Skip to content

ci(renovate): the blueshell clients update without waiting out the cooldown - #1325

Merged
ExtraToast merged 1 commit into
mainfrom
worktree-renovate-first-party-no-cooldown
Sep 18, 2026
Merged

ExtraToast merged 1 commit into
mainfrom
worktree-renovate-first-party-no-cooldown

Conversation

@ExtraToast

@ExtraToast ExtraToast commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Closes #1324.

renovate.json sets minimumReleaseAge: 7 days at the top level, so every update waits a week before Renovate opens a pull request for it. That wait is a supply-chain measure: it leaves room for a compromised or broken third-party release to be pulled before this repository picks it up.

Two dependencies are not third-party. ESA-Blueshell/brevo-client and ESA-Blueshell/discord-client are ours, and the first-party-client depType already names them exactly — the custom managers follow their git tags, because GitHub Packages needs a token Renovate does not have.

Why the cooldown buys nothing there

The clients' own dependencies serve their cooldown in the client repositories, before a client release exists. A second week here holds back nothing that was not already held.

What is left in a client release is our own code, and it is there because the API changed. A client tag is how an API change reaches this site, so the delay is a week of the site talking to the API on the old contract.

How

The first-party-client rule sets minimumReleaseAge: null, which clears the inherited value for that depType alone. A new client tag now opens its pull request on the next Renovate run.

Not in scope

The global minimumReleaseAge: 7 days stands, and so does every other rule. ghcr.io/esa-blueshell/* images stay disabled, and the @esa-blueshell/* npm and net.blueshell.clients maven lookups stay off — the custom managers cover those, and their updates arrive as first-party-client too.

The clients still group into one blueshell generated clients pull request, and a major bump still waits for dashboard approval.

Verification

renovate-config-validator on the changed file: INFO: Config validated successfully.


Diff breakdown added removed, scaled to the largest row.

repo                                                +3     -1    1
  build & config     ████████████████████░░░░░░     +3     -1    1

──────────────────────────────────────────────────────────────────
total (hand-written)                                +3     -1  1 file

@ExtraToast
ExtraToast merged commit ae2028c into main Sep 18, 2026
25 checks passed
@ExtraToast
ExtraToast deleted the worktree-renovate-first-party-no-cooldown branch September 18, 2026 12:01
@ExtraToast ExtraToast added dependencies Pull requests that update a dependency file ci area:ci-cd labels Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:ci-cd ci dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Blueshell client updates skip the release cooldown

1 participant