From 85d0068727e689092f921d1163c30dfb611e7fc3 Mon Sep 17 00:00:00 2001
From: Erik Godding Boye <egboye@gmail.com>
Date: Tue, 2 Sep 2025 17:17:24 +0200
Subject: [PATCH 1/3] ci(renovate): remove redundant match all packages

Signed-off-by: Erik Godding Boye
---
 .github/renovate.json5                                   | 9 ---------
 .../base-dependabot/.github/renovate.json5               | 6 ------
 2 files changed, 15 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index ef25e456..05e95a89 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -56,18 +56,12 @@
       matchManagers: [
         'custom.regex',
       ],
-      matchPackageNames: [
-        '*',
-      ]
     },
     {
       groupName: 'Misc GitHub actions',
       matchManagers: [
         'github-actions',
       ],
-      matchPackageNames: [
-        '*',
-      ],
       enabled: true,
       matchBaseBranches: [
         'octo-sts-poc',
@@ -78,9 +72,6 @@
       matchManagers: [
         'gomod',
       ],
-      matchPackageNames: [
-        '*',
-      ],
     },
   ],
   ignorePaths: [
diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5
index bd8871c6..2a43e913 100644
--- a/modules/repository-base/base-dependabot/.github/renovate.json5
+++ b/modules/repository-base/base-dependabot/.github/renovate.json5
@@ -37,9 +37,6 @@
       matchManagers: [
         'gomod',
       ],
-      matchPackageNames: [
-        '*',
-      ],
     },
     {
       groupName: 'Testing Go deps',
@@ -109,9 +106,6 @@
       matchManagers: [
         'gomod',
       ],
-      matchPackageNames: [
-        '*',
-      ],
       matchCurrentValue: 'v0.0.0*',
       enabled: false,
     },

From 643724c6024e72b4877c2badc8d908810ed373b3 Mon Sep 17 00:00:00 2001
From: Erik Godding Boye <egboye@gmail.com>
Date: Tue, 2 Sep 2025 17:53:18 +0200
Subject: [PATCH 2/3] ci(renovate): move postUpgradeTasks into packageRules

Signed-off-by: Erik Godding Boye
---
 .github/renovate.json5 | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 05e95a89..14f3cd5b 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -28,12 +28,6 @@
       ],
     },
   ],
-  postUpgradeTasks: {
-    commands: [
-      'make vendor-go learn-tools-shas',
-    ],
-    executionMode: 'branch',
-  },
   baseBranchPatterns: [
     'main',
     'octo-sts-poc',
@@ -56,6 +50,12 @@
       matchManagers: [
         'custom.regex',
       ],
+      postUpgradeTasks: {
+        commands: [
+          'make vendor-go learn-tools-shas',
+        ],
+        executionMode: 'branch',
+      }
     },
     {
       groupName: 'Misc GitHub actions',

From 94a2d121fac1285979abc29a803ae33ec150e563 Mon Sep 17 00:00:00 2001
From: Erik Godding Boye <egboye@gmail.com>
Date: Tue, 2 Sep 2025 18:16:10 +0200
Subject: [PATCH 3/3] ci(renovate): dependencyDashboardApproval for
 major/digest upgrades

Signed-off-by: Erik Godding Boye
---
 .github/renovate.json5                            | 11 +++++++++++
 .../base-dependabot/.github/renovate.json5        | 15 ++++++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 14f3cd5b..5416f8ef 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -73,6 +73,17 @@
         'gomod',
       ],
     },
+    {
+      matchManagers: [
+        'custom.regex',
+        'gomod',
+      ],
+      matchUpdateTypes: [
+        'major',
+        'digest',
+      ],
+      dependencyDashboardApproval: true
+    }
   ],
   ignorePaths: [
     '**/vendor/**',
diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5
index 2a43e913..4477854a 100644
--- a/modules/repository-base/base-dependabot/.github/renovate.json5
+++ b/modules/repository-base/base-dependabot/.github/renovate.json5
@@ -102,10 +102,23 @@
       ],
     },
     {
-      description: 'Disable Go pseudo-version updates',
       matchManagers: [
         'gomod',
       ],
+      matchUpdateTypes: [
+        'major',
+        'digest',
+      ],
+      dependencyDashboardApproval: true
+    },
+    {
+      description: 'Disable (internal) cert-manager pseudo-version updates',
+      matchManagers: [
+        'gomod',
+      ],
+      matchPackageNames: [
+        'github.com/cert-manager/**',
+      ],
       matchCurrentValue: 'v0.0.0*',
       enabled: false,
     },