fix(#3394): add explicit gomod fileMatch for all go.mod files

[fullsend-ai-coder]

Add gomod manager-level fileMatch configuration to renovate.json to ensure Renovate consistently discovers and updates dependencies across all go.mod files in this multi-module repository, including tools/go.mod.

Renovate PR #3378 updated oras.land/oras-go/v2 in go.mod and acceptance/go.mod but missed tools/go.mod, requiring a manual follow-up PR #3391. By explicitly setting the fileMatch pattern for the gomod manager, we make the intent to cover all module directories explicit in the repo configuration rather than relying solely on Renovate defaults.

---

Closes #3394

Post-script verification

• Branch is not main/master (agent/3394-renovate-gomod-filematch)
• Secret scan passed (gitleaks — 5759bb21f606d6fb51f2c078de41d3cf9e0962f7..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:01 PM UTC · Completed 4:07 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Verdict: approve — safe, low-risk configuration change.

Summary

This PR adds an explicit gomod.fileMatch entry to renovate.json to ensure Renovate discovers all go.mod files in the repository, including tools/go.mod. The change is syntactically correct (valid JSON, valid Renovate config key), the regex (^|/)go\.mod$ is properly escaped and will match go.mod at any directory depth, and the placement in the file is consistent with the existing structure.

Analysis

Correctness: The regex pattern is correct and matches all four go.mod files in the repo (go.mod, acceptance/go.mod, tools/go.mod, tools/kubectl/go.mod). The gomod key is the correct manager name for Renovate's Go module manager.

Potential limitation (low): The pattern (^|/)go\.mod$ is identical to Renovate's built-in default fileMatch for the gomod manager, and the shared preset (github>conforma/.github//config/renovate/renovate.json) does not override the gomod fileMatch. This means the explicit setting may be redundant and may not change Renovate's file-discovery behavior.

The original issue (#3394) describes tools/go.mod being missed when updating oras.land/oras-go/v2. On inspection, that dependency appears as indirect in tools/go.mod but direct in the root go.mod. Since tools/ is a separate Go module, the postUpdateOptions: ["gomodTidy"] configured in the shared preset would only run go mod tidy in the module directory being updated — not across all modules. Renovate may skip indirect-only dependencies in separate modules even when it discovers the go.mod file.

If the missed update recurs after this change lands, the next step would be to investigate Renovate's handling of indirect dependencies across separate Go modules, potentially adding postUpgradeTasks to run go mod tidy in all module directories, or splitting the gomod packageRules grouping to handle each module independently.

Security: No concerns — this is a build-tooling configuration change with no runtime impact.

Scope & intent: The change is appropriately scoped to the linked issue #3394 and modifies only the Renovate configuration file.

No injection patterns detected in PR body, commit messages, or linked issue text.

---

Labels: PR modifies Renovate configuration for Go module dependency management

[fullsend-ai-review]

[low] correctness

The fileMatch pattern (^|/)go.mod$ is identical to Renovate gomod manager built-in default. The shared preset does not override gomod fileMatch, so this explicit setting is likely redundant. The root cause of tools/go.mod being missed (issue #3394) may be that oras.land/oras-go/v2 is an indirect dependency in tools/go.mod and Renovate does not track indirect-only dependencies across separate Go modules. If the issue recurs, consider adding postUpgradeTasks to run go mod tidy across all module directories.

Suggested fix: Monitor the next Renovate scan that includes a dependency present in tools/go.mod. If tools/go.mod is still missed, investigate Renovate indirect dependency handling in multi-module repos and consider postUpgradeTasks or per-module packageRules.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	53.62% <ø> (+<0.01%)	⬆️
generative	17.18% <ø> (ø)
integration	28.36% <ø> (ø)
unit	71.74% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.