From a2a509b23a7022c454c9f3818f90b2e2f2fbdb87 Mon Sep 17 00:00:00 2001
From: Yicong-Huang <17627829+Yicong-Huang@users.noreply.github.com>
Date: Wed, 29 Jul 2026 18:38:58 -0400
Subject: [PATCH] fix(ci): type routine Renovate bumps as chore, drop
 [security] suffix

config:recommended pulls in :semanticPrefixFixDepsChoreOthers, which
types runtime-dependency bumps as fix(...) and overrides our top-level
semanticCommitType: 'chore'. Routine, non-security majors such as
ng-zorro-antd (#7060) and fuse.js (#7059) therefore came through as
fix(...) rather than chore(...).

Append a catch-all packageRule (matchPackageNames: ['*'] -> chore) that
runs last and overrides the preset, so every routine bump is chore(...).
vulnerabilityAlerts is applied as a higher-priority layer for security
branches and keeps its fix(...) type.

Also set commitMessageSuffix: '' in vulnerabilityAlerts to drop
Renovate's default [SECURITY] title suffix; the security label already
identifies those PRs.

Fixes #7071

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/renovate.json5 | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 40b7c16f14b..3f4f523ea4e 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -46,6 +46,9 @@
   osvVulnerabilityAlerts: true,
   vulnerabilityAlerts: {
     semanticCommitType: 'fix',
+    // Drop Renovate's default `[SECURITY]` title suffix; the `security`
+    // label below already identifies these PRs.
+    commitMessageSuffix: '',
     // release/v1.2 flags the fix for backporting to the current release
     // line; bump it when a new release branch is cut.
     labels: ['dependencies', 'security', 'release/v1.2'],
@@ -161,5 +164,16 @@
       matchUpdateTypes: ['major'],
       enabled: false,
     },
+
+    // config:recommended pulls in :semanticPrefixFixDepsChoreOthers,
+    // which types runtime-dependency bumps as fix(...). We want the
+    // opposite: every routine bump is chore(...), and only
+    // vulnerabilityAlerts (above) uses fix(...). This catch-all runs
+    // last, so it overrides that preset; vulnerabilityAlerts is applied
+    // as a higher-priority layer for security branches and is unaffected.
+    {
+      matchPackageNames: ['*'],
+      semanticCommitType: 'chore',
+    },
   ],
 }