feat(renovate): gate Go toolchain minor-line bumps behind manual approval - #128
Merged
Conversation
…oval Go's version scheme is not semver: the leading 1 is frozen by the compatibility promise, so Go's `minor` is the real breaking axis. Go 1.27 alone moves Unicode 15 to 17, re-backs encoding/json on the v2 implementation, changes the DEFLATE encoder's output bytes, and removes the asynctimerchan GODEBUG. Without this rule the blanket automerge-routine-update-types rule treats that as an ordinary minor and merges it unattended in every repo the day it reaches go.dev's stable list. Scoped to `minor` only, so the stdlib-CVE patch stream the go-directive manager delivers keeps flowing without a human. Covers all four toolchain deps in one rule so no member of the golang toolchain group can drift ahead alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Go's version scheme is not semver. The leading
1is frozen by the compatibility promise, so Go'sminoris the real breaking axis, not a routine update: Go 1.27 alone moves Unicode 15 to 17, re-backsencoding/jsonon the v2 implementation, changes the DEFLATE encoder's output bytes, and permanently removes theasynctimerchanGODEBUG.Without a gate, the
Auto-merge routine update typesrule at the top of this file treats that as an ordinaryminorand merges it unattended in every repo the day the release reaches go.dev's stable list.Scope is deliberately narrow:
minoronly. Go PATCH updates are the stdlib-CVE stream the go-directive customManager exists to deliver, and they must keep flowing without a human. They also reach theFROM golang:two-component pins as a digest bump rather than a version bump, so neither path is touched here.golang(thegolang-versionARG GO_VERSIONpin and the docker builder image), so the wholegolang toolchaingroup carries the gate and no member can drift ahead alone.automerge: falsewins the rule merge, and directly after thegolang toolchaingroup it gates.Labels match homelab's own critical-infra minor gate (
requires-approval+minor-update). The per-release migration surface this protects is inventoried in.kiro/steering/go-stdlib-changelog.md.Validated with
renovate-config-validator(exit 0).