_ACCESS_TOKEN or GitHub App credentials are configured — docker/doco-cd/compose.yaml sets neither (the homelab repo is public, so no git auth token is needed).
• Security fix (GHSA-ggcr-c46c-q2gj): scopes HTTP(S) credentials to declared domains to prevent token leakage to arbitrary hosts. No risk in this repo, and the fix is a good reason to take the update promptly.
• New feature (bulk secrets): external_secrets_paths is additive and optional — no migration required.
• Minor version bump (0.129.1 → 0.130.0), no major version crossing.

[mpdavis]

Automated safety review: safe to merge.