Thanks Chad
I've done some more investigation and you're right - there's some upstream pipelines set to "Regularly fetch updates to this repository" rather than our company strategy of "Fetch updates only on webhook or manual trigger". I wasn't aware that upstream material configurations could affect downstream ones. We rely on templates for the majority of our pipeline creations, and use an in-house tool (relying on GoCD APIs) that explicitly specify 'autoUpdate="false"'. It's been a while since I've created a pipeline from the GoCD wizard or from scratch, so not sure if this has always been the case, but through the GoCD GUI Create Pipeline workflow, the material configuration is selected before a template is chosen, meaning templates cannot control advanced material configuration, such as autoUpdate="false". Unless the user selects this from the material Advanced menu at the time, the default is essentially 'autoUpdate="true"'. I think that a bunch of these has crept in since I last cleared them up.
For posterity for anyone else reading this, some contextual info is useful to know:
1. When "Regularly fetch updates to this repository" is selected, it is not explicitly expressed in the XML. Its absence on the line beginning <git url=" under the material configuration defines it, somewhat unintuitively. For instance, if you set autoUpdate="true", GoCD will simply delete the key value pair, and "Regularly fetch updates to this repository" is selected.
2. When "Fetch updates to this repository only on webhook or manual trigger" is selected, on the line beginning <git url=" the property of autoUpdate="false" appears to show this in the XML.
3. This property must be the same over all pipelines which use the same material. You cannot have one pipeline which pulls and one which receives a push for the same material.