From 46f726265cf1b01e5961fb2b257853082387cd59 Mon Sep 17 00:00:00 2001
From: Valentin Maerten <maerten.valentin@gmail.com>
Date: Mon, 3 Aug 2026 22:23:06 +0200
Subject: [PATCH] ci(renovate): make the go constraint valid and skip indirect
 digest updates

The constraintsFiltering rule from #2951 never took effect, for two
cumulative reasons.

First, Renovate validates every configured constraint against the
datasource versioning (semver for Go modules) before filtering. Our
`go: "1.25"` has no patch component, so isValid() rejects it, Renovate
logs 'Invalid constraint used with strict constraintsFiltering' as a
repository problem, and skips filtering entirely. Aligning the value on
the go.mod directive fixes that. Note the constraint was never the one
doing the filtering anyway: the gomod manager already extracts the go
directive itself under the reserved '%goMod' key, which is what the go
datasource compares releases against. The setting keeps its other role,
picking the Go binary Renovate runs.

Second, filtering only ever sees releases. github.com/planetscale/
vtprotobuf reaches us as a digest update - an indirect dep pinned to a
pseudo-version, tracked against upstream HEAD - so no constraint
metadata is available to filter on. Stop chasing HEAD for indirect deps;
they move when the direct dep pulling them in moves.
---
 .github/renovate.json | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index 92ce1a0918..f0aab36179 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -10,7 +10,7 @@
   "osvVulnerabilityAlerts": true,
   "postUpdateOptions": ["gomodTidy"],
   "constraints": {
-    "go": "1.25"
+    "go": "1.25.10"
   },
   "customManagers": [
     {
@@ -55,6 +55,13 @@
       "description": "Skip releases whose own `go` directive exceeds ours. Without this, `gomodTidy` propagates their requirement into our go.mod and breaks the older Go versions in the CI matrix.",
       "matchManagers": ["gomod"],
       "constraintsFiltering": "strict"
+    },
+    {
+      "description": "Digest updates carry no release metadata, so constraintsFiltering cannot inspect their `go` directive. Indirect deps pinned to a pseudo-version are the ones that slip through, so don't chase upstream HEAD for those; they move when the direct dep that pulls them in moves.",
+      "matchManagers": ["gomod"],
+      "matchDepTypes": ["indirect"],
+      "matchUpdateTypes": ["digest"],
+      "enabled": false
     }
   ]
 }