Review Ansible role updates before merging

.github/renovate.json

@@ -66,18 +66,6 @@
       ],
       "allowedVersions": "/^v0\\./"
     },
-    {
-      "description": "Automerge version bumps of roles maintained in the MASH organization and of devture roles (via branch push - no PR)",
-      "matchManagers": [
-        "ansible-galaxy"
-      ],
-      "matchSourceUrls": [
-        "https://github.com/devture/com.devture.ansible.role{/,}**",
-        "https://github.com/mother-of-all-self-hosting{/,}**"
-      ],
-      "automerge": true,
-      "automergeType": "branch"
-    },
     {
       "description": "Housekeeping updates merge via branch push (no PR, no email); a failure on the branch still surfaces as a PR. i18n/requirements.txt bumps are exercised by the Matrix i18n workflow before merging.",
       "matchFileNames": [

docs/renovate.md

@@ -4,6 +4,13 @@ SPDX-FileCopyrightText: 2026 Slavi Pantaleev
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
+# Reviewing role dependency updates
+
+Renovate opens pull requests for Ansible role version updates instead of merging their branches
+directly. Review the released role changes and the playbook wiring before merging; a role update may
+need a playbook adaptation even when its role tests pass. Other dependency classes retain their
+separate Renovate policies.
+
 # Maintaining the Renovate runner
 
 The self-hosted runner version is pinned in [`.github/workflows/renovate.yml`](../.github/workflows/renovate.yml). Renovate updates this pin and automerges passing updates according to [`.github/renovate.json`](../.github/renovate.json).