[pditommaso]

Why

The 1.42.2 release failed at Publish condasplit image: the Renovate buildkit update (#1213) changed the condasplit sources without bumping condasplit/VERSION, so the release refused to publish the already existing immutable v2 tag. check-version failed on #1213 but it is not a required check, so the PR was merged anyway (fixed on master by bumping to v3, 21fa507).

Changes

• build-condasplit.yml: drop the paths filter so the workflow runs on every pull request. A required check skipped by a paths filter stays pending and blocks unrelated PRs. Cost is small: check-version ~8s, test ~50s.
• build.yml: the Publish condasplit image step runs make check and then make build only when the tag is missing, instead of make release. In CI the second imagetools inspect of make release hangs ~17 minutes on a missing tag: the 1.42.2 release spent 20 of its 30 minutes in that step, with a build of ~2.5 minutes. The Makefile is left untouched because it is part of the condasplit source checksum, changing it would need a v4 bump.
• renovate.json: group condasplit Go updates in their own PR, labelled condasplit-bump, with a note to bump condasplit/VERSION and the wave.build.condasplit-image default.

After merge

Add check-version to the required status checks of the master branch protection (repo admin setting, not part of this PR).

🤖 Generated with Claude Code

[claude]

APPROVE: a CI and Renovate config change with no correctness issue found.

What changed

• build-condasplit.yml drops its paths filter so it runs on every pull request. That is needed because check-version becomes a required check: when a paths filter skips a required check, it stays pending and blocks the merge. On PRs that don't touch condasplit, make -C condasplit check passes in two cases: the tag is already published with the same source checksum, or the tag is "not published yet". So unrelated PRs aren't blocked. The default-image grep only reads files that are already in the repo, so it also passes when nothing changed.
• In Renovate, the new gomod + condasplit/** rule covers both condasplit/go.mod and condasplit/frontend/go.mod. It groups the updates, adds the condasplit-bump label, and adds a body note about the required VERSION and default-image bump. The rule comes after the go directive rule and doesn't set enabled, so Go toolchain updates stay disabled.

Non-blocking notes

• check-version now calls docker buildx imagetools inspect against public.cr.seqera.io on every PR. If the registry is down, the check fails and blocks every merge, not just condasplit changes. That's probably fine, but worth knowing.
• The test job (Go vet and test in a golang container) also runs on every PR now. It's cheap, but it could keep its own paths filter if you split it into a separate workflow, because only check-version needs to run everywhere.
• Renovate updates to the golang:1.27 base image in condasplit/Dockerfile (docker manager) also change the image sources, but the new rule doesn't label them. Consider adding dockerfile to matchManagers so they get the same note.
• Branch protection is configured outside the repo, so I couldn't verify that check-version is actually marked as required.