fix: require review for GitHub Actions minor/patch updates

[Danathar]

Closes #1074

Summary

• Add a final repository package rule that disables automerge for github-actions minor and patch updates.
• Keep the existing digest/pin automation and non-GitHub-Actions minor/patch automation.
• Add static regression coverage for rule ordering and values.
• Document package-rule precedence and grouped-branch automerge behavior.

Effective behavior before

The inherited projectbluefin/renovate-config rules automerged digest, pin, patch, and minor updates, including a GitHub Actions non-major grouping rule and a separate projectbluefin/actions automerge rule. common/renovate.json then enabled GitHub-native platform automerge for the same update types. The current open Renovate PR #1144 has the inherited github-actions (non-major) group name and reports Automerge: Enabled, confirming that the inherited layer is active.

Renovate's live config filename order is renovate.json, then .github/renovate.json, .github/renovate.jsonc, and .github/renovate.json5; it stops at the first existing file. Therefore the root renovate.json is the active repository config. A live Renovate run on this repository reports managers dockerfile (1 file / 9 dependencies), github-actions (11 / 40), and renovate-config; it reports no custom.regex manager. If .github/renovate.json5 were active, its enabledManagers: ["github-actions", "custom.regex"] would also disable the observed dockerfile manager.

This makes .github/renovate.json5 a real tracking gap, not just duplicate configuration: its two custom.regex managers are inactive, so the wallpaper COPY --from= digest and BONEDIGGER_VERSION pins are not being tracked even though docs/skills/ci-tooling/references/renovate-and-tools.md says they are. Its stale GitHub Actions automerge rule would also re-arm if the root file were removed or config selection changed.

This PR intentionally leaves that separate configuration repair out of #1074. Open issue #1147 owns the concrete common fix. #433 was closed as completed after its custom-manager remediation was added to the inactive .github/renovate.json5; the wallpaper-digest part of that remediation therefore never took effect. #1147 explicitly supersedes that incomplete result and should determine whether #433 is reopened. The broader audit RFC #1103 records this as evidence for its organization-wide proposal, but does not replace the repository-specific repair.

Rule interaction and fix

Renovate evaluates all matching packageRules entries in order; later entries override earlier values. The new rule is last in common/renovate.json, matches github-actions plus minor/patch, and sets automerge: false. It therefore overrides both inherited GitHub Actions automerge rules and the local broad automerge rule.

The rule intentionally also gates projectbluefin/actions. The issue targets the github-actions manager, and no approved policy exception exists for first-party actions. Digest and pin automation remains the safe content-addressed path.

The inherited github-actions (non-major) grouping remains intact. Renovate computes branch automerge as the logical AND of the grouped upgrades' automerge values, so a mixed digest plus minor/patch group waits for human review as a whole; digest-only groups continue to automerge.

Result

• GitHub Actions minor updates: human review required.
• GitHub Actions patch updates: human review required.
• GitHub Actions digest and pin updates: continue to automerge.
• Non-GitHub-Actions digest, pin, patch, and minor updates: retain existing automerge behavior.
• Major updates: continue to require human review.

Validation

• npx --yes --package renovate@44.101.3 renovate-config-validator --strict --no-global renovate.json
• just check
• uv run --with pytest pytest tests/test_renovate_config.py -q
• PATH=/tmp/omp-precommit/bin:$PATH PYTHONPATH=/tmp/omp-precommit/lib/python3.14/site-packages uvx pre-commit run --all-files
• git diff --check
• Renovate package-rule evaluation against the live inherited configuration and local configuration: minor/patch actions resolve to automerge: false, digest/pin actions resolve to automerge: true, projectbluefin/actions minor resolves to false, and an npm minor remains true.

[kubestellar-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.78