From 75679f7c03211309637e457d09d2f25a594351e9 Mon Sep 17 00:00:00 2001
From: cplieger <917744+cplieger@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:11:24 +0200
Subject: [PATCH] feat(renovate): automerge lock file maintenance PRs

lockFileMaintenance joins the automerge allowlist. It was left out when
3f827de replaced the global automerge=true with an explicit update-type
allowlist, which made the weekly batch (~10 repos, one PR per lockfile)
go green in about a minute and then sit until merged by hand. That
hand-merge reviewed nothing: a regenerated lockfile is not meaningfully
reviewable, and the PRs are structurally release-inert because lockfiles
sit in the CI detect job's path-exclusion list, so a lockfile-only push
cannot publish or tag. rollback, replacement and bump still fail closed.

Verified against Renovate 44.7.3's own code rather than by inspection:
applyPackageRules from dist/util/package-rules, fed a synthetic config
per update type, flips exactly one cell (lockFileMaintenance false ->
true) with patch/minor still true and major/rollback/bump/replacement
still false. flatten.js confirms packageRules do apply to the
lock-file-maintenance config, and that dep-level matchers (the git-cliff
and tool-registry automerge=false rules) cannot match it.

renovate-config-validator --strict passes but does not gate this change:
it rejects a typo'd matcher key while silently accepting a bogus enum
value inside matchUpdateTypes.
---
 default.json | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/default.json b/default.json
index 40f24b3..312f551 100644
--- a/default.json
+++ b/default.json
@@ -17,13 +17,14 @@
   "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
-      "description": "Auto-merge routine update types. Deliberately an explicit allowlist instead of a global automerge=true so the remaining types (rollback, replacement, bump, lockFileMaintenance) fail closed to manual review. pinDigest is included because it is the same trust class as pin/digest (one-time action-digest pinning).",
+      "description": "Auto-merge routine update types. Deliberately an explicit allowlist instead of a global automerge=true so the remaining types (rollback, replacement, bump) fail closed to manual review. pinDigest is included because it is the same trust class as pin/digest (one-time action-digest pinning). lockFileMaintenance is included because its PRs are structurally release-inert (lockfiles are in the CI detect job's path-exclusion list, so a lockfile-only push cannot publish or tag) and only ever move transitive versions inside already-declared ranges; leaving it out produced ~10 permanently-green PRs every Monday whose weekly hand-merge was pure toil, not review. Renovate does apply packageRules to the lock-file-maintenance config (flatten.ts calls applyPackageRules twice on it with updateType set), so matching it here is enough.",
       "matchUpdateTypes": [
         "minor",
         "patch",
         "digest",
         "pin",
-        "pinDigest"
+        "pinDigest",
+        "lockFileMaintenance"
       ],
       "automerge": true
     },