From bd842991ab7977c2a40b03c69dc383c12a820446 Mon Sep 17 00:00:00 2001
From: panicboat <panicboat@gmail.com>
Date: Sat, 31 Oct 2026 09:16:16 +0900
Subject: [PATCH] fix: keep production dependency updates out of automerge

Renovate applies matching packageRules in order, so the later minor and patch rule turned automerge back on for production files. Recent production pull requests were merged without review.

Claude-Session: https://claude.ai/code/session_01N1XYRqYewzhQfyJcM9zFjG
Signed-off-by: panicboat <panicboat@gmail.com>
---
 default.json              | 22 +++++++++++-----------
 scripts/workflows/test.sh |  6 ++++++
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/default.json b/default.json
index 789f6b8..99c8dc3 100644
--- a/default.json
+++ b/default.json
@@ -35,17 +35,6 @@
         "*"
       ]
     },
-    {
-      "description": "🚫 Production environments - disable automerge",
-      "matchFileNames": [
-        "**/production/**"
-      ],
-      "automerge": false,
-      "prPriority": -1,
-      "addLabels": [
-        "⚠️ production"
-      ]
-    },
     {
       "description": "🚫 Major updates - disable automerge",
       "matchUpdateTypes": [
@@ -72,6 +61,17 @@
         "panicboat/.github"
       ],
       "minimumReleaseAge": null
+    },
+    {
+      "description": "🚫 Production environments - disable automerge",
+      "matchFileNames": [
+        "**/production/**"
+      ],
+      "automerge": false,
+      "prPriority": -1,
+      "addLabels": [
+        "⚠️ production"
+      ]
     }
   ]
 }
diff --git a/scripts/workflows/test.sh b/scripts/workflows/test.sh
index 20ddf11..e8a7795 100755
--- a/scripts/workflows/test.sh
+++ b/scripts/workflows/test.sh
@@ -49,6 +49,12 @@ test_resolver_skips_label_resolver_without_a_pull_request() {
     assert_eq "needs.resolve.outputs.has-targets == 'true' &&" "$(yq '.jobs["deploy-terragrunt"].if' "${workflow}" | head -n 1)"
 }
 
+test_renovate_keeps_production_out_of_automerge() {
+    # Renovate applies matching packageRules in order, so a later rule overrides the production rule.
+    assert_eq "false" "$(jq -r '[.packageRules[] | select(.automerge != null) | select(.matchFileNames // [] | index("**/production/**"))][0].automerge' "${repo_root}/default.json")"
+    assert_eq "production" "$(jq -r '[.packageRules[] | select(.automerge != null)] | last | if (.matchFileNames // [] | index("**/production/**")) != null then "production" else "other" end' "${repo_root}/default.json")"
+}
+
 test_workflows_do_not_read_apply_trigger() {
     assert_eq "" "$(grep -rl --exclude='*test.sh' 'apply_trigger\|validate-apply-trigger' "${workflows_dir}" "${repo_root}/scripts" || true)"
 }