fix(ci): replace blanket Renovate disable with major-only block

[rm3l]

Summary

The Renovate config disabled all updates on release branches (enabled: false without matchUpdateTypes), then tried to selectively re-enable patch and digest updates. This never worked because Renovate skips dependencies entirely before determining the update type when the blanket disable matches — the re-enable rules had nothing to match against.

Replaces the three rules (disable-all, re-enable patch, re-enable digest) with a single rule that only disables major updates. Minor, patch, and digest updates are now implicitly allowed on release branches.

EOL branch rules (release-1.5 through 1.8) are unaffected — they use exact branch names and intentionally disable everything.

Same fix as redhat-developer/rhdh-must-gather#428, which was confirmed working after a Renovate cache bust.

Test plan

• After merging, trigger a Renovate run and verify PRs are created for release branches
• A cache-busting commit on active release branches may be needed (Renovate caches extraction results keyed by branch SHA)

[rhdh-qodo-merge]

PR Summary by Qodo

Allow non-major Renovate updates on active release branches

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Replace the release-branch blanket disable with a major-only block so non-major updates can
 proceed.
• Preserve the existing full update bans on EOL release branches.

Diagram

graph TD
  A["Release branch"] --> B{"EOL branch?"} -- No --> D{"Major update?"} -- No --> F["Allow update"]
  B -- Yes --> C["Disable all"]
  D -- Yes --> E["Disable major"]

Loading

High-Level Assessment

The major-only block directly expresses the intended release-branch policy. Retaining a blanket disable with selective re-enable rules was considered but cannot produce the intended updates; separate branch configurations would add complexity without a clear benefit.

Files changed (1) +2 / -14

Bug fix (1) +2 / -14

renovate.jsonBlock only major updates on release branches +2/-14

Block only major updates on release branches

• Replaces the blanket release-branch disable and patch/digest re-enable rules with one major-only disable rule. Minor, patch, and digest updates are no longer blocked by that rule; the exact-name EOL branch rules remain unchanged.

.github/renovate.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[rhdh-qodo-merge]

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more

[rm3l]

Merging to verify the changes in Renovate

[rm3l]

/cherrypick release-2.1
/cherrypick release-1.9

1.10 will be coming up later.

[openshift-cherrypick-robot]

@rm3l: once the present PR merges, I will cherry-pick it on top of release-1.9, release-2.1 in new PRs and assign them to you.

Details

In response to this:

/cherrypick release-2.1
/cherrypick release-1.9

1.10 will be coming up later.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@rm3l: new pull request created: #590

Details

In response to this:

/cherrypick release-2.1
/cherrypick release-1.9

1.10 will be coming up later.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@rm3l: #589 failed to apply on top of branch "release-1.9":

Applying: fix(ci): replace blanket Renovate disable with major-only block
Using index info to reconstruct a base tree...
M	.github/renovate.json
Falling back to patching base and 3-way merge...
Auto-merging .github/renovate.json
CONFLICT (content): Merge conflict in .github/renovate.json
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 fix(ci): replace blanket Renovate disable with major-only block

Details

In response to this:

/cherrypick release-2.1
/cherrypick release-1.9

1.10 will be coming up later.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.