chore(renovate): group a consumer's catalog pins so a bump moves as one unit

Andrew Dunnrequested to merge
chore/group-catalog-pins into main

The catalog custom manager captures depName per component. That is correct for resolution and wrong for delivery: it fans out one merge request per component per project. tach has 12 catalog pins. kaniko has 39. Nobody finishes a 12-MR bump, so nobody finishes a bump at all, and the pins drift apart inside a single file.

Measured across the 17 projects that consume the catalog

Five catalog versions in simultaneous use:

version pins
v3.0.0 22
v3.1.0 1
v4.0.2 60
v4.1.0 11
v4.1.2 2

Five projects carry two different catalog versions inside one .gitlab-ci.yml:

project split
tach v3.0.0 ×5 + v4.0.2 ×7 (half a major behind the other half)
manifold v3.0.0 ×2 + v4.0.2 ×3
postern v3.0.0 ×2 + v4.0.2 ×3
egress v3.1.0 ×1 + v4.1.2 ×1
reference v4.1.0 ×1 + v4.1.2 ×1

Zero projects are on the current catalog version.

Why this is the remaining half of the fix

The write defect behind the drift is already repaired: the manager's matchStrings require the v prefix, and a prefix-stripped newValue had no slot to land in, so Renovate resolved the release, failed to template it, and abandoned the branch. That was 81 errored branch updates across 15 projects.

Fixing the write made bumps possible. It did not make them finishable, because the fan-out remained. This is the other half.

The rule

{ "matchManagers": ["custom.regex"],
  "matchPackageNames": ["gitlab-com/public-sector/pipeline"],
  "groupName": "public-sector catalog",
  "automerge": false }

Matched on packageName, not depName. This matters: depName here is the bare component name (osv-verdict, release) while packageNameTemplate is the catalog project. A matcher written against the project path with a /** suffix would have matched nothing and silently done nothing.

Placed at index 2, before the major rule, so a major catalog bump still picks up that rule's major-bump label and human gate.

What it does not do

automerge stays false. A catalog bump changes consumer CI behaviour and gets a human.

Renovate still separates major from non-major, so a project split across a major boundary gets two grouped MRs rather than one. tach goes from 12 MRs to 2, not to 1. That split is correct: a v3.0.0 to v4.2.0 move should not ride along inside a minor bump.

Verification

renovate-config-validator passes. The 12 pre-existing packageRules are unchanged.

Merge request reports