fix(renovate): match the freedesktop-sdk series the junction actually tracks

[hanthor]

The bug

renovate.json filters freedesktop-sdk tags with a rule anchored to the 25.08 series:

"extractVersion": "^freedesktop-sdk-(?<version>25\\.08\\.[0-9]+)$"

elements/freedesktop-sdk.bst has been on 26.08 since the bump to freedesktop-sdk-26.08.0-0-gdb97cce:

  track: freedesktop-sdk-26.08*
  ref: freedesktop-sdk-26.08.0-0-gdb97cce32cecadc7a3e98f06d557ebfa6ba9ad46

No tag upstream publishes can satisfy that rule any more. Renovate does not error on an extractVersion that matches nothing — it reports no updates. So the junction has silently stopped receiving bump PRs, and the track-refs job in build.yml never gets a ref to resolve. The failure mode is indistinguishable from "already up to date", which is why it is easy to miss.

The fix

Bump the rule to 26.08, and stop the two from drifting again.

.github/scripts/check-renovate-series.py reads the series out of each junction's track: glob and asserts the matching extractVersion is anchored to the same series, failing closed:

$ python3 .github/scripts/check-renovate-series.py     # before
ERROR: elements/freedesktop-sdk.bst tracks `freedesktop-sdk-26.08*` (series 26.08)
but renovate.json filters .../freedesktop-sdk.git with extractVersion
'^freedesktop-sdk-(?<version>25\.08\.[0-9]+)$' (series 25.08). Renovate matches
no tag, so this junction gets no update PRs.

$ python3 .github/scripts/check-renovate-series.py     # after
OK: 2 Renovate version filter(s) match their junction `track:` series

It is deliberately built in the same shape as check-release-version.py and check-k0s-version.py — a single invariant, a docstring explaining the silent failure it prevents, fail-closed, no dependencies beyond the stdlib. Wired into .pre-commit-config.yaml next to the other two, and unit-tests.yml now also triggers on renovate.json and elements/*.bst so the guard actually runs when either side of the invariant moves.

The gnome-build-meta rule already agrees with its junction (track: gnome-50 / ^(?<version>50\.[0-9]+)$) and is unchanged; the check now holds it there.

Tests

tests/unit/test_check_renovate_series.py covers the passing case, the exact regression above, a junction with no packageRule, a junction with no track:, both series helpers, and the checked-in tree itself so drift fails CI rather than only pre-commit.

$ python3 -m pytest tests/unit -q
207 passed, 1 xfailed in 0.64s

Note on scope

I came at this from a sibling BuildStream image repo and only touched the Renovate invariant. One thing I noticed but deliberately left alone: just show-me-the-future and just install-vm give you a real QEMU install-and-reboot test, and no workflow calls either, so main has no automated boot gate. Happy to wire that up as a separate PR if it would be welcome.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VwEniffvKGH7gHfqKneuaJ

[hanthor]

Independent verification — the bug is real, the guard is non-vacuous

I can't approve this (same account authored it), so recording the verification instead. Everything below I ran myself rather than taking the description's word for it.

The mismatch is real, confirmed against the actual element:

# elements/freedesktop-sdk.bst
track: freedesktop-sdk-26.08*
ref:   freedesktop-sdk-26.08.0-0-gdb97cce32cecadc7a3e98f06d557ebfa6ba9ad46

against "extractVersion": "^freedesktop-sdk-(?<version>25\\.08\\.[0-9]+)$".

The description's framing of the failure mode is the important part and it's correct: an extractVersion matching nothing doesn't error, it reports no updates. "Silently stopped receiving bump PRs" and "already up to date" are indistinguishable from outside — so the thing that tells you the junction is current had itself gone blind.

The guard actually catches it. I reintroduced the 25\.08 regex and re-ran:

FAILED tests/unit/test_check_renovate_series.py::test_the_real_repo_is_consistent
1 failed, 5 passed

Clean tree: 6 passed. It reads the real renovate.json against the real element, not a fixture of itself — so it will catch the next series bump too, which is the whole point.

And it's wired to fire. The unit-tests.yml path filter gains renovate.json and elements/*.bst. Without that the guard would live in a job a renovate.json-only change never triggers — a gate that exists but never runs, which is how the original drift survived in the first place.

• Full suite on this head: 207 passed, 1 xfailed (baseline main: 201 passed, 1 xfailed)
• mergeable_state: clean, build and unit green

One thing to flag before merging

The checker is reachable from pre-commit and from the test suite, but not from just validate, and there's no pre-commit CI workflow — so the unit test is the only enforcement in CI. Fine today; worth knowing it's a single point of failure if the path filter is ever pruned.

@castrojo @mrbobbytables — this is clean and needs no approval to merge under current protection, but it's Claude-authored end to end and nobody has reviewed it. Worth a human glance before it lands rather than merging on the strength of its own test suite.

The just show-me-the-future / just install-vm observation at the bottom of the description is worth its own issue, by the way — main having no automated boot gate is a bigger gap than this PR.

---

Generated by Claude Code