ci(renovate): force chore(deps) commits and add area/dependencies label - #3015

NOT LGTM — the area/dependencies label wiring and the kubevirt.io/csi-driver disable are correct, but the headline change does not actually force chore(deps) for direct dependencies, so the kind/bug labeling this PR targets is not resolved.

Business context: make Renovate PRs land as chore(deps) with an area/dependencies label so dependency bumps stop being labeled kind/bug and area/uncategorized.

Blocker

1. The top-level semanticCommitType: "chore" is overridden back to fix for direct Go modules, so their PRs stay fix(deps): … and the labeler still applies kind/bug.

config:recommended (extended here) pulls in the :semanticPrefixFixDepsChoreOthers preset, which contributes a packageRule { "matchDepTypes": ["dependencies", "require"], "semanticCommitType": "fix" }. In Renovate, packageRules override top-level config, so this rule wins over the new top-level setting. The gomod manager assigns depType require to direct dependencies (and indirect to indirect ones), so direct-dep PRs resolve to fix, not chore.

I resolved this exact config with Renovate and applied the rules to a synthetic gomod dependency: a direct (require) dep resolves to semanticCommitType=fix, and only an indirect dep resolves to chore. Direct dependencies are the dominant Renovate PR type, so the kind/bug pollution described in the PR body is not fixed.

Evidence: .github/renovate.json:4 (config:recommended in extends) and .github/renovate.json:10-11 (top-level semanticCommitType / semanticCommitScope).

Fix: force the type with a rule that wins over the preset — either add :semanticCommitTypeAll(chore) to extends, or append a user packageRule (user rules are evaluated last), for example { "matchManagers": ["gomod"], "semanticCommitType": "chore", "semanticCommitScope": "deps" }. semanticCommitScope already resolves to deps, so the area/dependencies mapping is unaffected either way.

Not blocking

The rest is correct and the fix above is localized to the commit type:

• The area/dependencies label and the deps → area/dependencies labeler mapping are consistent. semanticCommitScope resolves to deps for every Renovate PR (whether the type ends up fix or chore), so the scope-to-area mapping clears area/uncategorized regardless of the blocker. Evidence: .github/workflows/pr-labeler.yaml:49, .github/labels.yml:173-175.
• Disabling kubevirt.io/csi-driver is valid and does not collide with the k8s.io/** group rule, since kubevirt.io/… does not match that glob. Evidence: .github/renovate.json:28-33.
• JSON parses, the label-schema validation passes, and the label-sync workflow creates the new label on merge to main.

NOT LGTM — the chore(deps) override is now correct, but the branch is stale against main and would drop the Dockerfile / GitHub Actions digest-pinning that has since landed; rebase and reconcile before merge.

Prior blocker — resolved. The earlier issue (top-level semanticCommitType: chore overridden back to fix for direct Go modules by the :semanticPrefixFixDepsChoreOthers rule from config:recommended) is fixed: the new user packageRule forces semanticCommitType=chore / semanticCommitScope=deps for matchManagers: ["gomod"], and since user packageRules evaluate after preset rules, last-match-wins lands on chore for direct (require) deps too. renovate-config-validator passes and the JSON is valid. The area/dependencies label exists in .github/labels.yml and the labeler maps deps → area/dependencies, so the scope-to-area wiring is intact.

New blocker — stale branch / config regression. main now sets "enabledManagers": ["gomod", "dockerfile", "github-actions"] and carries a packageRule pinning Dockerfile and GitHub Actions to immutable digests — both landed after this branch forked. This branch still has "enabledManagers": ["gomod"] and lacks that rule, so the PR is in a conflicting, unmergeable state, and merging it as-is (taking the branch side of the conflict) would disable the dockerfile/github-actions managers and drop the digest-pinning — a regression of config already on main. Please rebase onto main, keep enabledManagers: ["gomod", "dockerfile", "github-actions"] and the pinDigests rule, and add the new gomod chore rule on top (it's gomod-scoped, so it doesn't affect the Dockerfile/Actions rules).

LGTM — Renovate now emits chore(deps) consistently and the new area/dependencies label is wired through both the label catalog and the auto-labeler.

Verified:

• Premise holds: pr-labeler maps fix → kind/bug and chore → kind/cleanup, so today's fix(deps) Renovate PRs do land as kind/bug. Forcing chore(deps) lands them as kind/cleanup instead.
• The extra gomod packageRule is necessary, not redundant: the config extends config:recommended, which pulls in :semanticPrefixFixDepsChoreOthers (re-sets semanticCommitType=fix for direct production deps). A user packageRule evaluated after the preset is required to win it back; the top-level chore alone would not.
• renovate.json is valid JSON; labels.yml + pr-labeler.yaml are extended in lockstep per the area/* convention.

Non-blocking:

• Disabling Renovate for kubevirt.io/csi-driver removes it from automated bump/security tracking; acceptable since it is commit-pinned and advanced manually with the image build (already noted in the rule description).