From aa0d1dea5672d8fb94816d870b5273dfaf445ce2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rapha=C3=ABl=20DUCOM?= <raphael.ducom@gmail.com>
Date: Mon, 17 Aug 2026 00:17:36 +0200
Subject: [PATCH] ci(renovate): drop unreachable automerge, freeze the macOS
 runner, track the inline zizmor pin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three fixes found while auditing why Renovate had gone quiet (root cause is
Silent mode on the Mend side, not this file):

- The github-actions group asked for automerge, but the "main protect" ruleset
  requires an approving review with a bypass limited to org admins. The bot
  cannot merge, so the PRs sat open on a green CI. Granting the app a bypass
  would hand it a blanket waiver on every dependency PR, digest bumps of
  third-party actions included — not a trade this repo's supply-chain posture
  wants.
- runs-on is the SDK we compile against, not the deployment target (that lives
  in Package.swift). Moving to macos-26 would opt the app into the macOS 26
  design language and leave no macOS 15 machine in CI, so it is a product
  decision rather than a weekly PR.
- CI pinned zizmor==1.25.2 inline while the pre-commit hook was already on
  v1.26.1, despite the comment claiming they match. A regex manager now tracks
  the pin and groups it with the hook so the two move together.

Verified with `renovate --platform=local`: the pin extracts as
zizmorcore/zizmor 1.25.2, and macos no longer yields any update.
---
 renovate.json | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/renovate.json b/renovate.json
index e517d45..7da91d1 100644
--- a/renovate.json
+++ b/renovate.json
@@ -6,12 +6,34 @@
   "labels": ["dependencies"],
   "vulnerabilityAlerts": { "enabled": true, "schedule": ["at any time"], "labels": ["security"] },
   "pre-commit": { "enabled": true },
+  "customManagers": [
+    {
+      "description": "CI pins zizmor inline (pipx run zizmor==X); the pre-commit manager cannot see it.",
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"],
+      "matchStrings": ["zizmor==(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
+      "depNameTemplate": "zizmorcore/zizmor",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    }
+  ],
   "packageRules": [
     {
+      "description": "No automerge: the 'main protect' ruleset requires an approving review the bot cannot bypass.",
       "matchManagers": ["github-actions"],
       "groupName": "github-actions",
-      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
-      "automerge": true
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"]
+    },
+    {
+      "description": "The runner image is the SDK we build against: macOS 26 would opt the app into the new design language and leave no macOS 15 machine in CI. Deliberate bump only — see platforms in Package.swift for the actual deployment target.",
+      "matchDatasources": ["github-runners"],
+      "matchPackageNames": ["macos"],
+      "enabled": false
+    },
+    {
+      "description": "Keep the inline CI pin and the pre-commit hook in one PR so they never drift.",
+      "matchPackageNames": ["zizmorcore/zizmor", "zizmorcore/zizmor-pre-commit"],
+      "groupName": "zizmor"
     },
     { "matchDatasources": ["docker"], "groupName": "docker base images" }
   ]