From 4da1b09c64adbf0dace3600bb79953fb5b042842 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Wed, 21 Oct 2026 16:03:31 +0300
Subject: [PATCH] Keep Molecule Python updates within Ansible support

---
 .github/renovate.json    | 16 ++++++++++++++++
 docs/molecule-testing.md |  3 +++
 2 files changed, 19 insertions(+)

diff --git a/.github/renovate.json b/.github/renovate.json
index 66bb74eb1..67532150f 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -127,6 +127,22 @@
       "automerge": true,
       "automergeType": "branch"
     },
+    {
+      "description": "Molecule's pinned ansible-core 2.21 supports controller Python through 3.14. Keep Python updates below 3.15 until Ansible supports the newer minor and the scenarios pass on it.",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchFileNames": [
+        ".github/workflows/molecule.yml"
+      ],
+      "matchDepNames": [
+        "python"
+      ],
+      "matchDepTypes": [
+        "uses-with"
+      ],
+      "allowedVersions": "<3.15"
+    },
     {
       "description": "Automerge patch bumps of components whose role has a Molecule scenario (via branch push - no PR). A bump touches that role's defaults/main.yml, which makes the Molecule workflow run that role's scenario, so the update only merges once the component has been started on the configuration the role renders. Patch is the baseline for every covered role; explicitly approved roles may also appear in the narrower minor rule below. Keep this list in step with the roles that have a scenario - bin/check-molecule-automerge-list.py (patch rule) enforces that.",
       "matchFileNames": [
diff --git a/docs/molecule-testing.md b/docs/molecule-testing.md
index 411851fe8..5069a7034 100644
--- a/docs/molecule-testing.md
+++ b/docs/molecule-testing.md
@@ -29,6 +29,9 @@ Molecule is deliberately **not** part of the `prek` hooks. A run is far too slow
 CI uses Python 3.14, which is supported by the pinned Ansible dependencies. Keep the
 workflow's Python minor version within Ansible's supported controller versions;
 an unrestricted `3.x` can select a newer Python before Ansible supports it.
+Renovate limits this workflow's Python dependency to `<3.15` while the pinned
+Ansible supports Python only through 3.14. Raise the workflow pin and this Renovate
+limit together after upgrading Ansible and verifying the scenarios on the newer Python.
 
 `.github/workflows/molecule.yml` does not run every scenario on every push — with one repository holding every role, that would be unaffordable. Its first job works out which roles the push actually touched, keeps the ones that have a scenario, and builds the job matrix from those. A documentation change runs nothing.