fix(renovate): apply this organisation's policy to every repository, and tidy after an update - #9
Merged
Merged
Conversation
…and tidy after an update
default.json is a PRESET. It reaches a repository only through an `extends`
naming it; sitting in the organisation applies it to nothing. With
onboarding:false and requireConfig:'optional', an uncovered repository runs on
Renovate's factory defaults and says so only at debug level:
DEBUG: No renovate config file found (repository=...)
Measured 2026-09-03: 77 of the 835 repositories across the 117 organisations
that actually run Renovate carry no config at all. On every one of them the Go
toolchain guard -- written after go 1.27.0 auto-merged into seven repositories,
and because it miscompiles on loong64 (golang/go#81000) -- has never been in
force, and nothing reported it. The tell was in the branch names all along: an
uncovered repository gets renovate/<dep>-0.x, a covered one renovate/deps.
inheritConfig reads default.json before every repository regardless of what that
repository carries. inheritConfigStrict is not decoration: left at its default
of false, a missing file is silent, which is this same failure one level up.
postUpdateOptions carries BOTH gomodTidy and gomodUpdateImportPaths. gomodTidy
alone is inert here -- artifacts.ts skips tidy outright when updateType is
major, and Renovate calls a 0.x minor bump a major, which is nearly every
dependency in this fleet. gomodUpdateImportPaths lifts that gate and rewrites
nothing for a 0.x dependency: its commands are filtered to newMajor > 1.
Proven on go-macos before this landed anywhere else: 33 repositories read the
inherited config with none missing, the three that carried no config now receive
it, the container logged `go mod tidy command included` and ran it, and
`go mod tidy` on the branch Renovate then produced changes nothing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
default.jsonis a preset — it reaches a repository only through anextendsnaming it. Measured 2026-09-03: 77 of 835 repositories across the 117 organisations that run Renovate carry no config at all, so no organisation policy applied to them, including the Go toolchain guard.inheritConfigreads it before every repository regardless.inheritConfigStrict: truebecause the default,false, is silent when the file is missing — the same failure one level up.postUpdateOptionscarries bothgomodTidyandgomodUpdateImportPaths: the first alone is inert, sinceartifacts.tsskips tidy whenupdateTypeis major and Renovate calls a0.xminor bump a major. The second lifts that gate and rewrites nothing for0.x.Proven on
go-macosfirst: 33 repositories read the inherited config, none missing; the container rango mod tidy;go mod tidyon the branch it produced changes nothing.