From 919c273e13786795cb1b0b9a7d6ebce1d2289bbf Mon Sep 17 00:00:00 2001
From: Alexander Gil Casas <pando855@gmail.com>
Date: Wed, 14 Oct 2026 20:31:22 +0200
Subject: [PATCH 1/2] chore(renovate): restrict automerge to low-risk passing
 upgrades

---
 renovate.json | 49 +++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 39 insertions(+), 10 deletions(-)

diff --git a/renovate.json b/renovate.json
index 1d56004..e560857 100644
--- a/renovate.json
+++ b/renovate.json
@@ -52,30 +52,59 @@
       ]
     },
     {
-      "matchUpdateTypes": [
-        "patch"
+      "description": "Automerge non-breaking stable Rust dependencies after CI and a short release soak",
+      "matchManagers": [
+        "cargo"
       ],
       "matchCurrentVersion": "!/^0/",
+      "matchUpdateTypes": [
+        "patch",
+        "minor"
+      ],
       "automerge": true,
       "automergeType": "pr",
-      "ignoreTests": false,
       "platformAutomerge": true,
-      "matchPackageNames": [
-        "/.*/"
-      ]
+      "ignoreTests": false,
+      "minimumReleaseAge": "3 days"
     },
     {
+      "description": "Automerge non-major GitHub Actions and pre-commit updates after CI",
+      "matchManagers": [
+        "github-actions",
+        "pre-commit"
+      ],
       "matchUpdateTypes": [
+        "patch",
         "minor"
       ],
-      "matchCurrentVersion": "!/^0/",
       "automerge": true,
       "automergeType": "pr",
-      "ignoreTests": false,
       "platformAutomerge": true,
+      "ignoreTests": false,
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Never automerge controller-critical dependencies, even when their version looks stable",
       "matchPackageNames": [
-        "/.*/"
-      ]
+        "kube",
+        "kube-core",
+        "kube-client",
+        "kube-runtime",
+        "kube-derive",
+        "k8s-openapi",
+        "kube-leader-election",
+        "hcloud",
+        "tower-http",
+        "tikv-jemallocator",
+        "hyper",
+        "hyper-util",
+        "opentelemetry",
+        "opentelemetry_sdk",
+        "opentelemetry-otlp",
+        "opentelemetry-semantic-conventions",
+        "tracing-opentelemetry"
+      ],
+      "automerge": false
     },
     {
       "matchPackageNames": [

From 20a2e8972ee3b6049eb815e6bd45d7a2c34bf71b Mon Sep 17 00:00:00 2001
From: Alexander Gil Casas <pando855@gmail.com>
Date: Wed, 14 Oct 2026 21:38:53 +0200
Subject: [PATCH 2/2] fix(renovate): gate automerge on CI and group kube
 upgrades

---
 renovate.json | 60 +++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 49 insertions(+), 11 deletions(-)

diff --git a/renovate.json b/renovate.json
index e560857..6e032ab 100644
--- a/renovate.json
+++ b/renovate.json
@@ -63,9 +63,9 @@
       ],
       "automerge": true,
       "automergeType": "pr",
-      "platformAutomerge": true,
+      "platformAutomerge": false,
       "ignoreTests": false,
-      "minimumReleaseAge": "3 days"
+      "minimumReleaseAge": "14 days"
     },
     {
       "description": "Automerge non-major GitHub Actions and pre-commit updates after CI",
@@ -79,9 +79,27 @@
       ],
       "automerge": true,
       "automergeType": "pr",
-      "platformAutomerge": true,
+      "platformAutomerge": false,
       "ignoreTests": false,
-      "minimumReleaseAge": "3 days"
+      "minimumReleaseAge": "14 days"
+    },
+    {
+      "description": "Automerge tested patch updates of futures 0.x only; other pre-1.0 crates are reviewed",
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchPackageNames": [
+        "futures"
+      ],
+      "matchCurrentVersion": "/^0\\./",
+      "matchUpdateTypes": [
+        "patch"
+      ],
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": false,
+      "ignoreTests": false,
+      "minimumReleaseAge": "14 days"
     },
     {
       "description": "Never automerge controller-critical dependencies, even when their version looks stable",
@@ -102,10 +120,29 @@
         "opentelemetry_sdk",
         "opentelemetry-otlp",
         "opentelemetry-semantic-conventions",
-        "tracing-opentelemetry"
+        "tracing-opentelemetry",
+        "tokio",
+        "tokio-util",
+        "tracing",
+        "tracing-subscriber",
+        "/^kube-/"
       ],
       "automerge": false
     },
+    {
+      "description": "Update kube-rs dependencies as one manually reviewed compatibility group",
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchPackageNames": [
+        "kube",
+        "kube-leader-election",
+        "k8s-openapi"
+      ],
+      "groupName": "kubernetes-client",
+      "groupSlug": "kubernetes-client",
+      "automerge": false
+    },
     {
       "matchPackageNames": [
         "/opentelemetry/",
@@ -118,14 +155,11 @@
       "matchPackageNames": [
         "renovatebot/pre-commit-hooks"
       ],
-      "automerge": true,
-      "automergeType": "pr",
-      "ignoreTests": false,
-      "platformAutomerge": true,
       "schedule": [
         "after 4am and before 10am on the first day of the month"
       ],
-      "enabled": true
+      "enabled": true,
+      "description": "Keep pre-commit-hooks updates monthly; major versions remain manual"
     },
     {
       "matchDatasources": [
@@ -136,5 +170,9 @@
         "/debian/"
       ]
     }
-  ]
+  ],
+  "platformAutomerge": false,
+  "automergeStrategy": "squash",
+  "ignoreTests": false,
+  "dependencyDashboard": true
 }