👷 skip lockfile updates for integration apps in renovate

[bcaudan]

Motivation

Follow-up to #112. After landing the packageManager fix, #109 surfaced two new Renovate failures:

• forge-vite: corepack now picks the right yarn version but hangs on the interactive download confirmation prompt.
• electron-builder-vite: yarn fails with ENOENT: ... integration-sdk.tgz because the apps depend on a build artifact (@datadog/electron-sdk: file:../../integration-sdk.tgz) that's only generated at test time by scripts/install-integration-apps.ts.

Renovate fundamentally cannot run yarn install in those directories — the file dep doesn't exist outside CI's test setup, and the committed yarn.lock is a placeholder that gets overwritten then git restored at test time anyway.

Changes

• Add a Renovate packageRule matching e2e/integration/apps/**/package.json that sets updateLockFiles: false and lockFileMaintenance.enabled: false. Renovate will still bump dep versions in those package.json files, but won't try to invoke yarn — bypassing both observed failures.

Test instructions

Config-only change; verifies on the next scheduled Renovate run. After this lands:

• Renovate PRs touching the integration apps should change only package.json, not yarn.lock.
• The artifact-update warning on Renovate PRs should disappear.

Checklist

N/A, config-only

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0850ef0155

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Separate integration app updates from the catch-all group

When an integration app dependency is a minor/patch update, it still inherits the earlier catch-all groupName, so it can be batched with root/app updates that do not set updateLockFiles: false (for example shared deps like electron, typescript, or @types/node). Renovate documents that package-rule artifact skipping in grouped branches is applied only if every upgrade in the group wants it, so mixed grouped PRs will still try to update lockfiles and hit the same missing integration-sdk.tgz/interactive yarn failures this rule is meant to avoid. Give these files their own group or exclude them from the catch-all before relying on this flag.

Useful? React with 👍 / 👎.