[apeabody]

Summary

• Set "semanticCommitType": "fix" for gomod updates: Configure Go module dependency updates across CFT's releasable Go tools (cli, tflint-ruleset-blueprint, infra/blueprint-test, infra/module-swapper, and infra/utils/fbf) to use fix(deps): instead of chore(deps): for both standard dependency updates and vulnerability alert PRs.
• Separate custom.regex (Makefile and build/*.cloudbuild*.yaml) into its own chore(deps): group: Set "semanticCommitType": "chore", groupName: "{{#if packageFileDir}}{{{packageFileDir}}} tooling deps{{else}}root tooling deps{{/if}}", and groupSlug: "{{#if packageFileDir}}{{{replace '/' '-' packageFileDir}}}-tooling-deps{{else}}root-tooling-deps{{/if}}" on custom.regex managers so Makefile and Cloud Build tooling updates (cft/developer-tools, golangci-lint, alpine) remain chore(deps): and do not merge into go.mod PRs in cli/ or infra/blueprint-test/.

[gemini-code-assist]

Code Review

This pull request updates the Renovate configuration in .github/renovate.json by setting semantic commit types for Go module and custom regex dependencies, and renaming dependency groups to include 'tooling'. A review comment points out that setting semanticCommitType to 'fix' on the general gomod manager rule will cascade to Go version updates, potentially triggering unnecessary production releases. It is recommended to explicitly override this to 'chore' for Go version updates.

[gemini-code-assist]

Setting "semanticCommitType": "fix" on the general gomod manager rule will also cascade to the subsequent golang-version rule (lines 83-92), which matches the gomod manager and golang-version datasource.

Since Go toolchain/version updates are typically considered maintenance or toolchain updates (chore) rather than bug fixes (fix), they might trigger unnecessary production releases if they use semantic-release or similar tools.

Consider explicitly overriding "semanticCommitType": "chore" in the golang-version rule to keep Go version updates as chore.

[apeabody]

Intentionally keeping golang-version updates as fix(deps):. Both go / toolchain directive updates and module require updates touch the same go.mod file and are grouped together in the {{packageFileDir}} deps PR, and bumping the go directive in go.mod updates the published module metadata and the Go toolchain (go-version-file) used to build released binaries.