Skip to content

fix(renovate): stop behind-base rebases resetting the pr-cooldown clock #287

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevSecNinja merged 1 commit into from
Jul 27, 2026
Merged

fix(renovate): stop behind-base rebases resetting the pr-cooldown clock #287

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .renovate/packageRules.json5
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,14 +53,15 @@
minimumReleaseAge: "14 days",
},
{
description: "ghcr.io / lscr.io / quay.io do not expose a trusted release timestamp, so the default timestamp-required behaviour marks every release 'pending' forever and no PR is ever created. Treat missing timestamps as stable so Renovate opens the PR (and enables automerge); the 14-day soak is instead enforced by the pr-cooldown required status check. Placed after the generic docker rule so it wins. See docs/design-decisions/0005-pr-age-cooldown-for-untrusted-timestamps.md.",
description: "ghcr.io / lscr.io / quay.io do not expose a trusted release timestamp, so the default timestamp-required behaviour marks every release 'pending' forever and no PR is ever created. Treat missing timestamps as stable so Renovate opens the PR (and enables automerge); the 14-day soak is instead enforced by the pr-cooldown required status check, which measures the PR branch head commit age. rebaseWhen:conflicted stops behind-base-branch rebases from rewriting that commit on every base change and perpetually resetting the cooldown clock (branch protection is non-strict, so a behind-base branch still auto-merges once soaked). Placed after the generic docker rule so it wins. See docs/design-decisions/0005-pr-age-cooldown-for-untrusted-timestamps.md.",
matchDatasources: ["docker"],
matchPackageNames: [
"/^ghcr\\.io\\//",
"/^lscr\\.io\\//",
"/^quay\\.io\\//",
],
minimumReleaseAgeBehaviour: "timestamp-optional",
rebaseWhen: "conflicted",
},
{
description: "Auto-merge dotfiles devcontainer image digest, patch, and minor updates via branch without tests, ignoring the global schedule and release-age soak so they can always merge. Placed after the generic docker minimumReleaseAge rule so its minimumReleaseAge:0 wins. Major bumps are intentionally excluded and left for manual review.",
Expand Down
9 changes: 9 additions & 0 deletions docs/design-decisions/0005-pr-age-cooldown-for-untrusted-timestamps.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,15 @@ Age is measured from the **branch head commit**, not PR creation: when Renovate
rebases the PR to a newer version the clock correctly restarts, so the exact
content being merged has always soaked for the full period.

Because the gate reads the branch head commit date, the gated rule also sets
**`rebaseWhen: "conflicted"`**. Renovate's default (`auto`, which becomes
`behind-base-branch` once automerge is enabled) would rebase the PR every time
`main` advances, rewriting the head commit and resetting the cooldown clock
forever on an active repo. `conflicted` limits rebases to genuine merge
conflicts; branch protection is non-strict
(`strict_required_status_checks_policy: false`), so a behind-base gated PR still
auto-merges once the soak completes — no rebase required.

Datasources that DO provide a trusted timestamp (docker.io, github
tags/releases) are left on the default `timestamp-required` +
`internalChecksFilter: strict` path — their soak is enforced natively and they
Expand Down
Loading