mergify: fix "update PR" logic

We can no longer simply check the files list matches `[ flake.lock ]`,
since we now also touch `generated/` files.

Mergify conditions cannot be checked against "all" list items; checks
are always applied against "any" item. Therefore we need some
double-negatives to check that "any item does not match a regex that
does not match (flake.lock|generated/.*)".

Yes, this is horrible.

.github/mergify.yml

@@ -17,8 +17,15 @@ queue_rules:
           # Allow queuing PRs that have been approved
           - "#approved-reviews-by >= 1"
 
-          # Allow queuing flake.lock updates without approval
+          # Allow queuing update PRs without approval
           - and:
-              - "#files = 1"
+              # We need a double-negative, because mergify only has "any" conditions on list types...
-              - files = flake.lock
+              #
-              - author = GaetanLepage
+              # So we check if "any file does not match the regex", using the `-` prefix operator.
+              # The regex matches anything except `flake.lock` and `generated`, using a negative lookahead `(?!)`
+              #
+              # After canceling out the double-negative, the condition below is true when
+              # _all_ files match either `^flake\.lock$` or `^generated/`
+              - "-files ~= ^(?!flake[.]lock$|generated/)"
+              # Also check the PR was opened by the github-actions bot
+              - author = github-actions