fix(renovate): let Renovate pin references to this repo - #96
Merged
Conversation
The pinDigests rule excluded reqstool/*, so consumers' references to this repo were never pinned and stayed on a mutable @main. The exclusion was written when the only first-party references were inside this repo, where $/ makes pinning moot -- but this config is extended by every repo in the org, so it reached much further than intended. With consumers now pinning to the 1.0.0 tag, this rule is what keeps those pins current: Renovate bumps the digest and rewrites the version comment on each new tag here. actions/* and github/* stay excluded, unchanged -- they sit inside the same trust boundary as the runner. Closes #25. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #25.
Description
renovate.json5'spinDigestsrule excludedreqstool/*, so every consumer's references to this repo went unpinned and stayed on a mutable@main.That exclusion was written when the only first-party references were inside this repo, where
$/makes pinning moot. But this config is extended by every repo in the org, so it reached much further than intended — it's the reason 63@mainreferences accumulated across 12 repos, and why CodeQL'sactions/unpinned-tagfired twice this week while the PyPI publish path was being fixed.actions/*andgithub/*stay excluded, unchanged — they sit inside the same trust boundary as the runner, and pinning them would trade the major-tag automerge for a digest bump per action per week.Merge order
This merges last. 1.0.0 is tagged, and 12 companion PRs move every consumer to
@<sha> # 1.0.0. Merging this first would have Renovate pin the@mainrefs mid-sweep, which is the wrong end state.Checklist
git commit -s).Test plan
Parsed locally as JSON5 (29 packageRules).
validate-renovateon this PR is the real check. After merge, the proof is Renovate opening a digest-bump PR against the consumers on the next tag here rather than staying silent.