From f5eda3295d73f1cc3a32aaae41322785941806ef Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 2 Sep 2026 17:07:58 +0000
Subject: [PATCH] chore(sync): synced file(s) with cplieger/ci

---
 cliff.toml           | 6 +++++-
 scripts/repin-sha.sh | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/cliff.toml b/cliff.toml
index 44bcb76..c43af7d 100644
--- a/cliff.toml
+++ b/cliff.toml
@@ -107,7 +107,11 @@ exclude_paths = [
   ".github/",                  # CI workflows + pins: never in the artifact
   "**/*.md",                   # docs, incl. fix:-typed README-only edits
   "LICENSE",
-  "alerts.yaml",               # README-companion alert rules (docs artifact)
+  "alerts/",                   # README-companion alert rules, one file per
+                               # expression language (a ruler parses every expr in
+                               # the file it loads, and PromQL/LogQL are mutually
+                               # unparseable, so a mixed single file loads in neither)
+  "alerts.yaml",               # the pre-folder root form, until no repo has one left
   "compose.yaml",              # the root-level example compose
   "tests/",                    # smoke tests: exercised at build, never shipped
   "**/testdata/",
diff --git a/scripts/repin-sha.sh b/scripts/repin-sha.sh
index 6e59910..dac7483 100644
--- a/scripts/repin-sha.sh
+++ b/scripts/repin-sha.sh
@@ -1,4 +1,9 @@
 #!/bin/sh
+# Renovate sha256 repin helper — CANONICAL COPY in cplieger/ci
+# (configs/repin-sha.sh), synced to scripts/repin-sha.sh in every repo with a
+# root Dockerfile by scripts/classify-repos.py. DO NOT edit the synced copy in
+# an app repo — change it here and let the sync land it.
+#
 # Recompute a Dockerfile sha256 integrity pin after Renovate moved its version
 # literal. Run by Renovate itself via postUpgradeTasks, because no datasource
 # publishes a sha256, so the recomputed pin lands in the bump commit.