webgrip/renovate-config
5
0
Fork 0
Code Issues Pull requests 1 Projects Releases 7 Packages Wiki Activity Actions

chore: split the OCI grouping decision out of the pinDigests mechanism rule #15

Open
gitea_admin wants to merge 1 commit from chore/split-oci-group-rule into main
pull from: chore/split-oci-group-rule
merge into: webgrip:main
Conversation 0 Commits 1 Files changed 1 +16 -3
gitea_admin commented 2026-08-06 05:01:36 +00:00
First-time contributor
Copy link

One rule was doing two unrelated jobs, and it cost us: pinDigests: false is a correctness requirement (Renovate would append @sha256 to the OCIRepository tag value; spec.ref.digest is a separate YAML key), while groupName: "Flux OCI Helm charts" is a policy choice with a real trade-off — one grouped PR saves CI, but rollback becomes all-or-nothing and the branch fails atomically (one unresolvable chart blocks the rest).

Because the group rode inside a rule whose description only talks about digest handling, nobody read the grouping as a decision. In homelab-cluster it bundled fifteen unrelated charts (cert-manager, coredns, kyverno, envoy-gateway among them) into single automerging commits until it was split locally (homelab .renovaterc.json5, Flux OCI Helm charts (platform)).

Behaviour is unchanged — both rules keep identical matchers and Renovate merges matching packageRules field-by-field. Consumers can now override grouping without re-stating (or accidentally losing) the digest mechanism, and each description names what its rule is for.

chore: on purpose: behaviour-neutral, no release needed; it rides the next feat/fix release.

🤖 Generated with Claude Code

One rule was doing two unrelated jobs, and it cost us: `pinDigests: false` is a **correctness requirement** (Renovate would append `@sha256` to the OCIRepository tag value; `spec.ref.digest` is a separate YAML key), while `groupName: "Flux OCI Helm charts"` is a **policy choice** with a real trade-off — one grouped PR saves CI, but rollback becomes all-or-nothing and the branch fails atomically (one unresolvable chart blocks the rest). Because the group rode inside a rule whose description only talks about digest handling, nobody read the grouping as a decision. In homelab-cluster it bundled fifteen unrelated charts (cert-manager, coredns, kyverno, envoy-gateway among them) into single **automerging** commits until it was split locally (homelab `.renovaterc.json5`, `Flux OCI Helm charts (platform)`). **Behaviour is unchanged** — both rules keep identical matchers and Renovate merges matching packageRules field-by-field. Consumers can now override grouping without re-stating (or accidentally losing) the digest mechanism, and each description names what its rule is for. `chore:` on purpose: behaviour-neutral, no release needed; it rides the next feat/fix release. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
chore: split the OCI grouping decision out of the pinDigests mechanism rule
All checks were successful
Validate Renovate presets / validate (safe-automerge.json) (pull_request) Successful in 7m57s
Details
Validate Renovate presets / validate (grouped.json) (pull_request) Successful in 8m7s
Details
Validate Renovate presets / validate (default.json) (pull_request) Successful in 8m7s
Details
Validate Renovate presets / validate all presets (pull_request) Successful in 7m56s
Details
3e5999bbbf 
One rule was doing two unrelated jobs. pinDigests: false is a correctness
requirement — Renovate would otherwise append @sha256 to the OCIRepository tag
value, when spec.ref.digest is a separate YAML key owned by repo-local
post-upgrade tasks. groupName "Flux OCI Helm charts" is a policy choice with a
real trade-off: a grouped PR saves CI (one pipeline run instead of N) but makes
rollback all-or-nothing and fails atomically — one unresolvable chart aborts the
whole group's branch.

Because the group rode inside a rule whose description only talks about digest
handling, the grouping was never read as a decision. In homelab-cluster it
bundled fifteen unrelated charts (cert-manager, coredns, kyverno, envoy-gateway
among them) into single automerging commits until it was split locally.

Behaviour is unchanged: both rules keep identical matchers, and Renovate merges
matching packageRules field-by-field, so the net config is the same. What changes
is that a consumer can now override the grouping policy without re-stating (or
accidentally losing) the pinDigests mechanism, and each rule's description names
what it is actually for.

No release needed — behaviour-neutral; rides the next feat/fix release.
All checks were successful
Validate Renovate presets / validate (safe-automerge.json) (pull_request) Successful in 7m57s
Details
Validate Renovate presets / validate (grouped.json) (pull_request) Successful in 8m7s
Details
Validate Renovate presets / validate (default.json) (pull_request) Successful in 8m7s
Details
Validate Renovate presets / validate all presets (pull_request) Successful in 7m56s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/split-oci-group-rule:chore/split-oci-group-rule
git switch chore/split-oci-group-rule

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff chore/split-oci-group-rule
git switch chore/split-oci-group-rule
git rebase main
git switch main
git merge --ff-only chore/split-oci-group-rule
git switch chore/split-oci-group-rule
git rebase main
git switch main
git merge --no-ff chore/split-oci-group-rule
git switch main
git merge --squash chore/split-oci-group-rule
git switch main
git merge --ff-only chore/split-oci-group-rule
git switch main
git merge chore/split-oci-group-rule
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/renovate-config!15
No description provided.