Automerge workflow actions only, gate the rest

[kriszyp]

Renovate now enables auto-merge only for GitHub Action updates in the integration and lint workflows. Current repository rules still require human approval, and every allowlisted action is exercised by a required pull-request check; release, scheduled, reusable AI-review, container-image, runtime, major, and pre-1.0 updates stay human-gated.

The eligible action occurrences use their own Renovate group. This keeps a shared action such as actions/checkout from landing in one branch that also edits unexercised publish workflows. The root manifest remains disabled because it follows core; nested integration-test manifests remain managed. rocksdb-js stays disabled because its release workflow owns those proposals.

prConcurrentLimit remains 20 so human-gated PRs cannot starve the action group. This is effectively an upper bound rather than an expected queue depth.

For the human reviewer

1. Approval semantics: automerge: true enables GitHub auto-merge, but the active Main - Require Reviewers ruleset still requires one human approval and last-push approval; Renovate is not a bypass actor.
2. Action scope: the allowlist contains .github/workflows/integration-tests.yaml and lint-code.yaml. unit-tests.yaml is excluded because its current action references are already exercised by the required lint and integration jobs; excluding the file prevents a future unit-only action from silently entering the automerge group.
3. Branch separation: groupSlug: "pr-test-workflow-actions" overrides the earlier all-digests grouping for allowlisted occurrences. Release and scheduled workflow occurrences remain in the human-gated group.
4. Concurrency: 20 is global. Dawson approved the tradeoff as effectively unlimited if the queue is actively maintained; revisit it if CI load becomes noisy.

Verification

• Renovate 44.33.2 config validation passes.
• A Node 24 local Renovate 44.33.2 --dry-run=full succeeds, resolves the config without migration, and extracts repository dependencies.
• Focused rule assertions fail on the prior PR head and pass on the final config: YCSB and the unit workflow are absent, only the two intended workflow files are allowlisted, and the description assigns approval/check enforcement to repository rules.
• npm run lint:required, targeted Prettier formatting, and git diff --check pass.
• Application build/unit/integration suites were not run because this changes only Renovate policy and is not loaded by Harper runtime or tests.

Review coverage

Original policy authored by Claude Opus 5; review fixes authored by GPT-5 Codex. Earlier rounds used Claude and Gemini. The final review-feedback fix was independently reviewed by Gemini and Cursor Composer under the no-Claude quota policy; both completed, while Claude and domain adjudication were intentionally pruned. Their findings were broader pre-existing policy concerns or contradicted the approved intent and repository facts; neither identified a defect specific to removing the redundant unit-workflow entry.

Co-Authored-By: GPT-5 Codex noreply@openai.com

_{Human-Review-Need: 4 @ 2503a33}

[gemini-code-assist]

Code Review

This pull request updates the Renovate configuration (renovate.json) to increase the concurrent PR limit, refine automerge rules, and add specific package rules for various dependencies. Feedback on the changes points out that Renovate's matchPackageNames does not support negation using the ! prefix, and suggests using excludePackageNames instead to properly exclude specific packages.

[claude]

Reviewed; no blockers found.

[dawsontoth]

2 was mostly from when we were just getting started, if we stay on top of things, I don't think we'll get very high into the 20 range. I read that as effectively unlimited.