[pando85]

Summary

Enable conservative CI-gated automerge for routine dependency updates and keep controller-critical upgrades under manual review.

Automerge rules

• Rust crates >=1.0: patch/minor updates after 14 days and passing CI.
• GitHub Actions and pre-commit hooks: patch/minor updates after 14 days and passing CI.
• futures 0.x: patch-only updates after 14 days and passing CI (based on the successful build(deps): Update Rust crate futures to v0.3.34 #98 migration).
• Explicitly exclude kube-rs, Hetzner hcloud, HTTP/network stack, async runtime, metrics/tracing, and allocator crates.
• Keep all major upgrades and weekly Cargo.lock maintenance manual.
• Group kube, k8s-openapi, and kube-leader-election into one manually reviewed Kubernetes-client PR.

Safety

• Set platformAutomerge: false to avoid GitHub merging before required CI checks have run.
• Keep ignoreTests: false, require Renovate to observe passing checks, and enforce squash merges.
• Keep CI's pre-commit (including cargo test --all-targets --locked), docker-smoke and helm-unittest checks.
• Remove the former renovatebot/pre-commit-hooks automerge override that could auto-merge major upgrades.
• Enable Dependency Dashboard for visibility.

Operational recommendation

GitHub branch protection/rulesets should require pre-commit, docker-smoke, and helm-unittest before merging to guard against missing or bypassed checks. GitHub App permissions do not currently allow inspecting/updating repository branch protection, so that admin-side guard still needs verification.

No existing kube-rs or hcloud compatibility change is auto-merged by these rules.