From 8140f8ff7972f24455cd78d31797933d393dc76f Mon Sep 17 00:00:00 2001
From: John Eckersberg <dev@eckersberg.com>
Date: Tue, 6 Oct 2026 13:47:00 -0400
Subject: [PATCH] renovate: Fix ignoring gh-aw managed actions

The rule added in #269 to disable updates in gh-aw managed workflow
files (.github/workflows/*.lock.yml) had no effect: Renovate applies
matching packageRules in order with later rules winning, and the
"GitHub Actions" group rule later in the list sets "enabled": true,
re-enabling those deps. As a result Renovate kept bumping
github/gh-aw-actions in the compiled lock files, e.g.
https://github.com/bootc-dev/bootc/pull/2478#discussion_r4066207557

Move the rule to the end of packageRules so it takes precedence, and
additionally disable github/gh-aw-actions everywhere, since its
versions are managed by the gh-aw compiler, per
https://github.github.com/gh-aw/reference/dependabot/#compiler-managed-gh-aw-actions-ignore-rule

Verified with a local Renovate dry run against bootc: before this
change gh-aw-actions in *.lock.yml got an update to v0.91.1, after
it they are reported as disabled while other actions still update.

Assisted-by: AI
Signed-off-by: John Eckersberg <dev@eckersberg.com>
---
 renovate-shared-config.json | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/renovate-shared-config.json b/renovate-shared-config.json
index 113fe97..d1868a4 100644
--- a/renovate-shared-config.json
+++ b/renovate-shared-config.json
@@ -100,15 +100,6 @@
       "timezone": "UTC",
       "updateNotScheduled": false
     },
-    // Ignore gh-aw managed workflow files — they are regenerated by the compiler.
-    {
-      "description": ["Ignore gh-aw managed workflow files"],
-      "matchFileNames": [
-        ".github/workflows/*.md",
-        ".github/workflows/*.lock.yml"
-      ],
-      "enabled": false
-    },
     // These files in these repos are synced from the bootc-dev/infra repository, which
     // sends PRs to update them. Ignoring them here to avoid conflicting Renovate updates.
     {
@@ -286,6 +277,25 @@
     {
       "matchDatasources": ["custom.rust-nightly"],
       "versioning": "rust-release-channel"
+    },
+    // Ignore gh-aw managed workflow files — they are regenerated by the compiler.
+    //
+    // These rules MUST stay last: later matching rules win, and the group
+    // rules above set "enabled": true, which would otherwise re-enable these.
+    {
+      "description": ["Ignore gh-aw managed workflow files"],
+      "matchFileNames": [
+        ".github/workflows/*.md",
+        ".github/workflows/*.lock.yml"
+      ],
+      "enabled": false
+    },
+    // gh-aw-actions versions are pinned and managed by the gh-aw compiler.
+    // See: https://github.github.com/gh-aw/reference/dependabot/#compiler-managed-gh-aw-actions-ignore-rule
+    {
+      "description": ["Ignore compiler-managed gh-aw actions"],
+      "matchPackageNames": ["github/gh-aw-actions{/,}**"],
+      "enabled": false
     }
   ]
 }