From cdfab876656465f67862cbb0b358a3d89a185e96 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Thu, 3 Sep 2026 22:11:54 +0200 Subject: [PATCH] fix(renovate): apply this organisation's policy to every repository, and tidy after an update default.json is a PRESET. It reaches a repository only through an `extends` naming it; sitting in the organisation applies it to nothing. With onboarding:false and requireConfig:'optional', an uncovered repository runs on Renovate's factory defaults and says so only at debug level: DEBUG: No renovate config file found (repository=...) Measured 2026-09-03: 77 of the 835 repositories across the 117 organisations that actually run Renovate carry no config at all. On every one of them the Go toolchain guard -- written after go 1.27.0 auto-merged into seven repositories, and because it miscompiles on loong64 (golang/go#81000) -- has never been in force, and nothing reported it. The tell was in the branch names all along: an uncovered repository gets renovate/-0.x, a covered one renovate/deps. inheritConfig reads default.json before every repository regardless of what that repository carries. inheritConfigStrict is not decoration: left at its default of false, a missing file is silent, which is this same failure one level up. postUpdateOptions carries BOTH gomodTidy and gomodUpdateImportPaths. gomodTidy alone is inert here -- artifacts.ts skips tidy outright when updateType is major, and Renovate calls a 0.x minor bump a major, which is nearly every dependency in this fleet. gomodUpdateImportPaths lifts that gate and rewrites nothing for a 0.x dependency: its commands are filtered to newMajor > 1. Proven on go-macos before this landed anywhere else: 33 repositories read the inherited config with none missing, the three that carried no config now receive it, the container logged `go mod tidy command included` and ran it, and `go mod tidy` on the branch Renovate then produced changes nothing. --- default.json | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/default.json b/default.json index b9803a2..414076f 100644 --- a/default.json +++ b/default.json @@ -10,7 +10,9 @@ ], "packageRules": [ { - "description": "One pull request per repository for everything non-breaking, rather than one per dependency. Merging them singly means every merge rebases the others and restarts their checks: one run over an organisation of 34 repositories updated 109 branches and merged 2. Grouped, a repository needs one round of checks instead of dozens.", + "description": [ + "One pull request per repository for everything non-breaking, rather than one per dependency. Merging them singly means every merge rebases the others and restarts their checks: one run over an organisation of 34 repositories updated 109 branches and merged 2. Grouped, a repository needs one round of checks instead of dozens." + ], "matchUpdateTypes": [ "minor", "patch", @@ -21,7 +23,9 @@ "automerge": true }, { - "description": "Never auto-merge the Go toolchain, and never let it ride in somebody else's group. A rule that says automerge:false for one dependency is defeated by grouping, because Renovate decides automerge per BRANCH: go 1.27.0 rode into seven repositories inside a branch called renovate/github-actions, whose other dependency was actions/setup-go. Ungrouped, it gets a branch of its own and this setting governs it. It matters because go1.27.0 miscompiles on loong64 (golang/go#81000, bisected on real hardware to 3fdac6780b): go-gfx/gfx fails that lane and stayed open only because the lane failed, which is the CI gate holding rather than this rule. A repository without such a lane sees nothing.", + "description": [ + "Never auto-merge the Go toolchain, and never let it ride in somebody else's group. A rule that says automerge:false for one dependency is defeated by grouping, because Renovate decides automerge per BRANCH: go 1.27.0 rode into seven repositories inside a branch called renovate/github-actions, whose other dependency was actions/setup-go. Ungrouped, it gets a branch of its own and this setting governs it. It matters because go1.27.0 miscompiles on loong64 (golang/go#81000, bisected on real hardware to 3fdac6780b): go-gfx/gfx fails that lane and stayed open only because the lane failed, which is the CI gate holding rather than this rule. A repository without such a lane sees nothing." + ], "matchManagers": [ "gomod", "github-actions"