From 365b0500043ce68fbbf31100b20d5f34c4d99c7f Mon Sep 17 00:00:00 2001 From: cplieger <917744+cplieger@users.noreply.github.com> Date: Fri, 9 Oct 2026 19:17:07 +0200 Subject: [PATCH] ci: run the v3 checks and let Renovate track the docs pins --- .github/workflows/ci.yaml | 4 ++-- CONTRIBUTING.md | 2 +- default.json | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index e4588bb..c2d0d1f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -4,7 +4,7 @@ # check. PR-only: branch protection requires the check before merge, so a # post-merge re-run on main would be redundant (standard for config-only # repos). Hand-maintained (this repo is the sync source, not a sync target); -# the pinned SHA is bumped by Renovate via the `# v2` comment. +# the pinned SHA is bumped by Renovate via the `# v3` comment. name: CI on: @@ -21,4 +21,4 @@ permissions: jobs: ci: - uses: cplieger/ci/.github/workflows/ci.yaml@c9c218d713f221dabb8504141b1ab4501d5ba7af # v2 + uses: cplieger/ci/.github/workflows/ci.yaml@b5c28aa5341aa41fa0795f698bd44d0e26ff299a # v3 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4d7966a..f4a25da 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -29,7 +29,7 @@ Changes only to these files never release: - Markdown files, PNG, JPEG, WebP, GIF and SVG files in the root `docs/` folder, the root `LICENSE` and the root `.github/` folder - the root `alerts/` folder and the root `compose.yaml` - the root `tests/` folder, any `testdata/` folder, and `_test.go`, `.test.ts` and `.spec.ts` files -- any `package-lock.json`, `.punused-ignore` or knip configuration file +- any `package-lock.json` or knip configuration file - the root `.editorconfig`, `.gitattributes`, `.gitignore` and `.dockerignore` ## Repositories whose default branch is `dev` diff --git a/default.json b/default.json index 6b37e5e..ed56414 100644 --- a/default.json +++ b/default.json @@ -91,7 +91,7 @@ "enabled": false }, { - "description": "All four synced workflow destinations (ci/codeql/release/security, per cplieger/ci scripts/classify-repos.py) are OWNED by repo-sync: the templates carry the cplieger/ci digest pin, so every ci release already propagates to every consumer repo as auto-merging chore(sync) PRs with the new digest baked in. Disable Renovate on these destination files so sync is the single writer. Renovate used to race repo-sync on every ci release in these files: the sync PR usually landed first, Renovate autoclosed its now-redundant digest PR (GitHub permanently drops auto-merge arming when a PR closes), and the next release reopened the same PR unarmed \u2014 Renovate arms platform automerge only at PR creation, never on reopen \u2014 leaving permanently-green never-merging PRs cycling open/autoclosed (observed 2026-07-30..08-04 across 13 repos). Excluded: cplieger/ci (these filenames ARE the canonical reusable workflows there, where Renovate must keep updating pins) and cplieger/.github (hand-maintained ci.yaml; not a sync target since the repo is not releaseable). A future non-sync-target repo hand-maintaining one of these filenames needs its own exclusion here or its pins freeze, which is exactly what happened to cplieger/tool-catalog: a data repo with no releasable surface (no go.mod, jsr.json or Dockerfile), so classify-repos.py profiles it lang=none and no sync group writes its files. Its hand-maintained pins sat frozen at e0df4c8 from 2026-08-04, the day this rule landed, until 2026-08-12, 14 patch releases behind, while Renovate kept bumping every other dependency in that repo. Recompute this list whenever the sync manifest changes: the repos needing an exclusion are exactly those holding one of these filenames that no group in classify-repos.py's output writes. Measured 2026-08-12 across all 55 non-archived non-fork repos, that set is precisely the three named here (cplieger/ci's release.yaml self-pin, cplieger/.github's hand-maintained ci.yaml, and cplieger/tool-catalog's three).", + "description": "All four synced workflow destinations (ci/codeql/release/security, per cplieger/ci scripts/classify-repos.py) are OWNED by repo-sync: the templates carry the cplieger/ci digest pin, so every ci release already propagates to every consumer repo as auto-merging chore(sync) PRs with the new digest baked in. Disable Renovate on these destination files so sync is the single writer. Renovate used to race repo-sync on every ci release in these files: the sync PR usually landed first, Renovate autoclosed its now-redundant digest PR (GitHub permanently drops auto-merge arming when a PR closes), and the next release reopened the same PR unarmed \u2014 Renovate arms platform automerge only at PR creation, never on reopen \u2014 leaving permanently-green never-merging PRs cycling open/autoclosed (observed 2026-07-30..08-04 across 13 repos). Excluded: cplieger/ci (these filenames ARE the canonical reusable workflows there, where Renovate must keep updating pins) and cplieger/.github (hand-maintained ci.yaml; not a sync target since the repo is not releaseable). A future non-sync-target repo hand-maintaining one of these filenames needs its own exclusion here or its pins freeze, which is exactly what happened to cplieger/tool-catalog: a data repo with no releasable surface (no go.mod, jsr.json or Dockerfile), so classify-repos.py profiles it lang=none and no sync group writes its files. Its hand-maintained pins sat frozen at e0df4c8 from 2026-08-04, the day this rule landed, until 2026-08-12, 14 patch releases behind, while Renovate kept bumping every other dependency in that repo. Recompute this list whenever the sync manifest changes: the repos needing an exclusion are exactly those holding one of these filenames that no group in classify-repos.py's output writes. Measured 2026-10-09 across all 67 non-archived non-fork repos, that set is precisely the three named here (cplieger/ci's release.yaml self-pin, cplieger/.github's hand-maintained ci.yaml, and cplieger/docs's ci.yaml, codeql.yml and security.yml, another lang=none repo whose pins sat frozen from its first commit for want of this exclusion). cplieger/tool-catalog left the set when its publish.yaml put it in the artifact CI sync group, which now writes its ci.yaml, codeql.yml and security.yml.", "matchManagers": [ "github-actions" ], @@ -104,12 +104,12 @@ "matchRepositories": [ "!cplieger/ci", "!cplieger/.github", - "!cplieger/tool-catalog" + "!cplieger/docs" ], "enabled": false }, { - "description": "Never digest-track cplieger/ci reusable workflows on a branch ref (a stray `# main`/`# master` instead of a release tag). A branch ref moves with every commit, so Renovate digest-chases HEAD and, with digest auto-merge on, loops forever (and fans out to every consumer via Sync). Reusable-workflow pins MUST track a release tag such as `# v2`.", + "description": "Never digest-track cplieger/ci reusable workflows on a branch ref (a stray `# main`/`# master` instead of a release tag). A branch ref moves with every commit, so Renovate digest-chases HEAD and, with digest auto-merge on, loops forever (and fans out to every consumer via Sync). Reusable-workflow pins MUST track a release tag such as `# v3`.", "matchManagers": [ "github-actions" ],