[jdx]

Summary

• add a cargo Renovate package rule that groups sigstore-* crate updates together
• mirrors the existing grouped-crate pattern used for rattler

Test

• python3 -m json.tool .github/renovate.json
• git diff --check

This PR was generated by an AI coding assistant.

---

Note

Low Risk
Only changes Renovate bot configuration; no application, auth, or runtime behavior.

Overview
Adds a Renovate packageRules entry in .github/renovate.json so Cargo updates for crates matching ^sigstore- are grouped under sigstore crates, following the same pattern as the existing rattler group.

This should produce single grouped PRs when multiple Sigstore crates need bumps, instead of separate Renovate PRs per crate.

^{Reviewed by Cursor Bugbot for commit 3c4a308. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated automated dependency management rules to group related Rust package updates together, improving maintenance consistency.
  • Added a dedicated grouping for a set of related crates so future updates are handled more uniformly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: c2bd8106-6248-4746-a281-5cbcde9487fe

📥 Commits

Reviewing files that changed from the base of the PR and between 4b7cec3 and 3c4a308.

📒 Files selected for processing (1)

• .github/renovate.json

---

📝 Walkthrough

Walkthrough

Added a new Renovate packageRules entry in .github/renovate.json that groups Cargo dependencies with names starting with "sigstore-" under a "sigstore crates" group, enabling coordinated version bumps for these packages.

Changes

Renovate Configuration

Layer / File(s)	Summary
Add sigstore crates grouping rule .github/renovate.json	New packageRules entry matches Cargo-managed packages starting with "sigstore-" and groups them under "sigstore crates" for coordinated updates.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A rabbit hops through config trees so neat,
Grouping crates named "sigstore-" for a treat,
One bump, one PR, all bundled tight,
Renovate's burrow now feels just right,
🐇✨ Hop on, dependencies unite!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: grouping sigstore Renovate dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Adds a single packageRules entry to .github/renovate.json that groups all sigstore-* cargo crate updates under a shared "sigstore crates" Renovate group, matching the structure already used for rattler.

• The regex /^sigstore-/ correctly targets the sigstore-verify crate (the only sigstore dependency in crates/mise-sigstore/Cargo.toml) and any other sigstore-* transitive crates Renovate may track.
• The rule follows the same shape as the existing rattler entry (description, matchPackageNames, matchManagers, groupName), keeping the config consistent.

Confidence Score: 5/5

Safe to merge — the change is a one-block addition to Renovate config with no code-path impact.

The only change is a new packageRule in renovate.json. It correctly matches the sigstore-verify dependency used in crates/mise-sigstore/Cargo.toml, the JSON is valid, and the rule mirrors the established rattler pattern without any deviation.

No files require special attention.

Important Files Changed

Filename	Overview
.github/renovate.json	Adds a Renovate packageRule to group sigstore-* cargo crate updates, consistent with the existing rattler grouping pattern; no issues found.

_{Reviews (1): Last reviewed commit: "chore(deps): group sigstore renovate upd..." | Re-trigger Greptile}

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.14 x -- echo	19.0 ± 0.6	17.6	21.8	1.00
mise x -- echo	20.4 ± 2.9	18.4	40.8	1.08 ± 0.16

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.14 env	19.0 ± 0.8	17.6	23.3	1.00
mise env	19.6 ± 0.6	18.2	23.7	1.03 ± 0.06

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.14 hook-env	19.9 ± 0.8	18.4	24.4	1.00
mise hook-env	20.2 ± 0.8	18.8	24.9	1.02 ± 0.06

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.14 ls	16.3 ± 0.6	15.1	19.0	1.00
mise ls	16.9 ± 0.7	15.7	20.8	1.04 ± 0.06

xtasks/test/perf

Command	mise-2026.6.14	mise	Variance
install (cached)	136ms	136ms	+0%
ls (cached)	59ms	59ms	+0%
bin-paths (cached)	64ms	63ms	+1%
task-ls (cached)	126ms	127ms	+0%