apm manager updates the apm.yml copies that APM deploys

[MPV]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.134.1

Please tell us more about your question or problem

apm install copies each dependency's files into the project's harness directories, once per target. When a skill directory has an apm.yml of its own, which declares the skill's own dependencies, that file is copied too. With the claude and copilot targets it lands at:

• .claude/skills/<name>/apm.yml
• .agents/skills/<name>/apm.yml

The apm manager's managerFilePatterns (/(^|/)apm\.ya?ml$/) matches the copies. Renovate extracts them as projects of their own and opens updates for the pins inside them.

These PRs change nothing that lasts:

• The copies belong to APM: the project's apm.lock.yaml lists them under that dependency's deployed_files.
• There's no lockfile beside a copy, so the artifact update is skipped and the PR edits only the copies.
• The next apm install restores them from the package. Measured with APM 0.33.0: after editing a pin in both copies, apm install left git status clean.

Minimal reproduction: https://github.com/MPV/renovate-apm-deployed-copies

Renovate's PR, which changes only the copy: MPV/renovate-apm-deployed-copies#1

	Expected	Actual
root apm.yml	updated, as now	updated, as now
.claude/skills/<name>/apm.yml and .agents/skills/<name>/apm.yml	left alone: apm.lock.yaml lists them as deployed files	extracted, and their pins get their own updates

The workaround is ignorePaths, or a package rule that disables the manager for the copies' directories. Both have to list every target's skills directory, and APM adds targets often.

Fix: #46879. The apm manager skips an apm.yml that an apm.lock.yaml in a parent directory lists under deployed_files.

Logs (if relevant)

Logs

DEBUG: Matched 2 file(s) for manager apm
 INFO: Dependency extraction complete
       "stats": {"managers": {"apm": {"fileCount": 2, "depCount": 2}}}
DEBUG: packageFiles with updates
       "packageFile": ".claude/skills/with-dependencies/apm.yml"
         "depName": "mattpocock/skills/skills/productivity/grill-me",
         "currentValue": "v1.0.0",
         "updates": [{"newValue": "v1.3.1", "bucket": "non-major"}]
       "packageFile": "apm.yml"
         "depName": "MPV/renovate-apm-demo1/skills/with-dependencies",
         "currentDigest": "8f8e319be130cee292c4a8a8e8ff286f8271afb5",
         "skipReason": "unversioned-reference"
DEBUG: apm.updateArtifacts(.claude/skills/with-dependencies/apm.yml) (branch="renovate/mattpocock-skills-skills-productivity-grill-me-1.x")
DEBUG: apm: no lock file found
DEBUG: Updated 1 package files
DEBUG: No updated lock files in branch
 INFO: Branch created (branch="renovate/mattpocock-skills-skills-productivity-grill-me-1.x")
 INFO: PR created (pr=1, prTitle="Update dependency mattpocock/skills/skills/productivity/grill-me to v1.3.1")

[jamietanna]

@beenish-majeed https://github.com/renovatebot/renovate/blob/main/.github/contributing.md#ai-assistance-notice

[RahulGautamSingh]

Thanks for the detailed report and the reproduction. The fix in #46879 looks correct, (which makes the apm manager skip an apm.yml that a parent apm.lock.yaml lists under deployed_files).

Until it is merged, use ignorePaths for the deployed skills directories.

Further discussion can continue on the PR.