From fd4766624cd2f2af59b606a3733e75e0ca5b3d69 Mon Sep 17 00:00:00 2001
From: fullsend-code
 <278716306+fullsend-ai-coder[bot]@users.noreply.github.com>
Date: Sat, 8 Aug 2026 14:26:52 +0000
Subject: [PATCH 1/2] fix(#3482): exclude vulnerability PRs from grouped patch
 updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add packageRules entry to renovate.json that sets groupName and
groupSlug to null for vulnerability alerts on gomod packages.
This prevents Renovate from deduplicating standalone security
PRs against grouped patch bundles that may have failing CI.

Also add vulnerabilityAlerts config with security/renovate labels
and unrestricted scheduling so security fixes are processed
immediately.

This addresses a recurring pattern where approved security PRs
(e.g., #3473-3475 for CVE-2026-71556/CVE-2026-71557, and earlier
#3250-3253 for go-git v5.19.1) were autoclosed by Renovate in
favor of months-stale grouped PRs with failing checks.

Note: pre-commit could not run in sandbox (network access
restricted). No Go code changes — config-only change.

Closes #3482
---
 renovate.json | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 940036c1b..d83f04789 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,5 +3,18 @@
   "extends": [
     "github>conforma/.github//config/renovate/renovate.json",
     "helpers:pinGitHubActionDigests"
-  ]
+  ],
+  "packageRules": [
+    {
+      "description": "Keep vulnerability/security PRs standalone so they are not grouped with stalled patch bundles",
+      "matchManagers": ["gomod"],
+      "isVulnerabilityAlert": true,
+      "groupName": null,
+      "groupSlug": null
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "labels": ["security", "renovate"],
+    "schedule": ["at any time"]
+  }
 }

From 6c9b2b9f5597a71485dd099f8288212e830cecde Mon Sep 17 00:00:00 2001
From: cuipinghuo <chuo@redhat.com>
Date: Tue, 15 Sep 2026 23:23:09 -0400
Subject: [PATCH 2/2] fix(#3482): drop ineffective vulnerabilityAlerts schedule
 override

Renovate always ignores `schedule` for vulnerability alerts (it forces
immediate creation via its built-in `force` block), so the previous
`"schedule": ["at any time"]` had no runtime effect and the comment
claiming it bypassed the daily schedule was misleading.

Keep only the `labels` override, which is honored, and correct the
comment to explain that ungrouping and immediate creation already come
from Renovate's force block for vulnerability alerts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 renovate.json | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/renovate.json b/renovate.json
index 85d1ea0ef..e54c198a3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,14 +3,13 @@
   "extends": [
     "github>conforma/.github//config/renovate/renovate.json"
   ],
-  // Vulnerability/security fixes are already kept as standalone PRs: Renovate
-  // internally forces `groupName: null` for vulnerability alerts via its
-  // built-in `force` block, which outranks user packageRules — so an explicit
-  // ungrouping rule would be a no-op and is intentionally omitted.
-  // Here we only tune how vulnerability PRs surface: label them and create them
-  // immediately, bypassing the daily schedule.
+  // Vulnerability/security fixes are already kept as standalone PRs and created
+  // immediately: Renovate internally forces `groupName: null` and ignores the
+  // daily `schedule` for vulnerability alerts via its built-in `force` block,
+  // which outranks user config — so an explicit ungrouping rule or a `schedule`
+  // override would be a no-op and is intentionally omitted.
+  // Here we only add labels so CVE-fix PRs are easy to spot and route.
   "vulnerabilityAlerts": {
-    "labels": ["security", "renovate"],
-    "schedule": ["at any time"]
+    "labels": ["security", "renovate"]
   }
 }