fix(renovate): make repo-sync the single writer for synced CI workflows - #132
Merged
Conversation
Extend the scorecard-only rule to all six synced workflow destinations (ci.yaml, codeql.yml, coverage.yml, release.yaml, scorecard.yml, security.yml per cplieger/ci scripts/classify-repos.py). The templates carry the cplieger/ci digest pin, so repo-sync already propagates every ci release fleet-wide; Renovate racing it produced autoclosed digest PRs that reopened without platform automerge re-armed (GitHub drops arming on close, Renovate only arms at creation) and cycled open/autoclosed forever — observed 2026-07-30..08-04 across 13 repos. Excluded: cplieger/ci (canonical source) and cplieger/.github (hand-maintained ci.yaml, not a sync target).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the scorecard-only Renovate disable to all six synced workflow destinations (
ci.yaml,codeql.yml,coverage.yml,release.yaml,scorecard.yml,security.yml), making repo-sync the single writer for thecplieger/cidigest pins they carry.Root cause this fixes: Renovate and repo-sync raced on every ci release. The sync PR usually landed first, Renovate autoclosed its now-redundant digest PR, GitHub permanently dropped auto-merge arming on close, and the next release reopened the PR unarmed (Renovate arms platform automerge only at creation). Result: permanently-green, never-merging digest PRs cycling open/autoclosed across 13 repos (2026-07-30..08-04).
Exclusions:
cplieger/ci(canonical source, Renovate must keep updating pins there) andcplieger/.github(hand-maintainedci.yaml, not a sync target).Tested
cplieger/ci scripts/classify-repos.py(authoritative sync manifest generator).cplieger/ciin these filenames is a sync target except the two exclusions.