chore(deps): automate Gemfile.lock maintenance (phase 1) (#34666)

* chore(deps): automate Gemfile.lock maintenance (phase 1)

Automate Gemfile.lock generation and periodic maintenance for compliance mandate https://b.corp.google.com/issues/509981628.

* fix(deps): exclude spanner from default batch and force-stage generated lockfiles

* fix(ci): pin action references to SHAs and harden workflow permissions per zizmor audit

* fix(deps): remove spanner from renovate config and scope lockfile staging

* fix(deps): remove Gemfile.lock from gitignores and refine Phase 1 target list

Remove Gemfile.lock from root and Phase 1 gem .gitignore files so lockfiles can be tracked.

Remove google-cloud-spanner from Phase 1 target matrix in generate-lockfiles.yml and renovate.json as it is hosted in ruby-spanner.

* fix(deps): scope Phase 1 lockfiles and remove external write action

Restore Gemfile.lock in root .gitignore and use explicit !Gemfile.lock negation rules in Phase 1 libraries per reviewer recommendation.

Remove third-party write action (generate-lockfiles.yml) to eliminate software supply chain risk in GitHub Actions runners.

Check in initial Gemfile.lock files directly for Phase 1 libraries (google-cloud-core, google-cloud-storage, google-cloud-pubsub, google-cloud-bigquery, google-cloud-errors).

* fix(deps): restrict Renovate bundler manager to Phase 1 target libraries

Update renovate.json syntax to use modern config:recommended and managerFilePatterns to restrict file scanning to the 5 Phase 1 libraries.

* fix(deps): explicitly disable Renovate processing for non-Phase 1 libraries

Add negation matching rules (!google-cloud-core/**, etc.) with enabled: false to packageRules in renovate.json. This ensures that while Renovate discovers all Gemfiles during initial repository extraction, all 881 non-Phase 1 libraries are completely disabled and dropped from update evaluation.

---------

Co-authored-by: Yoshi Automation Bot <yoshi-automation@google.com>

Author: torreypayne

.github/renovate.json

@@ -1,6 +1,46 @@
 {
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base"
+    "config:recommended"
   ],
-  "rangeStrategy": "widen"
+  "semanticCommits": "enabled",
+  "semanticCommitType": "chore",
+  "semanticCommitScope": "deps",
+  "rangeStrategy": "widen",
+  "lockFileMaintenance": {
+    "enabled": false
+  },
+  "packageRules": [
+    {
+      "description": "Disable Renovate processing for non-Phase 1 gems during phased rollout",
+      "matchFileNames": [
+        "!google-cloud-core/**",
+        "!google-cloud-storage/**",
+        "!google-cloud-pubsub/**",
+        "!google-cloud-bigquery/**",
+        "!google-cloud-errors/**"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Phase 1: Core & Handwritten Gems Lockfile Rollout",
+      "matchFileNames": [
+        "google-cloud-core/**",
+        "google-cloud-storage/**",
+        "google-cloud-pubsub/**",
+        "google-cloud-bigquery/**",
+        "google-cloud-errors/**"
+      ],
+      "groupName": "core handwritten gems lockfiles",
+      "rangeStrategy": "update-lockfile",
+      "lockFileMaintenance": {
+        "enabled": true,
+        "automerge": false,
+        "schedule": [
+          "before 5am on monday"
+        ],
+        "commitMessageAction": "maintain Gemfile.lock files"
+      }
+    }
+  ]
 }

google-cloud-bigquery/.gitignore

@@ -7,3 +7,6 @@ jsondoc/*
 
 # Ignore YARD stuffs
 .yardoc
+
+# Allow tracking Gemfile.lock for Phase 1 rollout
+!Gemfile.lock