From 7771d70f906ba008e947c4fa60dfe5dcc1aba77a Mon Sep 17 00:00:00 2001
From: charliie-dev <charles@nics.nat.gov.tw>
Date: Fri, 17 Jul 2026 01:56:34 +0800
Subject: [PATCH 1/2] chore(renovate): group go toolchain across managers to
 prevent drift
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Go's version lives in three managers — go.mod (gomod), dhi.io/golang
(dockerfile), and mise.toml (mise) — each in its own per-manager group, so
their bumps opened as separate PRs that merged out of step (mise's went in
while go.mod and the base image lagged). Add a packageRule grouping depName
`go` and `dhi.io/golang` into one `go toolchain` group with dashboard
approval off, so the combined bump opens as a single reviewable PR.

Surfaced by nics-dp/otel-bundle#125.
---
 renovate-preset.json | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/renovate-preset.json b/renovate-preset.json
index 70e4cc0..f9c8f0a 100644
--- a/renovate-preset.json
+++ b/renovate-preset.json
@@ -281,6 +281,24 @@
         "github.com/nics-dp/**"
       ],
       "enabled": false
+    },
+    {
+      "description": "Keep the Go toolchain version in lockstep across managers so it can't drift (the failure mode where mise's `go` PR merges while go.mod's `go` directive and the dhi.io/golang base image lag behind). go.mod (gomod) and mise (mise) both resolve to depName `go`; dhi.io/golang is the dockerfile base image; repos may also add a README custom manager on depName `go`. Grouping them opens one combined PR instead of three that race. dependencyDashboardApproval is disabled here so the combined bump opens directly (overriding the gomod dashboard-only rule above for `go`), and automerge is off so a human reviews the single PR. Placed last to override the per-manager groups above for these deps.",
+      "matchDepNames": [
+        "go",
+        "dhi.io/golang"
+      ],
+      "groupName": "go toolchain",
+      "commitMessagePrefix": "chore(go.toolchain):",
+      "labels": [
+        "dependencies",
+        "go"
+      ],
+      "automerge": false,
+      "dependencyDashboardApproval": false,
+      "assignees": [
+        "charliie-dev"
+      ]
     }
   ]
 }

From 170a6dda2899c9e5a779d902ab5aee00d58750b2 Mon Sep 17 00:00:00 2001
From: charliie-dev <charles@nics.nat.gov.tw>
Date: Fri, 17 Jul 2026 02:15:53 +0800
Subject: [PATCH 2/2] fix(renovate): scope go-toolchain group to its managers,
 soften drift claim

Copilot review on #288 flagged two real issues:
- matchDepNames alone matched `go` across every ecosystem (e.g. an npm
  package named `go`) and would have overridden its dashboard-approval
  policy. Add matchManagers [gomod, mise, dockerfile, custom.regex] so the
  rule only touches the intended Go toolchain deps.
- groupName batches whatever updates are available in a run; it does not
  wait for all members or force identical versions. Reword the description
  to claim a narrowed drift window rather than lockstep.
---
 renovate-preset.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/renovate-preset.json b/renovate-preset.json
index f9c8f0a..e679e28 100644
--- a/renovate-preset.json
+++ b/renovate-preset.json
@@ -283,7 +283,13 @@
       "enabled": false
     },
     {
-      "description": "Keep the Go toolchain version in lockstep across managers so it can't drift (the failure mode where mise's `go` PR merges while go.mod's `go` directive and the dhi.io/golang base image lag behind). go.mod (gomod) and mise (mise) both resolve to depName `go`; dhi.io/golang is the dockerfile base image; repos may also add a README custom manager on depName `go`. Grouping them opens one combined PR instead of three that race. dependencyDashboardApproval is disabled here so the combined bump opens directly (overriding the gomod dashboard-only rule above for `go`), and automerge is off so a human reviews the single PR. Placed last to override the per-manager groups above for these deps.",
+      "description": "Collapse the Go toolchain's separate per-manager update PRs into one. go.mod (gomod), mise.toml (mise), the dhi.io/golang base image (dockerfile), and a downstream README copy (custom.regex) all track the same Go version but live in different manager groups, so they used to open and merge as independent PRs (e.g. nics-dp/otel-bundle#123's mise bump merged while go.mod and the image lagged). matchManagers scopes this to exactly those managers, so an unrelated dep named `go` in another ecosystem (e.g. an npm package) is not swept in — and its update policy is left untouched. dependencyDashboardApproval is off so the combined bump opens directly (overriding the gomod dashboard-only rule above for these deps); automerge is off so a human reviews the single PR. Note: groupName batches whatever updates are available in a given run — it does not wait for every member nor force identical versions across datasources, so this narrows the drift window rather than guaranteeing lockstep. Placed last to override the per-manager groups above.",
+      "matchManagers": [
+        "gomod",
+        "mise",
+        "dockerfile",
+        "custom.regex"
+      ],
       "matchDepNames": [
         "go",
         "dhi.io/golang"