Automerge GitHub Actions updates - #134
Conversation
Permit Renovate to merge GitHub Actions updates once the inherited release-age policy and CI requirements are satisfied.
WalkthroughThe Renovate configuration adds an automerge rule for Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@renovate.json`:
- Around line 6-12: Add an explicit minimumReleaseAge value to the GitHub
Actions rule identified by its matchManagers entry, and configure the rule to
require the “CI / test” status check on main before automerging. Keep the
existing automerge behavior and description unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| { | ||
| "description": "Automerge GitHub Actions updates after release-age and CI checks", | ||
| "matchManagers": [ | ||
| "github-actions" | ||
| ], | ||
| "automerge": true | ||
| }, |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
npx --yes --package renovate -- renovate-config-validator --strict
npx --yes --package renovate -- \
renovate --platform=local --dry-run=extract --print-config \
> /tmp/renovate-effective-config.log
rg -n '"minimumReleaseAge"|"internalChecksFilter"|"ignoreTests"|"platformAutomerge"' \
/tmp/renovate-effective-config.log
repo="$(gh repo view --json nameWithOwner -q .nameWithOwner)"
branch="$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name)"
gh api "repos/${repo}/branches/${branch}/protection/required_status_checks" \
--jq '{contexts, checks}'Repository: TryGhost/vscode
Length of output: 2293
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- renovate.json ---'
cat -n renovate.json
printf '%s\n' '--- Renovate-related configuration ---'
rg -n -i 'minimumReleaseAge|internalChecksFilter|ignoreTests|platformAutomerge|automerge|github-actions' \
--glob '!node_modules' --glob '!dist' --glob '!build' .
printf '%s\n' '--- GitHub workflow files ---'
git ls-files '.github/workflows/*' | while IFS= read -r file; do
printf '\n--- %s ---\n' "$file"
cat -n "$file"
done
printf '%s\n' '--- Repository identity and branch protection ---'
if command -v gh >/dev/null 2>&1; then
repo="$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || true)"
branch="$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name 2>/dev/null || true)"
printf 'repo=%s\nbranch=%s\n' "$repo" "$branch"
if [ -n "$repo" ] && [ -n "$branch" ]; then
gh api "repos/${repo}/branches/${branch}/protection/required_status_checks" \
--jq '{contexts, checks}' 2>&1 || true
fi
else
printf '%s\n' 'gh is unavailable'
fiRepository: TryGhost/vscode
Length of output: 3828
🌐 Web query:
TryGhost Renovate "@TryGhost:quietJS" minimumReleaseAge
💡 Result:
In the context of TryGhost's Renovate configuration, minimumReleaseAge is a security-focused setting used to delay dependency updates until a specified time has passed since the release [1][2]. This helps mitigate supply chain risks by ensuring new, potentially malicious, or unstable packages have time to be vetted by the community and security tools [3][2]. Specific details regarding the @tryghost:quietJS preset and minimumReleaseAge include: 1. Preset Definition: The quietJS configuration (often referenced as quiet.json5 in the TryGhost/renovate-config repository) uses security:minimumReleaseAgeNpm as a standard practice [1]. 2. Custom Overrides: Within the TryGhost configuration, specific package groups—such as @tryghost packages and Koenig-related packages—are explicitly configured with "minimumReleaseAge": "0 days" [1]. This override ensures that updates for their own internal, trusted packages are not delayed by the general security soak time [1]. 3. Mechanism: When minimumReleaseAge is set (e.g., to a specific duration like 7 days), Renovate checks the release timestamp of a package [3][2]. If the elapsed time is less than the configured minimumReleaseAge, Renovate marks the update's status as "pending" rather than suggesting it immediately [3][2]. It is important to note that TryGhost has migrated from legacy npm-hosted presets to repository-backed presets (e.g., using github>tryghost/renovate-config:quiet.json5), which allows them to maintain these granular controls over their dependency update strategy [4].
Citations:
- 1: https://github.com/TryGhost/renovate-config/blob/main/quiet.json5
- 2: renovatebot/renovate@cba077e
- 3: https://docs.renovatebot.com/key-concepts/minimum-release-age/
- 4: chore: migrate Renovate config to repo-backed preset Ghost-CLI#2067
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- Renovate preset references in repository metadata ---'
rg -n -i 'tryghost|quietJS|renovate|minimumReleaseAge|branch protection|required status|status checks' \
README.md package.json package-lock.json yarn.lock .github . 2>/dev/null \
--glob '!node_modules' --glob '!dist' --glob '!build' | head -250
printf '%s\n' '--- Public GitHub repository metadata ---'
curl -fsSL 'https://api.github.com/repos/TryGhost/vscode' |
jq '{default_branch: .default_branch, archived: .archived, visibility: .visibility}' 2>&1 || true
printf '%s\n' '--- Public branch-protection and ruleset endpoints ---'
for endpoint in \
'https://api.github.com/repos/TryGhost/vscode/branches/main/protection/required_status_checks' \
'https://api.github.com/repos/TryGhost/vscode/rulesets'; do
printf '\n%s\n' "$endpoint"
curl -sS -D - "$endpoint" -o /tmp/github-response.json | sed -n '1,12p'
cat /tmp/github-response.json
doneRepository: TryGhost/vscode
Length of output: 4129
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- TryGhost quietJS preset ---'
curl -fsSL 'https://raw.githubusercontent.com/TryGhost/renovate-config/main/quiet.json5' |
nl -ba | sed -n '1,220p' 2>&1 || true
printf '%s\n' '--- Renovate minimum-release-age preset definition ---'
curl -fsSL 'https://raw.githubusercontent.com/renovatebot/renovate/main/lib/config/presets/internal.ts' |
rg -n -C 8 'minimumReleaseAgeNpm|minimumReleaseAge' 2>&1 || true
printf '%s\n' '--- Workflow check-name inputs ---'
python3 - <<'PY'
from pathlib import Path
import re
for path in sorted(Path(".github/workflows").glob("*.yml")):
text = path.read_text()
name = re.search(r"(?m)^name:\s*(.+)$", text)
jobs = re.findall(r"(?m)^ ([A-Za-z0-9_-]+):\s*$", text)
print(path, "workflow_name=", name.group(1).strip() if name else "<implicit>", "jobs=", jobs)
PYRepository: TryGhost/vscode
Length of output: 632
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- TryGhost quietJS preset ---'
curl -fsSL 'https://raw.githubusercontent.com/TryGhost/renovate-config/main/quiet.json5' |
sed -n '1,220p' 2>&1 || true
printf '%s\n' '--- Preset references in fetched configuration ---'
curl -fsSL 'https://raw.githubusercontent.com/TryGhost/renovate-config/main/quiet.json5' |
rg -n -C 5 'minimumReleaseAge|security:|matchManagers|github-actions' 2>&1 || trueRepository: TryGhost/vscode
Length of output: 7423
Add an explicit release-age gate for GitHub Actions updates.
@tryghost:quietJS uses security:minimumReleaseAgeNpm, which does not apply to github-actions. Add minimumReleaseAge to this rule and require the CI / test check on main before relying on platform-native automerge.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@renovate.json` around lines 6 - 12, Add an explicit minimumReleaseAge value
to the GitHub Actions rule identified by its matchManagers entry, and configure
the rule to require the “CI / test” status check on main before automerging.
Keep the existing automerge behavior and description unchanged.
Source: MCP tools
1 participant
Configures Renovate to auto-merge all GitHub Actions updates once the inherited minimum release-age policy and CI requirements are satisfied.
This intentionally includes major GitHub Actions updates; normal package dependency major updates remain manual.