ci(renovate): the blueshell clients update without waiting out the cooldown - #1325
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1324.
renovate.jsonsetsminimumReleaseAge: 7 daysat the top level, so every update waits a week before Renovate opens a pull request for it. That wait is a supply-chain measure: it leaves room for a compromised or broken third-party release to be pulled before this repository picks it up.Two dependencies are not third-party.
ESA-Blueshell/brevo-clientandESA-Blueshell/discord-clientare ours, and thefirst-party-clientdepTypealready names them exactly — the custom managers follow their git tags, because GitHub Packages needs a token Renovate does not have.Why the cooldown buys nothing there
The clients' own dependencies serve their cooldown in the client repositories, before a client release exists. A second week here holds back nothing that was not already held.
What is left in a client release is our own code, and it is there because the API changed. A client tag is how an API change reaches this site, so the delay is a week of the site talking to the API on the old contract.
How
The
first-party-clientrule setsminimumReleaseAge: null, which clears the inherited value for thatdepTypealone. A new client tag now opens its pull request on the next Renovate run.Not in scope
The global
minimumReleaseAge: 7 daysstands, and so does every other rule.ghcr.io/esa-blueshell/*images stay disabled, and the@esa-blueshell/*npm andnet.blueshell.clientsmaven lookups stay off — the custom managers cover those, and their updates arrive asfirst-party-clienttoo.The clients still group into one
blueshell generated clientspull request, and a major bump still waits for dashboard approval.Verification
renovate-config-validatoron the changed file:INFO: Config validated successfully.Diff breakdown —
█added░removed, scaled to the largest row.