chore(CI): Split updates per day to allow smooth auto-merge process

[mtodor]

Description

Splits Renovate (MintMaker) update schedules across different days of the week to prevent merge conflicts when multiple PRs are created simultaneously.

Previously, all three managers (dockerfile, rpm-lockfile, tekton) ran on the same daily schedule. When multiple managers found updates at the same time, Renovate created multiple PRs. After one PR was merged, the others had a stale base branch — GitHub blocked the merge, requiring a manual rebase and another full CI cycle.

Each manager now runs on its own day within the 2–8 AM UTC window:

• Dockerfile: Friday
• RPM lockfile: Saturday
• Tekton: Sunday

Besides changes for Renovate - Dependabot is also changed to run only on Monday (Weekly).

This ensures at most one PR is created per schedule window. Within the 7-hour window, Renovate has time to create the PR, wait for CI, and automerge — all in the same run cycle.

Validation

• Verify renovate config with make renovate-validate
• Confirm cron day-of-week values are correct (5=Friday, 6=Saturday, 0=Sunday)
• Check cron config with crontab guru

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

Prompt: "Right now we have a problem that Konflux updates are automated in with auto merge. Konflux updates use MintMaker - what is actually renovate. [...] So we are splitting interaction per day. Because how renovate works, it finds updates, create pull requests. And then on next schedule when the CI pipeline is successful, it merges pull requests."
Response: Explored the existing .github/renovate.json5 configuration, identified all three managers sharing the same daily schedule, and planned the per-day split: Dockerfile on Friday, RPM on Saturday, Tekton on Sunday.

Prompt: "Change fallback and dockerfile to also be '2-8' similar to tekton and rpm-lockfile"
Response: Updated the global fallback schedule and the new Dockerfile schedule from 3-7 to 2-8 to align all windows consistently.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: b7bb88dd-0e81-4337-8f51-7cfe541510e5

📥 Commits

Reviewing files that changed from the base of the PR and between b9bf807 and d657416.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/renovate.json5

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated automated maintenance scheduling by changing the default window to run daily between 2:00 and 8:00 AM (UTC).
  • Staggered manager-specific runs so Dockerfile updates occur on Fridays, RPM lockfile updates on Saturdays, and Tekton updates on Sundays.
  • Switched Go module (gomod) dependency updates from daily to weekly, scheduled for Mondays for both the root and end-to-end test tooling.

Walkthrough

Dependency update automation now uses revised Renovate time windows and weekly Monday schedules for the two configured Dependabot Go module updates.

Changes

Dependency scheduling

Layer / File(s)	Summary
Renovate schedule policy .github/renovate.json5	The fallback window changed to 2–8 AM daily, while dockerfile, rpm-lockfile, and tekton updates run Friday, Saturday, and Sunday respectively.
Dependabot Go module schedule policy .github/dependabot.yml	Root and /e2e-tests/tools Go module updates changed from daily to weekly Monday schedules.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: splitting update schedules across days to improve auto-merge flow.
Description check	✅ Passed	The description matches the changeset and explains the Renovate/Dependabot schedule adjustments and rationale.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mtodor/update-weekly-split-per-day

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 92 times)

Stack Traces | 0s run time

- test violation 1
- test violation 2
- test violation 3

::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 92 times)

Stack Traces | 0s run time

- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[github-actions]

E2E Test Results

Commit: d657416
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✗ cve-cluster-does-not-exist (assertions: 1/3)
      one or more verification steps failed
      - ToolsUsed: Required tool not called: server=stackrox-mcp, tool=, pattern=get_clusters_with_orchestrator_cve|list_secured_clusters
      - MinToolCalls: Too few tool calls: expected >= 1, got 0
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ list-clusters (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)

Tasks:      10/11 passed (90.91%)
Assertions: 30/32 passed (93.75%)
Tokens:     ~49116 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  13457 tokens
  Output: 19275 tokens
Judge used tokens:
  Input:  41511 tokens
  Output: 39344 tokens

[janisz]

Should we change dependabot to monday?