Enable automerge for dependency updates

[bsquizz]

No description provided.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 1906ce23-0d4f-4681-9b85-75120696d397

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

HyperShell environment deploying

Deploying commit e1d9203 to an ephemeral OpenShift environment. This
comment will update in place once the environment is ready.

[amber-review-bot]

Amber review

Status: Complete

View the submitted review.

[amber-review-bot]

Verdict

This PR turns on Renovate automerge for grouped dependency updates, adds a Tekton manager block scoped to .tekton/**, and pulls in the Konflux cve-automerge-critical preset. The head commit cc6455c narrows the blast radius by removing automerge from the OpenShell gateway/supervisor runtime images, and renovate.json parses as valid strict JSON; the remaining items are config-consistency, policy-confirmation, and one cross-PR ordering question.

Findings

[Minor] New tekton block uses the deprecated fileMatch key (renovate.json:10)
The tekton manager block declares "fileMatch": ["\\.yaml$", "\\.yml$"], but the existing customManagers entry in the same file uses the current managerFilePatterns key. Renovate renamed fileMatch to managerFilePatterns; the old key still works but emits a config-deprecation warning and is inconsistent within one file. This is already tracked in an existing inline thread (discussion r4020145353); rename to managerFilePatterns for consistency.

[Minor] Automerge still covers production npm deps, container images, and .tekton/** pipelines (renovate.json)
cc6455c removed automerge from the OpenShell runtime-image group, which is a good reduction of risk. automerge: true still applies to npm production/optional dependencies, dockerfile container images, GitHub Actions, Go indirect deps, the cve-automerge-critical preset, and Tekton pipeline definitions under .tekton/**. Auto-merging production dependencies and pipeline definitions without human review is a supply-chain policy decision; it is mitigated by minimumReleaseAge: 14 days, internalChecksFilter: strict, and required CI. No action required if deliberate - please confirm intent.

[Minor] PR title / squashed commit is not a conventional commit (commit discipline)
The PR title Enable automerge for dependency updates and the commit subjects (Remove trailing comma, Disable automerge of openshell images) are not type(scope): description. Since commits are squashed on merge, please reword the squash message, e.g. chore(renovate): enable automerge for grouped dependency updates.

Cross-PR coordination

Renovate platform automerge routes merges through GitHub's native auto-merge, which enqueues into the repository merge queue, so the merge-queue gate is what actually protects auto-merged dependency and pipeline updates. On main today the merge queue (merge_group) exercises only the Kind e2e path; the OpenShift e2e job runs on push to main (.github/workflows/e2e-openshift-main.yml) but there is no merge_group-triggered OpenShift gate. PR #287 introduces exactly that gate (.github/workflows/e2e-openshift-merge-queue.yml, triggered on merge_group). Enabling automerge here - including for container images and .tekton/** pipelines - before that OpenShift merge-queue gate lands and is marked required means dependency/pipeline updates can auto-merge on Kind-only coverage. Maintainers should decide the merge order: land and require the OpenShift merge-queue e2e workflow (PR #287) before, or together with, turning on automerge, or confirm that the merge-queue routing is acceptable until then.

Previous concerns

• Major - Trailing comma makes renovate.json invalid strict JSON: Addressed. The final packageRules object no longer has a trailing comma; the file ends "groupName": "OpenShell images"\n }\n ]\n} and python3 -c "import json; json.load(open('renovate.json'))" succeeds against the current head cc6455c.
• Minor - New tekton block uses deprecated fileMatch: Still present. renovate.json:10 still declares "fileMatch": ["\\.yaml$", "\\.yml$"] while managerFilePatterns is used elsewhere in the same file.
• Minor - Automerge extended to production deps, runtime images, and Tekton pipelines: Partially addressed. cc6455c removed automerge from the OpenShell gateway/supervisor runtime-image group, so runtime image references no longer auto-merge. Automerge remains on npm production deps, container images, GitHub Actions, Go indirect deps, the CVE preset, and .tekton/**; restated above as a policy confirmation.
• Minor - PR title / squashed commit is not a conventional commit: Still present. The PR title is unchanged and the new commit subjects are not type(scope): ....

Findings Summary (ordered by severity, highest first):

1. [Minor] New tekton block uses deprecated fileMatch instead of managerFilePatterns - Config Consistency (L10)
2. [Minor] Automerge still covers production npm deps, container images, and .tekton/** pipelines - Policy / Supply Chain
3. [Minor] PR title / squashed commit is not a conventional commit - Commit Discipline

Convention Checklist:

Convention	Result
Valid JSON / config well-formed	Pass
Separate configuration from code	Pass
Config keys consistent (no deprecated keys)	Fail
Conventional commit message	Fail